Maksim Yakubets was indicted but treasury department also went after Evil Corp, what is really interesting is all the alluding to them being linked to FSB and as it turns out Yakubets is married to the daughter of Eduard Bendersky. w/ Joshua Platt @ WSJPro in Charlotte, NC
1/3
Dumped a bunch of notes surrounding a macos based stealer from etherhiding clickfix https://t.co/7OSGD8l9tM someone also released a blog surrounding pieces of it last night: https://t.co/Z2Gv7uJLoF
Cool find from @sysopfb here is a couple of Images from the Panel, This specific panel was delivering a MacOS stealer notnullOSX
http.html:"notnullOSX " - Shodan Search
http://111.90.]143.163:8080/install
Nice writeup https://t.co/1P5sUB0UlH Of note is a panel: hxxp://65.38.120.]80:8080 they left some tidbits behind in the login page: <<label>Пул доменов (по одному на строку)</label>"oeannon.]com&#10;heethcote.]com&#10;windlrr.]com"
@diego_gg95 Oh well take what I said as a best guess, also don’t feel too bad all the detections from av on vt were less than 5 out of 60+ or however many vt uses nowadays and most were very generic detections
I got drained, fully drained.
Hi everyone, I'm just coming to share with you all the worst day of my life, and how it happened so that you guys don't ever have to pass through it.
Thread below.
@diego_gg95 The recent ones I’ve seen are LummaC with a c2 of the domain I posted. If you still have yours you can upload it to virustotal and shoot out the link to the file and we can verify if you want.
Maksim Yakubets was indicted but treasury department also went after Evil Corp, what is really interesting is all the alluding to them being linked to FSB and as it turns out Yakubets is married to the daughter of Eduard Bendersky. w/ Joshua Platt @ WSJPro in Charlotte, NC
1/3