Tsof

5ß9f43l9x
Threat Researcher | Threat Hunter | APT, Malware Addicts | DFIR
#ThreatHunter #ThreatHunting

[Tsof @tsof_relox]

@letswastetime @DEATHCon2026 I hope you have a great performance. Eagerly waiting

[PandaRE 🐼 🇺🇦 @PandaRE__]

Even with Fable and Opus 5.5 on CVP I get a ton of safeguards, no thanks

[Tsof @tsof_relox]

@G60930953 how do you know?

[Renzon @r3nzsec]

DFIR analysts who use macOS as their daily driver deserve free and native forensic tooling. So I built one. 🍎

Introducing 𝗜𝗥𝗙𝗹𝗼𝘄 𝗧𝗶𝗺𝗲𝗹𝗶𝗻𝗲 — a timeline analysis app built from the ground up for Mac-based DFIR folks, forensic investigators, or SOC analysts. Built in appreciation of, and inspired by, Eric Zimmerman’s Timeline Explorer.

Every feature in this tool was shaped by real IR casework. Handling massive timelines, parsing artifacts here and there, and pivoting across logs during active investigations. I built IRFlow Timeline to be the native macOS timeline analyzer that actually keeps up with a live case. Every button and view is intentional; if it’s in the app, it’s because I needed it mid-case and realized the standard tools fell short.

No dependencies. Zero setup. Just drag, drop, and analyze.

#dfir #incidentresponse #timeline #macos #threathunitng #digitalforensics

[The DFIR Report @TheDFIRReport]

"The unusual command copied to the user's clipboard abused the SSH ProxyCommand option to quietly invoke the Windows Installer (msiexec) and download a payload, marking the start of the intrusion."

[Tsof @tsof_relox]

@G60930953 @MorphisecL @morphisec You've run into those script kiddle Vietnamese guys😅🤣

[Tsof @tsof_relox]

@RussianPanda9xx @MaxRogers5 Heyy, you deserve this, congratulations 😇🥰

[Fox_threatintel @banthisguy9349]

They can go cry me a river. womp womp

[ܛܔܔܔܛܔܛܔܛ @skocherhan]

DESKTOP-I1P3HMO
Bang_Luong_Thang_11_2025.csv

E001,John Smith,Manager,3000,500,400,200,3700,Excellent performance
E002,Alice Johnson,Accountant,2200,300,150,100,2550,Accurate and punctual
E003,Michael Brown,HR Officer,2000,250,200,50,2400,Great teamwork
E004,Emma Davis,Sales Executive,1800,400,350,80,2470,Exceeded sales targets
E005,David Wilson,IT Support,2100,200,100,120,2280,Reliable support
E006,Sosona Mikari,IT Dev,2300,200,100,100,2500,

[hithere @asdasd13asbz]

Hello, while investigating the Midnight or EndPoint ransomware, for which a decryption tool was recently released, I discovered several suspicious points and decided to compile a brief report about them
Report : https://t.co/HvJZIEkkgl

#Ransomware #Kimsuky #Lazarus #APT

[DFIR Training @DFIRTraining]

TERABYTES OF FORENSIC TEST IMAGES
HUNDREDS OF CTFs
https://t.co/dsUPfRNMxH #DFIR #CTF

[Matt Anderson @nosecurething]

New @Huntress blog! @Purp1eW0lf and I share some old defense evasion tactics from a well-commented script used by Xinglocker in 2021 still being used today!

Make sure you can detect them! #detectionengineering #ransomware

https://t.co/kISGPUhjJg

[Shanholo @ShanHolo]

#DFIR #CSIRT #SOC

Great post about the CVE-2025-53770 #SharePoint #Vulnerability ⤵️

https://t.co/kjDsUmAmuX

First #Webshell found in some servers were exploited➡️
📦spinstall0.aspx
🔥IOCs: 02b4571470d83163d103112f07f1c434

[mr.d0x @mrd0x]

A follow up on last week’s FileFix blog.

FileFix (Part 2)
https://t.co/pIcrbQnccc

[Intel 471 @Intel471Inc]

🚨 EMERGING THREAT: MOMMY ACCESS BROKER
Leaked guide linked to mommy reveals how this actor exploits CVEs and sells access to high-value targets like governments and telecoms.

🔗 Read the full report: https://t.co/X5LaA8XnAR

#threatintel #cybersecurity #threathunting

[mr.d0x @mrd0x]

FileFix - A ClickFix Alternative

https://t.co/OMU7UADf9J

[mr.d0x @mrd0x]

Finally had some time to publish these blogs. Enjoy!

Spying On Screen Activity Using Chromium Browsers
https://t.co/9A1CIxe7bH

Camera and Microphone Spying Using Chromium Browsers
https://t.co/JSiokR9p7f

[The DFIR Report @TheDFIRReport]

We had a blast speaking at the Ransomware Summit! 🎤💥
Huge thanks to everyone involved!

🎥 Missed our keynote? No worries — you can catch the full session here:

👉 https://t.co/r0fl4IMcyj

[DanDye @dandye]

Watch Gemini execute a SOC runbook for proactive threat hunting! Using MCP tools, IoCs from a Google Threat Intelligence collection are found (and blocked) in SecOps—showcasing the AI-powered runbooks. #AI #SecOps #ThreatHunting #MCP #GoogleCloudSecurity
https://t.co/UIIiXlCz2H

[Tsof @tsof_relox]

How to threat hunt Living Off The Land binaries https://t.co/PPZYnTiFu9