tephracore

The Art of DarkIntelligence

[tephracore @tephracore]

Introducing "Tactical Malware Analysis", the 1st advanced Malware training by the United Arab Emirates. This is an exclusive training delivered in Dubai and Abu dhabi: https://t.co/M3BhJx2Zxt get your seat before it's too late #noexcuses #الامن_السيبراني #malware #uae #Training

[tephracore @tephracore]

New leak site Bonaci Group. So far exposing data of two American law firms.

[tephracore @tephracore]

We analyzed the provided leak file RareChems.txt cc7ca07681f7d977f74dcc22cf1286de786d77b071e467cbe19c544858861887 it content seems valid. the leak was created with mysqldump tool (good indication of a full compromise of the database)

[tephracore @tephracore]

LEAK🔓: RareChems a drug marketplace considered the retail store of Lizard Labs, full database dump was shared in the Darknet. The dump include info on all the buyers and suppliers, payment informations and more (thread)

[tephracore @tephracore]

Darkrypt launched their website where they published a sample of data (what looks like to be an Israeli driving license), and ways to contact them. This email was shared: [email protected]

[tephracore @tephracore]

LEAK🔓 detected: A source dubbed Darkrypt are selling data stolen from the Bar-Ilan University - BIU in Israel, based on their announcement see below: (thread)

[tephracore @tephracore]

Darkrypt also shared publicly a 59.1 MB zip file sample of the data. The zip file have the following hash d6b754f033c31d4c60a7e56e916cb011. The data seems to be outdated, but still contains PII and other information related to the University. We urge BIU to take immediate actions

[tephracore @tephracore]

An introduction write-up by @lordx64 to virtual machine code de-obfuscation. Analyzing VM obfuscation is an excellent skill to have if you were dealing with advanced APT malware (FinSpy is a malware that comes with two complex VMs) https://t.co/tjlTHZp1WF

[tephracore @tephracore]

@lordx64 solving one of the virtual machine obfuscation challenges by @MalwareTechBlog using IDAPython , enjoy the read:

[tephracore @tephracore]

@lordx64 just published a very long and detailed analysis of A new OSX/Bundlore Loader. Analysis done via Emulation @unicorn_engine and LLDB Python API . 👏

[tephracore @tephracore]

Security expert @patrickwardle covering OS X/ WindTail backdoor, from WindShift APT an APT group originally discovered by @lordx64 go check Patrick excellent presentation!

[Patrick Wardle @patrickwardle]

Just posted slides from my VirusBulletin talk: "Cyber-espionage in the Middle East: Unravelling OSX.WindTail" 🐪👾🍎 #VB2019 #TalkingNerdy

Link:
https://t.co/CqZXoky0Kb

[tephracore @tephracore]

Unveiling OSX/Tarmac an advanced macOS malware developed by a threat actor with deep Malvertising links : https://t.co/6wuf0jfj13 @DESCofficial @patrickwardle @SentinelOne @USCERT_gov @CarbonBlack_Inc #Tarmac #malware

[tephracore @tephracore]

Great work by @ThaiCERT listing Windshit APT ! Ps: more details of research coming soon.

[Łukasz @maldr0id]

A threat actor encyclopedia listing APT groups prepared by @ThaiCERT:

https://t.co/jXKozIJeWH

[tephracore @tephracore]

great work by Phil Stokes from @SentinelOne , explaining how #WINDSHIFT apt malware and other OSX malware can bypass gatekeeper security settings : https://t.co/gnx9phI1FP

[tephracore @tephracore]

kudos to @_CPResearch_ , @megabeets_ and @shablolForce for recently publishing a "Mac Malware Encyclopedia" covering #macOS #malware samples.

happy to see Windtail and Windtape malware from #windshift #APT are documented as well:
https://t.co/7w75tiRq8n

[tephracore @tephracore]

tephracore delivering last findings and talk about WINDSHIFT APT #windshift #apt at SANS summit 2019 Abu dhabi @SANSEMEA

[SANS Institute, EMEA @SANSEMEA]

Taha Karim of @tephracore on the Windshift APT, a new macOS malware which focuses on specific individuals for espionage and surveillance purposes. #CyberSecurityME #Malware #Hacking

[tephracore @tephracore]

bsidesSF 2019 #CTF #writeups #runit #runitplusplus
https://t.co/S5pX0rcyRJ
cc: @CTFtime @BSidesSF