Ofer Caspi

Malware Researcher @ Alien Labs (AT&T CyberSecurity) | Former CheckPoint Research

[Ofer Caspi @shablolForce]

@moonlock_lab @patrickwardle @philofishal @malwrhunterteam @birchb0y @jacoblatonis @L0Psec @greglesnewich @theJoshMeister @karol_paciorek More details for JaskaGO: https://t.co/MtSfg48Zkx

[Ofer Caspi @shablolForce]

@philofishal it's a different malware. Gary-Stealer is written in C++ and behaves differently. (look on both malware reports to see the differences)

[Ofer Caspi @shablolForce]

#JaskaGO - new malware stealer infecting macOS and Windows systems flies under the radar

https://t.co/MtSfg48Zkx

#infosec #malware #threat #macOS #windows #cybersecurity

[Ofer Caspi @shablolForce]

proxy C&C on VT

#malware #infosec #cybersecurity #informationsecurity #windows #tech #ProxyNation

[Ofer Caspi @shablolForce]

Part 2 of our research: #ProxyNation - Dark Nexus Between Proxy Apps & Malware

Massive malware campaign creates proxy botnet of 400,000 peers via undetected proxy app delivery.

https://t.co/WjjE7HljNx

#macOS #malware #infosec #cybersecurity #informationsecurity #windows #tech

[Ofer Caspi @shablolForce]

Mac systems turned into proxy exit nodes by Adload:
https://t.co/UFikVLA2vj

#infosec #malware #CyberSecurity #informationsecurity

[Ofer Caspi @shablolForce]

SeroXen - new fileless and undetected RAT for sale.

https://t.co/Wmcjp6d8tf

#infosec #malware #cybersecurity #informationsecurity

[Ofer Caspi @shablolForce]

BlackGuard malware is back! Now with more capabilities like stealing your crypto currency transactions

#infosec #cybersecurity #malware #windows #crypto #Discord #Telegram #chrome #edge #Steam

https://t.co/KpPNIRcMUR

[Ofer Caspi @shablolForce]

Shikitega - New stealthy malware targeting Linux.
Main dropper is an ELF file with only 376 bytes, exploits system vulnerabilities for root access, and abuse legitimate cloud services to host its C&C
https://t.co/Q8AjwQXeJq

#infosec #cybersecurity #exploit #linux #malware #iot

[Ofer Caspi @shablolForce]

@attritionorg Yes, you are correct! The last digit got cut. The correct name is: “ET EXPLOIT VMware Spring Cloud Gateway Code Injection (CVE-2022-22947)”.
Thank you for noticing!

[Ofer Caspi @shablolForce]

@attritionorg I'm not very familiar with the detection names. I'll check it tomorrow and give you an answer

[Ofer Caspi @shablolForce]

Rapidly evolving IoT malware EnemyBot now targeting Content Management System servers and Android devices

https://t.co/V9wHfXaqfK

#infosec #malware #CyberSecurity
#Android #exploit #iot #tech

[Ofer Caspi @shablolForce]

@TracerSpiff Great work!

[Ofer Caspi @shablolForce]

BotenaGo strikes again - Malware source code uploaded to GitHub.
https://t.co/Ug63KpZZG7

Meanwhile low AV detection for new samples
#infosec #Malware #IoT #CyberSecurity #BotenaGo #Golang #Exploit

[Ofer Caspi @shablolForce]

HoHoHo new shoes by Santa? a case study of a special holiday sale

https://t.co/gGq0XTeqEa

#infosec #onlineshopping

[Ofer Caspi @shablolForce]

Read about a recent malware I found writing in Golang - BotenaGo, targeting millions of routers and IoT devices with arsenal of over 30 exploits:

https://t.co/zdXgEssbG5

#Malware #IoT #golang #Linux #Exploit #infosec

[Ofer Caspi @shablolForce]

@HildeTNT part of our work is to raise awareness. what may look bad implementation for someone with knowledge as yourself, is unknown for most of the people using those services, and how simple it is to lose there data and privacy.

[Ofer Caspi @shablolForce]

@HildeTNT @HildeTNT I’ll be glad to get the repo backup!

[Ofer Caspi @shablolForce]

@HildeTNT no hints? :) 🧐

[Ofer Caspi @shablolForce]

#TeamTNT with new campaign aka "Chimaera", posting infection statistics and numbers of cryptocurrency wallets stolen for the first time
https://t.co/5TyFT9Xf4L

#TeamTNT #malware #windows #linux #docker