Alex Hinchliffe

Cybers @ Unit 42; @[email protected]

[Ollie Whitehouse @ollieatnowhere]

The team at @NCSC inputted - go forth and defend..

[Marc Rogers @marcwrogers]

The @NCA_UK smackdown on Lockbit continues with new updates and details on Operation Cronos. This is the way.

[Alex Hinchliffe @threatint_al]

@RestIsPolitics @RoryStewartUK @campbellclaret BOOKS: Have either of you read “On intelligence” by John Hughes-Wilson? Great book imo. c37 on Blair’s Dodgy Dossier and @campbellclaret’s involvement is pretty damming though, and honestly makes me not want to listen to what is often a thoroughly enjoyable podcast.

[James Holland @JamesHolland_UK]

Thank you to @BlackHatEvents for again choosing @PaloAltoNtwks for the operations centre of the Asia 2024 conference!

It was awesome to see everyone again, build an infra in 1 day, and then a smooth operation for the week
#OpsForLife #BlackHat #BHAsia #LifeatPaloAltoNetworks

[PIVOTcon @pivot_con]

💡#PIVOTcon24 or #RSAC ❔😉

#CTI #ThreatIntel

[Unit 42 @Unit42_Intel]

Our telemetry revealed an interesting case of #BoggySerpens (#MuddyWater) against a Middle East target: Persistence through scheduled task that runs PowerShell to abuse AutodialDLL registry key. AutodialDLL loads DLL for C2 framework. Details at https://t.co/AHR4Z77PLz

[Doel Santos @SantosDoel]

Nothing better than returning from some time off, and encountering this amazing news. 🔥

[Alex Hinchliffe @threatint_al]

@jadefh the rise of the manchines... :/

[James Holland @JamesHolland_UK]

Thank you once again to @BlackHatEvents for choosing @PaloAltoNtwks to provide network security, as well as a growing security automation and orchestration capability, for the operations centres of the conferences this year in Singapore, Las Vegas and London ♥

[Alex Hinchliffe @threatint_al]

@ollieatnowhere Enjoyed the talk, thanks! We all have lots of work still to do heh… 👍

[Ollie Whitehouse @ollieatnowhere]

At @NCSC along with @CISAgov we have released our 'Guidelines for secure AI system development'

This release is co-sealed by various national agencies around the globe. Along with input from various academic and commercial organisations.

https://t.co/m0JlHetsXS

[Alex Hinchliffe @threatint_al]

@jamiebrummell Ooooh! That looks similar to last year’s. Great ctf & badge. Have fun… wish I could be there!

[Alex Hinchliffe @threatint_al]

@dannyjpalmer Congratulations!! Great picture :)

[Kostas @Kostastsale]

A Day in the Life of a CISO

[Volexity @Volexity]

.@Volexity is aware of widespread exploitation of #MOVEIt software published by Progress. Organizations running MOVEIt should follow remediation advice in the advisory published here: https://t.co/leyyA108oo
#dfir #threatintel
[1/3]

[Unit 42 @Unit42_Intel]

2023-05-17 (Wednesday): Today, this week's BB28 #Qakbot-style distribution chain pushed #Pikabot instead of Qakbot. Followed up with #CobaltStrike using #DNSTunneling. We later saw additional Cobalt Strike traffic over HTTPS. List of IOCs available at https://t.co/grUnRUq13b

[Alex Hinchliffe @threatint_al]

@dannyjpalmer Sorry to hear that, Danny! Hope some good comes of it for you…

[Unit 42 @Unit42_Intel]

#MicrosoftOutlook vulnerability CVE-2023-23397 uses a specially-crafted email to start a #RelayAttack. We detail the scope of the attack, interim guidance for those who cannot patch, our threat hunting queries, and more on the blog. https://t.co/iFpw3KVpsP

[Unit 42 @Unit42_Intel]

New #ransomware calling itself #CylanceRansomware targets #Windows and #Linux platforms. Mutex used in Windows: CylanceMutex. Extension used: .Cylance md5: 4601076b807ed013844ac7e8a394eb33(Linux), 31ed39e13ae9da7fa610f85b56838dde(Windows)
#LinuxSecurity

[Unit 42 @Unit42_Intel]

2023-03-07 (Tuesday) - Like @Cryptolaemus1 and many others, we've also seen new #Emotet #malspam and the associated malware (inflated Word docs and inflated Emotet DLL files) - Some IoCs from today's Emotet are available at https://t.co/a4ejFoOpYJ