🐣

principal threat researcher and professional pleb

[🐣 @sysgoblin]

the world is ending and im out here buyin crocs

[🐣 @sysgoblin]

the lord hath claimed another panel. they were taken too soon 🙏

[🐣 @sysgoblin]

dear Jesus, please give my fence the strength to remain rigid and upright #StormEunice

[🐣 @sysgoblin]

ffs jesus

[Stephan (@[email protected]) @_FirehaK]

Sad that I got beat to posting about this publicly after looking at it on and off since October, but there are a lot of great details in here about a previously unknown botnet written in Go! Here are some screenshots (including the operator's desktop) I had as well!

[🐣 @sysgoblin]

@nullcookies go off king

[ilikecats @0xilikecats]

A few hours ago, a promising token called $YEAR was airdropped. It was set up as a "year in review" of your Ethereum transaction history.

Less than an hour ago, this turned into a painful experience for buyers of the token.

Here's how $YEAR pulled the rug in under 6 hours🧵 1/

[FBI @FBI]

Happy holidays from the #FBI

[kd's modern strife 🇵🇸 @modern_kd]

@Sega__JEANAsis If this ever happens to you or anybody you know, there’s an option in that alert to view more details which tells you to bring the AirTag close or to bring it to the police

[🐣 @sysgoblin]

well i mean just fuck everything at this point right

[🐣 @sysgoblin]

log4getaboutit 🤌

[🐣 @sysgoblin]

just pushed a quick update to emulate apache/elastic, process query params, and accept POST data with a fake login form. have at it! 🍯

[🐣 @sysgoblin]

here take this 🤲🍯 #log4shell #log4j https://t.co/nEz67ACzup

[Steve Ragan ⚠️ @SteveD3]

I promised I would write a report covering my phishing research in 2021.

That report is now live:

https://t.co/rW2oIafdov

Shout out to @AmandaFGoedde for helping me edit, as well as @ninoseki for making Miteru, and @urlscanio for creating an awesome tool to help defenders.

[🐣 @sysgoblin]

here take this 🤲🍯 #log4shell #log4j https://t.co/nEz67ACzup

[Nasreddine Bencherchali @nas_bench]

#log4j thread

Detection Ideas + Yara by @cyb3rops - https://t.co/cKaYpCUodh
Hashes for vulnerable LOG4J versions by @mubix - https://t.co/frnQOIKyfb
SIGMA by @SOC_Prime - https://t.co/etSnr6gVcw
https://t.co/PH4UwT50vz
Payloads list by @GreyNoiseIO - https://t.co/JQJtjzQpUW

[🐣 @sysgoblin]

rip everyone #log4shell https://t.co/9EnFrIfG4B

[🐣 @sysgoblin]

@teachemtechy @mattyb1512 @Target @ANeilan +1

[🐣 @sysgoblin]

@m0rb https://t.co/DxDYjYDl6D

[Nixintel @nixintel]

How can you identify the plane, location, and mission commander in this image?

With the intelligence cycle and a little automation!

This @quiztime challenge from @fiete_stegers is the hardest one I've tried so far.

New #geolocation blog post: https://t.co/649JoPpS36