sysopfb

Threat Intel as a reverse-engineer in Crimeware domain. Dubbed "Malware Mangler" by TheRegister. [email protected]

[sysopfb @sysopfb]

Maksim Yakubets was indicted but treasury department also went after Evil Corp, what is really interesting is all the alluding to them being linked to FSB and as it turns out Yakubets is married to the daughter of Eduard Bendersky. w/ Joshua Platt @ WSJPro in Charlotte, NC
1/3

[sysopfb @sysopfb]

@PandaRE__ s/next year/last year/

[Shodan @shodanhq]

Shodan Membership sale is live until 2026-08-09 00:00 UTC (~48 hours from now): https://t.co/0iqiq2vTpn

[sysopfb @sysopfb]

@RussianPanda9xx @MarioGuerraSoto I do have a question though for you and everyone I guess. I recently wrote a updated blog and left the name MetaStealer in there primarily because I felt changing it after I wrote it was disingenuous after reading your recent excellent post on RMMSystem. Should I have rewrote it?

[PandaRE 🐼 🇺🇦 @PandaRE__]

So, let's talk about MetaStealer and make sure I'm not delusional.

The actual MetaStealer is a .NET stealer I blogged about a while back: https://t.co/1xk5LoOCwF. Its seller, "META", stopped updating it around 2022 and pretty much disappeared.

The malware AVs have been flagging as "MetaStealer" is NOT that MetaStealer: https://t.co/2P1Z55jluE

What we're actually seeing is ongoing updates (since 2023) to the loader I named Potemkin: https://t.co/PJy6hRmdTJ

Turns out it was documented earlier under the MetaStealer name, kudos to @banthisguy9349 for surfacing these:
https://t.co/o56Z4FLADc
https://t.co/4trZs6V504

[sysopfb @sysopfb]

DeviceManager python backdoor/rat operates over DNS or HTTP, current C2 is setup for DNS over TXT records; https://t.co/ky93kWZM2g

[sysopfb @sysopfb]

SpectrePaste - a case of a TA leveraging AI as a primary orchestrater and developer of the entire system. https://t.co/WuJjO9QfoE

[sysopfb @sysopfb]

"tracker" piece of malware related to RMMSystem RAT(which uses metastealer URIs), uses a separate DGA but also wordlist based blog: https://t.co/Z4Wbvs0OZ3 and DGA code: https://t.co/CLsm5rWHqv

[sysopfb @sysopfb]

Dumped a bunch of notes surrounding a macos based stealer from etherhiding clickfix https://t.co/7OSGD8l9tM someone also released a blog surrounding pieces of it last night: https://t.co/Z2Gv7uJLoF

[Ctrl-Alt-Intel @ctrlaltintel]

Cool find from @sysopfb here is a couple of Images from the Panel, This specific panel was delivering a MacOS stealer notnullOSX

http.html:"notnullOSX " - Shodan Search
http://111.90.]143.163:8080/install

[sysopfb @sysopfb]

Nice writeup https://t.co/1P5sUB0UlH Of note is a panel: hxxp://65.38.120.]80:8080 they left some tidbits behind in the login page: <<label>Пул доменов (по одному на строку)</label>"oeannon.]com
heethcote.]com
windlrr.]com"

[sysopfb @sysopfb]

https://t.co/D79qFw0WRC

[sysopfb @sysopfb]

https://t.co/JNXpRozK8i

[sysopfb @sysopfb]

https://t.co/DfWSPeQEZW

[sysopfb @sysopfb]

https://t.co/g50arBh3qk

[sysopfb @sysopfb]

https://t.co/H48GQgHevx Kudos to GitHub they were taking stuff down very fast

[sysopfb @sysopfb]

https://t.co/JRVsEuHZyX

[sysopfb @sysopfb]

DFIRReport pastebin link also lines up with one of the pastebins I saw in my blog - "cLika3dt"; https://t.co/tStFUVd3VH

[sysopfb @sysopfb]

Auto decoding IOCs from Arechclient and the onboard browser extension they drop https://t.co/PCIjGz8nE4

[sysopfb @sysopfb]

Auto decoding IOCs from Arechclient and the onboard browser extension they drop https://t.co/PCIjGz8nE4