Stef Rand

Senior Intelligence Analyst @RedCanary! Former DFIR @Mandiant, former @NetworkDefense intern. Psychology nerd. When I am not computering, I go outside and play!

[Stef Rand @techieStef]

Super excited to introduce Tangerine Turkey! Tangerine Turkey is @redcanary's name for a VBS worm that is delivered via an infected USB and uses a printui DLL hijack to deliver a cryptomining payload. This was a fascinating rabbit hole to go down!
https://t.co/5G7mkwR883

[Red Canary, a Zscaler company @redcanary]

📈 After ranking first for the whole year in our newly released Threat Detection Report, SocGholish takes the number one spot in our 10 top threat list for the month as well. Learn more about fake browser updates and worms in this month's edition of Intelligence Insights. https://t.co/hMX2NVLXGn

[Red Canary, a Zscaler company @redcanary]

📣 The 2025 Threat Detection Report is here! Dive into our analysis of 93,000 threats our customers' security controls missed, with actionable guidance on every page. Read the ungated report here: https://t.co/Iyv2T08cd1

[Red Canary, a Zscaler company @redcanary]

🆕 Two emerging threats make their debuts in our top 10 list: Infrared Ibis and Saffron Starling

Get detection opportunities and more in this month's edition of Intelligence Insights.
https://t.co/iMey9z58Iu

[Stef Rand @techieStef]

Exciting update to our blog! As part of our ongoing research we identified some public Github repos being leveraged that, I'm happy to say, are no longer active! More details--plus some IOCs for still-active sites--in the update.

[Red Canary, a Zscaler company @redcanary]

🗞️ Just in, from Red Canary Intel: After discovering that Tangerine Turkey’s operators pull down miner configuration files from remote resources, we reported some of their public GitHub repos, which have now been taken down. Read our updated blog for IOCs and more. https://t.co/Nc2qjyCrbd

[Red Canary, a Zscaler company @redcanary]

@techieStef Get more of this month's Intelligence Insights here: https://t.co/uUo6EqWilB

[Red Canary, a Zscaler company @redcanary]

HijackLoader—a newcomer to our monthly top 10 list—is fond of renaming executables, which presents a detection opportunity. Learn more in this month's edition of Intelligence Insights. https://t.co/CIXxO0tXke

[Red Canary, a Zscaler company @redcanary]

📈 We've seen a spike in LummaC2 stealer activity over the last two months. Get detection guidance and more in this month's edition of Intelligence Insights. https://t.co/i2eJF7j44Y

[Red Canary, a Zscaler company @redcanary]

ChromeLoader and SocGholish remained our top threats in September, but a new technique stood out, tricking users into copying a PowerShell script, pasting it into Windows Run, and executing malicious code that leads to LummaC2: https://t.co/4yJGznAsBR

[Bill Tripp @CulturalFire]

Removal Complete! Salmon can now access much more cold water habitat and excellent spawning grounds… https://t.co/yHHs5vovMW

[Red Canary, a Zscaler company @redcanary]

At the end of August 2024, Red Canary observed ransomware incidents that leveraged VPNs both as an initial access vector and to facilitate further access within organizations. https://t.co/7wWl5sSPDT

[Red Canary, a Zscaler company @redcanary]

Keep tabs on ChromeLoader and other browser-related threats in this month's edition of Intelligence Insights. https://t.co/grAEgtXaw2

[Red Canary, a Zscaler company @redcanary]

This month's newcomers:

🏵️ Amber Albatross, which starts with a potentially unwanted program and ultimately leads to a pyInstaller executable with stealer capabilities

💸 dllFake, a malware family that primarily targets browsers and crypto wallets

https://t.co/6LpGDSeaOI

[Stef Rand @techieStef]

@DannyDrinksWine Umbrellas of Cherbourg

[Red Canary, a Zscaler company @redcanary]

It's Koi phishing season! Red Canary Intel has been tracking an activity cluster that drops Koi Loader and a final payload of a .NET stealer. https://t.co/RwbiUlQXvS

[Stef Rand @techieStef]

@chrissanders88 😆 Thanks for the shout out! What can I say, malware jerks getting up to their jerky shenanigans makes me grumpy

[Red Canary, a Zscaler company @redcanary]

Keeping up with threats and trends can feel like navigating a labyrinth in the dark. @techieStef & @ForensicITGuy explore topics from our 2024 Threat Detection Report, including initial access tradecraft, cloud abuse, identity attacks, and more. 🎬 🍿 https://t.co/2oK6blxAZf

[Red Canary, a Zscaler company @redcanary]

Tax season springs financially-themed phishing lures on users, and vulnerabilities continue to sprout up in this month’s edition of Intelligence Insights. https://t.co/CZ0Pa7q9OW

[Stef Rand @techieStef]

I do not have words for how much this delights me. These loud little birds are one of my favorite things in the world. Look ye upon this glorious wrendering that captures their noisy bossy chaos. Absolutely wonderful, @thepacketrat

[Stef Rand @techieStef]

TDR Day 🥳🎉 also means it’s Threat Sounds release day!!! Vol. 4 has dropped and it’s epic, y’all! 🔥

https://t.co/Pl8mPM0G0f