STDAL

nothing new under the sun, that's why we have to rise above

[Quinten | 048.eth @QuintenFrancois]

Funny how Bitcoin is doing exactly what it does every 4 years

And people act surprised and angry

[Balaji @balajis]

Interestingly, those backups weren't just within European monasteries.

Key Roman manuscripts only survived because the Eastern Roman Empire didn't collapse. The Byzantines and the later Islamic world thus enabled the Renaissance. In modern parlance, a decentralized backup preserved Euclid, Ptolemy, and Galen till they could be re-read and appreciated one thousand years later, by a group of Europeans ready to emerge from the Dark Ages.

"...as the vast Roman Empire disintegrated, so did appreciation of these precious texts. Christianity cast a shadow over so-called pagan thought, books were burned, and the library of Alexandria, the greatest repository of classical knowledge, was destroyed.

Yet some texts did survive, and The Map of Knowledge explores the role played by seven cities around the Mediterranean — rare centers of knowledge in a dark world, where scholars supported by enlightened heads of state collected, translated and shared manuscripts.

In 8th century Baghdad, Arab discoveries augmented Greek learning. Exchange within the thriving Muslim world brought that knowledge to Cordoba, Spain. Toledo became a famous center of translation from Arabic into Latin, a portal through which Greek and Arab ideas reached Western Europe. Salerno, on the Italian coast, was the great center of medical studies, and Sicily, ancient colony of the Greeks, was one of the few places in the West to retain contact with Greek culture and language. Scholars in these cities helped classical ideas make their way to Venice in the 15th century, where printers thrived and the Renaissance took root.

The Map of Knowledge follows three key texts—Euclid's Elements, Ptolemy's The Almagest, and Galen's writings on medicine—on a perilous journey driven by insatiable curiosity about the world."
https://t.co/yskMVO3MXS

[tanuki42 @tanuki42_]

1/8 A North Korean recruiter just tried to pay me $300/month to launder his Upwork identity. Here is how the pitch works: 🧵

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft is investigating mistralai PyPI package v2.4.6 compromise. Attackers injected code in mistralai/client/__init__.py that executes on import, downloads hxxps://83[.]142[.]209[.]194/transformers.pyz to /tmp/transformers.pyz, and launches a second-stage payload on Linux. The file name transformers.pyz appears deliberately chosen to mimic the widely used Hugging Face Transformers library and blend into ML/dev environments.

The main payload is a credential stealer, but it also includes country-aware logic; it avoids Russian-language environments and contains a geo fenced destructive branch that has 1-in-6 chance of executing rm -rf / when the system appears to be in Israel or Iran.

To mitigate this threat: isolate affected Linux hosts, block 83[.]142[.]209[.]194, hunt for /tmp/transformers.pyz, pgmonitor[.]py, and pgsql-monitor.service, and rotate exposed credentials.

[Emmy Byrne @byrne_emmy12099]

Update_251001 ACM Sakesan Kantha.pdf.lnk
22180919f562fb9f6e50d7f20b2eb3f94eb009c212b74b45cf77659fe8274d5b
#APT #Kimsuky

[Baptiste Robert @fs0c131y]

New research reveals detailed analysis of DPRK VPN infrastructure used by North Korean operatives abroad.

According to technical analysis published by NK Internet Watch, "Hangro" appears to be a specialized VPN client that enables North Koreans overseas to establish secure connectivity back to domestic networks, potentially including the Kwangmyong intranet.

📍 Infrastructure spans multiple countries with servers in Russia (188.43.136.115/116) and North Korea (175.45.176.21/22)

📍 Requires mutual TLS authentication with certificates signed by internal CA "hrra2024"

📍 Uses embedded GOST cipher references suggesting Russian cryptographic influence

The research traces connections through Jo Myong Chol, a sanctioned DPRK national who registered supporting domains using the email [email protected]. This same email was used for other regime-affiliated sites including https://t.co/AWR6q5rx8B and https://t.co/qk5AgCtEuC.

1️⃣ Radio Free Asia reported North Korean trading companies pay $350 to the Shenyang consulate for Hangro access

2️⃣ Technical analysis reveals the client is derived from SoftEther VPN with custom authentication mechanisms

3️⃣ The service recently appeared on DPRK-affiliated websites as "service for visitors away from home" before disappearing in July 2025

This infrastructure represents a sophisticated method for maintaining regime connectivity with overseas operatives and commercial entities.

Source: https://t.co/ELYfnfELTZ

[The Record From Recorded Future News @TheRecord_Media]

The value of losses in crypto thefts has soared this year to more than $2 billion over the first six months, the blockchain analytics company Chainalysis says https://t.co/W6zUdxWzCn

[STDAL @stdal_]

@dystopiangf I think it's because we switched to a management era. Instead of leading to build and create new things inspired by a great vision, the "elite" now just manage stuff so that everything doesn't fall apart

[vx-underground @vxunderground]

How tf did the FBI / NSA get a picture of North Korean IT workers working

[Cyber_OSINT @Cyber_O51NT]

A recent report reveals that Pakistani freelancers are creating cracking websites linked to stealer malware, using a pay-per-install model, while exploiting SEO tactics to promote these sites amidst low prosecution risks. #cybersecurity #malware https://t.co/AkLanFGsKY

[Oleg @Cyber_0leg]

💸 From dirty crypto to clean money: how Russophone cybercriminals launder illicit crypto profits?

Fake inheritances, shady casinos, fake businesses, and shell companies.

The real bottleneck? Legalization.

🔗 Link in comments
#CTI #CryptoLaundering #DarkWeb

[Intrinsec @Intrinsec]

🔎 [THREAD] – New analysis by Intrinsec Cyber Threat Intelligence on the latest operations by Russian-aligned intrusion sets #UAC0050 & #UAC0006📢

🔗 Our Report: https://t.co/UTejWeIMKe

[Intrinsec @Intrinsec]

🔎 [THREAD] – Doppelgänger: A New Disinformation Campaign Spreading on Social Media 📢
📄 A newly released report sheds light on the tactics used by this Russian-linked network to target multiple Western countries.
⬇️

[TrendAI™ Research @trendai_RSRCH]

Fake #installers bundled with #infostealers are a constant threat, compromising user credentials and data integrity. These malicious programs often appear in search results and GitHub comments.

Find out more in our blog:⬇️ https://t.co/zdReinJnAJ

[Intrinsec @Intrinsec]

🚨 [New Report Alert!]

Our CTI team just published: "Premium Panel: phishing tool used in longstanding campaigns worldwide."

👉 This report reveals insights into a phishing kit used in campaigns for over two years!

📅Read the full report here: https://t.co/BoG4YNIeCW

[404 Media @404mediaco]

Researcher turns insecure license plate cameras into open source surveillance tool

Privacy advocate draws attention to the fact that hundreds of police surveillance cameras are streaming directly to the open internet.

🔗 https://t.co/UtmZpZhK4H

[TrendAI™ Research @trendai_RSRCH]

Earth Koshchei’s rogue Remote Desktop Protocol campaign targets government, military, and academia via spear-phishing, with alleged ties to Russia’s intelligence.

Learn more about this new threat actor’s tactic:⬇️ https://t.co/C3QgT5fTat

[BleepingComputer @BleepinComputer]

Fake LDAPNightmware exploit on GitHub spreads infostealer malware - @billtoulas
https://t.co/Nte4Usb5AH

https://t.co/Nte4Usb5AH

[Baptiste Robert @fs0c131y]

Hackers claim to have breached Gravy Analytics, a US location data broker selling to government agencies.

They shared 3 samples on a Russian forum, exposing millions of location points across the US, Russia, and Europe.

It's OSINT time! 👇

[Intrinsec @Intrinsec]

🎉 Happy New Year!

Our CTI team has just published a new report: "CryptBot: Hunting for Initial Access Vectors."

Here’s what we’ve uncovered about the malware’s spreading methods, originally shared privately with our clients in September. 🧵