Ｎｉｃｋ Ｒｏｄｄｙ

Sec Ops Fella @HuntressLabs | threat hunting and malware analysis | long haired hippie | opinions expressed here are my own

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

@bsidespeoria was an absolute success! Thank you to everyone involved, excited for next year! For those that may have missed my Threat Hunting talk, you can view it now on YouTube: https://t.co/M4aVLWHucT
#CyberSecurity #BSidesPeoria #infosecurity #ThreatHunting

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

@RussianPanda9xx ANNA THATS NOT JUST ANY BALD MAN

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

@wbmmfq Dead ass just looked down at my phone and thought you tweeted about Fortnite for a sec lmao

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

@wbmmfq BRO IS FLEXING THE IDAHO PARTY DIP

[Tanner @wbmmfq]

Bing malvertizing for Docker Desktop!

hxxps[://]hub[.]docker[.]com/r/v3api/api -> hxxps[://]api-download[.]us/docker -> hxxps[://]api-download[.]us/docker/windows/dwnl[.]php?token=[64 hex chars]

Downloads DockerDesktop.]zip, contains DockerDesktop.exe (legit executable signed by International Business Machines Corporation), which sideloads libcef.dll.

Hashes:

DockerDesktop.]zip - 25c043617523fa89b58f6acd5f4b66de42587093dcd2329721f6adbbc048720b

DockerDesktop.exe (renamed jcef_helper.exe) - 8dff14efa3c2b8a348c120f5739927c1668de05c3d91425e30b4e6a3ba776791

libcef.dll - b3e51746b31bf98aa30422a81f8f356ecaaa0f4e66a19637b6639c05575a3371

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

@wbmmfq Hey, if we gotta triage this shit might as well make the name funny

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

@wbmmfq

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

More macOS clickfix + Amos Stealer deployment observed today.

C2 infrastructure: wusetail[.]com / 185[.]53[.]179[.]138

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

@RussianPanda9xx Bold of you to assume I can read, Anna

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

RMMs just becoming a shitty version of Russian nesting dolls piss me off so much. Anyway, I'll post in another 6 months xoxoxoxoxoxoxo

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

@RussianPanda9xx @wbmmfq @r3nzsec

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

@RussianPanda9xx Jarvis, hack her computer

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

@IzzyBoopFPV WHO IS THEY AND WHY DID I NEVER RECIEVE A WARNING

[Tanner @wbmmfq]

SimpleHelp C2 server: 185.135.86[.]185

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

Me but I work from home

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

LinkedIn blowing up my phone like they hit the pentagon 💀

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

RAHHHHHHH CLI GANG

[Obsidian @obsdmd]

Anything you can do in Obsidian you can do from the command line.

Obsidian CLI is now available in 1.12 (early access).

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

@RussianPanda9xx

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

My feed is constantly a tug of war between two wolves: one thinks Linux is the single greatest invention of our species, and the other thinks using Linux requires you to know how to operate a fuckin Nuclear Reactor single handedly.

[chaotic memes @memechaotic]

Pretty much.

[Ｎｉｃｋ Ｒｏｄｄｙ @RoddSec]

“Another potentially malicious RMM has-”

[smol silly cat @Catsillyness]

"How's your life go-"

Me: