Pol Thill

[Infosec In the City (IIC) @Infosec_City]

🕵️ Unmasking Dark Pink: APAC’s Stealthy Threat Actor

Join @tr3gleos & @AlbertPriego as they reveal Dark Pink’s tactics & how TeleScout tracks attackers via Telegram C2.

📅 22-23 May 2025 | 📍 voco Orchard, SG
🎟️Conference Pass: https://t.co/QBYmHpOB7Y

#SINCON2025

[Albert Priego @AlbertPriego]

🔥 RootedCON 2025 – Here we go! 🔥

I’m thrilled to be back as a speaker at @rootedcon , and this time, I’ll be sharing the stage with my friend @tr3gleos. If last year was incredible, this year we’re taking it up a notch!

💡 Are you ready?

📅 Talk slot: March 6, 2025 | 14:00

[Pol Thill @tr3gleos]

@swedishmike @BSidesLondon Hey Mike, I could use one 🙂

[SentinelOne @SentinelOne]

🏆 Congratulations @tr3gleos, the winner of the first-ever Malware Research Challenge we put on in partnership with @vxunderground! https://t.co/9ON6qP1is5

Pol Thill's previously unpublished research sheds light on a cybercrime threat actor, Neo_Net, targeting thousands of clients of financial institutions, with a focus on Spanish and Chilean banks. This meticulous work makes a significant contribution to our understanding of the cybersecurity landscape and is the worthy winner of our challenge (and a new MacBook). 🙌

Read more: https://t.co/9ON6qP1is5

[Pol Thill @tr3gleos]

@jaydinbas Both iso files relate to Dark Pink, APT group that Group-IB reported on: https://t.co/ABjbZ641t9 In particular, both isos have been used in the last attack against the Indonesian government agency.

[Pol Thill @tr3gleos]

@malwrhunterteam The apk is ERMAC 2.0

[Pol Thill @tr3gleos]

@malwrhunterteam Seems to be an updated version of Ermac that uses google translate to translate its Turkish text to whatever language the infected device has and then displays that

[Pol Thill @tr3gleos]

@yakuhito Have fun losing to Luxembourg 😉

[Pol Thill @tr3gleos]

@malwrhunterteam It's a sample of AbereBot

[Pol Thill @tr3gleos]

@ken_truex Could you maybe help me with your EZ-PE challenge, I've been changing tons of stuff in the PE header but can't seem to get it to work

[Luxembourg Tech School @LuxTechSchool]

One amazing year for LTS! Thanks you all for the support! https://t.co/4i91ueDG6f @DigiLetzebuerg @cgie_lu @MeischClaude @medialab_lux