Ross

Incident Responder @Mandiant/Google Cloud
Forensicator and rabbit hole deep diver 🤿

[Mandiant (part of Google Cloud) @Mandiant]

PRC-nexus actor UNC6508 targeted North American research, exploiting REDCap servers to deploy INFINITERED malware.

The actor remained undetected for over a year and abused enterprise admin tools for covert data exfil.

Analysis, guidance and IOCs ➔ https://t.co/xLenVImMxH

[Vitaly Kamluk @vkamluk]

Cyberpaleontology should be taught as a subject in high school!

[Brian in Pittsburgh @arekfurt]

I hate how use of the term "sophisticated" is used/abused in describing cyber actors. So here is an actually sophisticated actor.

Note the:
-decently executed multi-stage social engineering
-array of bespoke tools
-fact there's obviously complex back-end processing occurring

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft identified a campaign by North Korean state actor Sapphire Sleet employing new combinations of macOS execution patterns and techniques, enabling the actor to compromise systems through social engineering rather than software exploitation. https://t.co/7ynhI0V1sW

[vx-underground @vxunderground]

This is very good malware.

This is solid-solid-SOLID B+ malware, very close to A- malware.

APT37 is using a old-school playbook. They're doing EPO (Entry Point Obfuscation) on a self-delivered binary for evasion. They also unironically are using something akin to cavity infection ... but on themselves. This is something you saw more in the Windows 95 - Windows XP era, not something you see in 2026.

Very cool. I respect it.

The multi-staged fragmentation of shellcode phases is also really, really, really cool. This is (once again) a more old-school technique usually reserved for infected binaries, not self-delivered binaries.

Despite all of these super cool features, APT37 shoots themselves in the foot immediately.

- EAT walking for Kernel32 functionality (???)
- XOR decryption is a huge red flag
- Allocating with PAGE_EXECUTE_READWRITE (???)
- Hardcoded OAuth token (???)
- Used external dependency for AES (???)

Why not use NT functionality to hook evasion? XOR is easily identified in static analysis, why XOR? Allocating memory with VirtualAlloc with RWX is a MASSIVE RED FLAG. They also hardcode a OAuth token ... they can multi-staged shellcode payload with old-school malware techniques but hardcore AN OAUTH TOKEN?

It unironically makes me wonder if they had one old-head malware guy working on it, then they had some newer dude do the non-hardcore stuff. There is a huge gap in skill sets here.

Or the old-head hasn't kept up to date on malware stuff since 2005... or they got lazy... I don't know, really weird.

[Renzon @r3nzsec]

DFIR analysts who use macOS as their daily driver deserve free and native forensic tooling. So I built one. 🍎

Introducing 𝗜𝗥𝗙𝗹𝗼𝘄 𝗧𝗶𝗺𝗲𝗹𝗶𝗻𝗲 — a timeline analysis app built from the ground up for Mac-based DFIR folks, forensic investigators, or SOC analysts. Built in appreciation of, and inspired by, Eric Zimmerman’s Timeline Explorer.

Every feature in this tool was shaped by real IR casework. Handling massive timelines, parsing artifacts here and there, and pivoting across logs during active investigations. I built IRFlow Timeline to be the native macOS timeline analyzer that actually keeps up with a live case. Every button and view is intentional; if it’s in the app, it’s because I needed it mid-case and realized the standard tools fell short.

No dependencies. Zero setup. Just drag, drop, and analyze.

#dfir #incidentresponse #timeline #macos #threathunitng #digitalforensics

[Mandiant (part of Google Cloud) @Mandiant]

GTIG, Mandiant & partners disrupted a global cyber espionage campaign by suspected PRC-nexus actor UNC2814.

The group used a novel backdoor, GRIDTIDE, abusing Google Sheets API for C2. We dismantled the infrastructure & released IOCs.

Read more: https://t.co/rdp0GD2JXL

[Seongsu Park @unpacker]

Great deep dive from the GitLab team on DPRK’s "Contagious Interview" and illicit IT worker campaign. This isn’t just a surface-level write-up. It shows how a platform can operationalize its own telemetry, extract high-signal intelligence, and convert that into concrete, actionable insights for the broader security community. Seriously impressive work. 👏
Blog: https://t.co/B9pPZwaiuv

If you want even more context, the Three Buddy Problem podcast did a great breakdown of the blog and unpacked the tradecraft, detection implications, and what this means for defenders. TBP is basically my go-to weekend running podcast, so it was extra cool to hear them dive into this and appreciate the shoutout me, guys. 🙇‍♂️

TBP Podcast: https://t.co/fFZyUxhFYz

[Mandiant (part of Google Cloud) @Mandiant]

UNC6201 is exploiting a high-risk zero-day (CVSS 10.0) in Dell RecoverPoint for Virtual Machines.

This PRC-nexus actor has leveraged the vulnerability since mid-2024 to maintain persistent access, and distribute GRIMBOLT backdoor.

📄 Learn more:
https://t.co/Q92lmOaW8X

[Stephan Berger @malmoeb]

What I learnt today: Mandatory User Profiles

Praetorian named their blog "Persistence Through Forgotten Windows Internals", and true, at least I never heard of Mandatory User Profiles before reading this article.

In enterprise environments, administrators sometimes want to enforce a specific user profile that resets on each login. To accomplish this, Windows supports a file called NTUSER[.]MAN (the .MAN standing for “mandatory”), which takes precedence over the usual NTUSER.DAT registry hive stored in %USERPROFILE% when a user logs in.

Setting up persistence on a copy of NTUSER.DAT using the Offline Registry Library might evade some EDRs. The whole blog post is worth a read, but the TL;DR for defender is:

Consider monitoring for NTUSER[.]MAN file creation in user profile directories, especially when it doesn’t come from an enterprise profile management system.

Source:
https://t.co/9gW16tHL5t

[The Hacker News @TheHackersNews]

🕵️‍♂️💰 North Korea-linked UNC1069 used deepfake Zoom calls to hack crypto firms.

Posing via Telegram, attackers lured victims into fake meetings, triggering ClickFix commands that deployed multi-stage malware on macOS & Windows to steal wallets and credentials.

🔗 Read → https://t.co/vgPAQXtNul

[BleepingComputer @BleepinComputer]

North Korean hackers use new macOS malware in crypto-theft attacks - @billtoulas
https://t.co/IHDWEIf8R6

https://t.co/IHDWEIf8R6

[blackorbird @blackorbird]

UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering #Lazarus

The victim reported that during the call, they were presented with a video of a CEO from another cryptocurrency company that appeared to be a deepfake.
https://t.co/YboRk3Ynaj

[The Record From Recorded Future News @TheRecord_Media]

Incident responders said North Korean hackers used a deepfake video call to convince an official at a cryptocurrency company to install malware on their device https://t.co/8b1TdlOS4L

[Alexandre Borges @ale_sp_brazil]

This presentation remains the go-to reference for learning the inner workings of the IDA Pro Hex-Rays decompiler:

(video) https://t.co/20HMiMjMv2

(article) https://t.co/wcwWv1OPia

#decompiler #reverseengineer #informationsecurity #cybersecurity

[Mandiant (part of Google Cloud) @Mandiant]

North Korean actor UNC1069 is targeting the crypto sector with AI-enabled social engineering, deepfakes, and 7 new malware families.

Get the details on their TTPs and tooling, as well as IOCs to detect and hunt for the activity detailed in our post 👇

https://t.co/t2qIB35stt

[Ross @rdi_x64]

See how DPRK-nexus actors are leveraging deepfake video to compromise the systems of high-value targets within the Cryptocurrency industry. This IR engagement also yielded some very fruitful findings on the toolset deployed by the threat actors once they had inital access.

[John Hultquist @JohnHultquist]

Another DPRK incident where it looks like deepfake video was involved. North Korea keeps coming up when it comes to this issue. https://t.co/llyENWsKvH

[blackorbird @blackorbird]

ProfileHound is a post-escalation tool to help find and achieve red-teaming objectives by locating domain user profiles on machines. It uses the BloodHound OpenGraph format to build a new edge called which determines if a user profile exists on a computer. This edge allows operators to make informed decisions about which computers to target for looting secrets.
https://t.co/l524stExDt

[Craig Rowland - Agentless Linux Security @CraigHRowland]

How a packet moves through the Linux kernel. Often you'll find Linux kernel docs are outdated and piecing together information like this is a real chore.

[Mandiant (part of Google Cloud) @Mandiant]

📣 Everything defenders need to know about UNC1549: a deep dive analysis of suspected Iran-nexus espionage targeting the aerospace, aviation, and defense industries in the Middle East.

Dive into the details: https://t.co/N2KBeHdJ7z