B*TCH on Wheels

Walk more Talk Less.

[Alberta Radio! @albertaradios]

If you're into cybersecurity/exploits/counter - use AI. Build your own AI box if needed. You'll all thank me later 😘

[clibm079 @clibm079]

APT Encyclopedia
Threat Intelligence Database

https://t.co/ntvsAEhCEe

[MagicSword @magicswordio]

Kiosks are everywhere... But how often are they actually exploited? Is this an underrepresented attack surface? And does app control even make sense in a kiosk environment? This Thursday, @CroodSolutions and @Shammahwoods join us to get into it.

Register to join: https://t.co/6feNkfHsDv

[UAlberta Insider(z) @UCPGoA23]

@userlolxxl @skocherhan @usetraceix @ADanielHill @MalbearLabs @three_cube @UK_Daniel_Card @magicswordio @LevelBlueCyber @medsci_yb3r @TeamNAIT @CBCEdmonton @TheBreakdownAB @albertaradios @cspotweet @CreesOnCBC @YourAlberta @Treaty8FNA @cybercentre_ca By @medsci_yb3r:
ualbertaca[.]onmicrosoft[.]com
Tenant ID: 718b8a9b-44d8-441a-a344-4294ea842172

https://t.co/jI0abwTQhI

https://t.co/Pj9xsQvdcD

https://t.co/T5anPVyPXe

https://t.co/ETUUy1lMSy

https://t.co/I2GpvVNZR2

https://t.co/j5FLFdvKMD

https://t.co/PY3gYsKFXR

[@CanadianProtest @CanadianPro2]

@Furnace_roofho @BornFree_isms @medsci_yb3r @UCPGoA23 @userlolxxl @albertaradios Bwahahaha!

Me too.

How dare she?

Forgot @TeamNAIT too.

Wonder why she did this?
🤗💖

[B*TCH on Wheels @TeamNAIT]

@CanadianPro2 @Furnace_roofho @BornFree_isms @medsci_yb3r @UCPGoA23 @userlolxxl @albertaradios Weird. @medsci_yb3r told us to leave them alone - not worth any of our time. He tried to reply with he's "happy to meet whoever in-person with documents on-hand" if they have any follow up questions lol.

We're sure you've seen his OCD work too. Something re: Mental Health.

[Clandestine @akaclandestine]

DNS is the layer an operator reads before they touch the app. https://t.co/wA8QhsIVSR scans from the outside, no zone file and no creds, the same vantage as recon: SPF/DMARC, DNSSEC, lame NS, takeover, suspicious TXT, DDNS, parked domains, registrant exposure.
Built by Esteban Borges (@tuitesteban), Octopus at @Huntio and founder of @dnsaudit. Hunt Intelligence hunts C2 and netblocks, and the scanner asks the question he already asks of a domain: who owns it, is the delegation alive, what is dangling.
Three intelligence reads. Lame delegation is a hijack primitive: parent still delegates, child NS stopped answering. Mail policy is campaign prep: DMARC at p=none and MX on a parked domain mean the brand is spoofable before the first lure. TXT and DDNS are pivots, not verdicts: v1.2 claimed 56 TXT patterns and 275 DDNS suffixes. Correlate with age, TLD, and registrar lock. Do not auto-block.
v1.3 adds a Domain Exposure Engine, 26 checks and a separate score: expiry, redemption, transfer, age, DNSSEC, WHOIS privacy. WhoisXML API puts ownership next to the finding. JSON and pip install dnsaudit feed SOAR. It does not replace passive DNS or a sandbox. On their numbers, ~20.9k of ~23.6k scanned domains had a critical finding.
https://t.co/58yqw9Ot5S

[Sandfly Security @SandflySecurity]

Attackers are encrypting payloads to sneak malware past Linux defenses. Spoiler: it doesn't work.Sandfly Founder, @CraigHRowland breaks down the Linux malware trends we're seeing on @DestLinuxPod 👇

[TheCyberPatronNetwork © @TheCyberPatron_]

What does your Digital Footprint say about you?

[B*TCH on Wheels @TeamNAIT]

@medsci_yb3r @UCPGoA23 @userlolxxl @skocherhan @usetraceix @ADanielHill @MalbearLabs @three_cube @UK_Daniel_Card @magicswordio @LevelBlueCyber @CBCEdmonton @TheBreakdownAB @albertaradios @cspotweet @CreesOnCBC @YourAlberta @Treaty8FNA @cybercentre_ca The other device being that @Dell workstation travelling b/w @youralberta @ualberta @AHS_media that contains access to Everyone's PII/PHI ??

That device = a 'Spreader' at best.

That does seem like a problem.

[UAlberta Insider(z) @UCPGoA23]

VirusTotal (6/64):

SHA-256: f7aef71e43e49854e73439866c74c1cc1ae1f81a7824d16cda443ccd5d10ae5f

https://t.co/PukUlGKyDC

@RecordedFuture

https://t.co/QVzKKWcnnz

https://t.co/n6X6eYUswS
https://t.co/s8jxSY7lkO

https://t.co/7u0fQuWYde
n = 600+

[UAlberta Insider(z) @UCPGoA23]

@userlolxxl @skocherhan @usetraceix @ADanielHill @MalbearLabs @three_cube @UK_Daniel_Card @magicswordio

How to explain to: Citizen / Law-Enforcement

Privileged email -> ATO/BEC -> Subdomain?

#Healthcare #Education #Government

@LevelBlueCyber OTX 2096

https://t.co/tsRpfzm1XK

[UAlberta Insider(z) @UCPGoA23]

@TeamNAIT @medsci_yb3r we did a thing = took initiative.

A "DEMONSTRATION" (passive collection).

Let us know if Officer Alex Wheadon of the RCMP contacts you.

In the above image #YARA scan of #VECT Ransomware.

Case no. 2026972763

@MondoABx @Furnace_roofho @gilmcgowan

[B*TCH on Wheels @TeamNAIT]

@UCPGoA23 @UAlberta @YourAlberta @Innovation_AB @NathanIpYEG @nateglubish @nenshi @RCMPAlberta @edmontonpolice @medsci_yb3r @LevelBlueCyber @edmontonjournal @CBCEdmonton @GlobalEdmonton @ABLabourToday @cspotweet @TheBreakdownAB @albertaradios @medsci_yb3r 😱 hahaha

Not incorrect. Passive scans are perfectly fine. Questionable how ya'll collected the #Data -> Hell no are they going to find this.

But it does fill in some gaps in 'Leadership, Knowledge, and Basic Cybersecurity Hygiene'.

😂

@nateglubish @NathanIpYEG

[UAlberta Insider(z) @UCPGoA23]

Busy Day. Diff. Teams. Same results = DEMONSTRATION

Found on YOUR: A) Networks & B) Devices

Samples collected @UAlberta @YourAlberta @Innovation_AB @NathanIpYEG @nateglubish @nenshi #Government offices AND @RCMPAlberta @edmontonpolice HQ

Publicly available. Good luck. #VECT

[userlolxxl @userlolxxl]

@UCPGoA23 @YourAlberta @medsci_yb3r @TeamNAIT @LevelBlueCyber @virustotal @TELUS @Rogers @Bell @FreedomMobile did a minor update "Copy of gatestone[.]co - 10.03.26 gatestoneco[.]com"https://t.co/0ncZ47pRfq @skocherhan as we discussed how can be reserved IP employed in malware transitions - read collection by "casmic6022" 👇https://t.co/OxNDO4wrkr & "Localghost" https://t.co/3teNFk1kQT

[B*TCH on Wheels @TeamNAIT]

@RichardKnack @Furnace_roofho @UCPGoA23 @CanadianPro2 @medsci_yb3r @MondoABx @albertaradios @PeterGuthrie99 @UAlberta @YourAlberta @ElectionsAB @LukaszukAB @nenshi @ABDanielleSmith @Alberta_UCP @UCPCaucus already has much of this information. It is not by 'pure luck' they get away with the things they do.

@albertaNDP @nenshi @NathanIpYEG @JanisIrwin do not have this 'advantage' - nor do the RCMP

[UAlberta Insider(z) @UCPGoA23]

@userlolxxl @YourAlberta @medsci_yb3r @TeamNAIT @LevelBlueCyber @virustotal @TELUS @Rogers @Bell @FreedomMobile Fraud Alert Update for #Alberta

STRONGLY advised to not provide ANY personal info if contacted over phone.

Thanks @userlolxxl

@medsci_yb3r @TeamNAIT

Thanks @albertaNDP @NathanIpYEG @jodi_stonehouse @JodiCalahoo @JanisIrwin & @mlasinclair @PeterGuthrie99 for allowing this

[UAlberta Insider(z) @UCPGoA23]

@userlolxxl @YourAlberta @medsci_yb3r @TeamNAIT @LevelBlueCyber @virustotal @TELUS @Rogers @Bell @FreedomMobile @albertaNDP @NathanIpYEG @jodi_stonehouse @JodiCalahoo @JanisIrwin @mlasinclair @PeterGuthrie99 Available at @virustotal

https://t.co/2NLacpEiYB

We also read reports & documentation.

It appears that @orlaghokelly of OKelly #Indigenous Law has a lot of work heading her way.

Please message @medsci_yb3r for further guidance and notify your clients @RussDiabo @CreesOnCBC