Saide

Seeker | hunting threats @unit42_intel | ex @msftsecurity

[Saide @saidesheikh]

Excited to be joining the speaker lineup at VULNCON 2026.

Looking forward to sharing lessons from real-world investigations and meeting fellow defenders, threat hunters, and incident responders.

See you in Bengaluru on 12-13 June, 2026.

[VULNCON @vulncon]

Bringing expertise in SIEM operations and cyber threat intelligence, Saide Sheikh, Detection and Response Analyst at Palo Alto Networks Unit 42 is joining the Technical Speaker Lineup at VULNCON 2026.

From dissecting attacker behavior across endpoints, networks, and cloud environments to driving investigations from initial detection to root cause analysis, Saide Sheikh brings a practitioner’s perspective to modern cyber defense.

At VULNCON, Saide will share insights drawn from real-world investigations, helping attendees better understand how adversaries operate. Join VULNCON 2026 to understand how signals emerge from the noise, and how effective defenders connect the dots to uncover sophisticated threats.

📍 NIMHANS Convention Centre, Bengaluru
📅 12th & 13th June, 2026

Last Minute Sale ends on 9th June. This is your final opportunity to secure a spot at VULNCON 2026.
https://t.co/f0N3NtzFcT

#VULNCON2026 #Vulncon #CyberSecurity #ThreatHunting #IncidentResponse #ThreatIntelligence #BlueTeam #SOC #CyberDefense

[Saide @saidesheikh]

Some fresh Intel.. Imagine wanting to compile "Hello World" and ending up victim of an Ethereum-backed malware heist. 💀 #RemusStealer

[Unit 42 @Unit42_Intel]

Users attempting to download open-source C++ IDE are hijacked via malicious CloudFront JS on-click, redirecting to fake MEGA-Transfer pages delivering #RemusStealer. Details at https://t.co/B9QBHn2xz0

[Saide @saidesheikh]

@BHinfoSecurity @ActiveCmeasures @BHinfoSecurity @ActiveCmeasures will this be recorded?

[Saide @saidesheikh]

Investigated #KongTuke #ClickFix abuse of DNS TXT records delivering a PowerShell botnet agent. The script contains XOR-obfuscated code, patches AMSI, disables PS ETW, polls C2, executes via IEX, and exposes an interactive cmd.exe shell. Persistence logic exists but was disabled.

[Unit 42 @Unit42_Intel]

We discovered the #KongTuke campaign using #DNS TXT records in its #ClickFix script. These DNS TXT records staged a command to retrieve and run a PowerShell script. We continue to monitor ClickFix campaigns for any future occurrences. Details at https://t.co/nU4KHPPlk5

[Saide @saidesheikh]

Glad to have been a part of this #ThreatIntelligence

[Unit 42 @Unit42_Intel]

Attackers are leveraging #SEOpoisoning and abusing online repositories to target users looking for legitimate tools. Associated ZIP archives contain BAT files that impersonate various applications. C2 server returns follow-up remote admin tool. Details: https://t.co/rzjp8ZLqBv

[Microsoft BlueHat @MSFTBlueHat]

The BlueHat India Villages are now open! Swing by between sessions and get hands-on, challenge your skills, and connect with security experts.

AI in Security Village: Explore AI’s role in cybersecurity and test yourself with AI-themed CTF challenges
Garage Village: Try soldering workshops and live 3D printing demos, perfect for prototyping newbies
Forensics Village: Learn digital forensics techniques, take a quiz, and join the CTF
MSRC Village: Hunt bugs, spot insecure code, dive into a phishing CTF, and get the scoop on bounty programs
AppSec Village: Brush up on secure coding, take on quizzes, and test yourself in CTF + RTF challenges
Arena: Don’t miss fireside chats on Diversity & Inclusion and the future of Quantum Computing

Which village are you checking out first?

#BlueHatIndia

[Baptiste Robert @fs0c131y]

@TecmundoDigita @PredictaLabOff @EquationCorp Is Luan USDoD?

Yep he confirmed it to a statement to HackRead 2 hours ago

https://t.co/KbeqnMNuqa

[Traceix @usetraceix]

Push straight to prod.

Testing is for the weak.

[chientrm @realchientrm]

He nearly make it tbh.

CVE-2024-3094

Until next time.

[Saide @saidesheikh]

Was going through Malware Analysis Fundamentals on @LetsDefendIO

Ironic enough? 🤔🤔

[Saide @saidesheikh]

Just when I thought I dodged a bullet by not going crazy during the meta downtime, LinkedIn decides to go on a break.

#LinkedInDown #LinkedIn

[inversecos @inversecos]

threat intelligence is basically stalking people for a living

[Saide @saidesheikh]

Check out my article: 3CX Supply Chain Compromise -
A Personal Perspective https://t.co/hFLc358UPJ via @LinkedIn

[Saide @saidesheikh]

@InfosecVandana It was nice to meet you!

[Saide @saidesheikh]

@nullcon last weekend was a blast - got to meet some fantastic new folks and reconnect with familiar ones! 🤝

#NullconGoa2023 #Nullcon #Infosec #CyberSecurity

[Saide @saidesheikh]

Souvenir from @seasides_conf

#Seasides #Infosec #SeasidesGoa2023

[vx-underground @vxunderground]

Threat Actors when they trip the EDR

[Jake Williams @MalwareJake]

Newton's First Law of Security Engineering: There's nothing more permanent than a temporary solution...

[Saide @saidesheikh]

@NoContextHumans @GetVideoBot

[Samir @SBousseaden]

:)