Validin

Validin is a next generation internet intelligence platform.

[Validin @ValidinLLC]

For analysts and researchers: releasing a new advanced search query language and Search Sessions. Read the announcement:

https://t.co/03azlvoUM6

[S1dhy @s1dhy]

1/

Just came across this using @ValidinLLC searching for "Launch Meeting - Zoom"

domains hosting what looks like XSS > RCE > MS Signed > dropper.exe > miniplasma > more fun

@astrarce @Gi7w0rm @RussianPanda9xx @SquiblydooBlog @MsftSecIntel @banthisguy9349 @_JohnHammond

[S1dhy @s1dhy]

Lets use this pivot point on @ValidinLLC

Title: Zoom Client Update

Reported to @abuse_ch

Telegram info
'bot_url' "6366434554:AAFV0fUvPM4BdKKUvMt9aQwg1nQ8MsxCpXE"
'chat_id' "588250349"

[Vultr @Vultr]

Validin's threat intelligence platform requires unfettered access to data, with affordable, high-performance storage, bandwidth, and scaling.

They’ve found that with Vultr Bare Metal, Cloud Compute, and File System.

See how @ValidinLLC wins with Vultr: https://t.co/DDnZPOxB9t

[Validin @ValidinLLC]

Six months after @DJSnM and @_JohnHammond were targeted with a fake "DMCA takedown" campaign, we revisit old pivots and find some new connections.

https://t.co/kOBltqUbKX

[PIVOTcon @pivot_con]

#PIVOTcon26 edition is over! Time to #pivot to #PIVOTcon27
Big thanks to our sponsors for making this happen!
@silentpush @vtxproject @censysio @urlscanio @ValidinLLC @TalosSecurity @abuse_ch @SpamhausTech @ecrime_ch @epieos @sekoia_io @wearetlpblack @webscout_io @rationaledge 1/

[Ariel Jungheit @ArielJT]

New report revisiting Gamaredon, this time focusing on their phishing emails and first stage downloaders - GammaDrop and GammaLoad. Despite years of active campaigns, detailed public analysis of either has been lacking. So we fixed that. 1/5

[Validin @ValidinLLC]

✈️ We’re headed to Malaga, Spain for #PIVOTCon26! Our founder Kenneth Kinion and founding engineer Sreekar Madabushi will be attending.

[Validin @ValidinLLC]

We're looking forward to seeing you all at @pivot_con next week!

[PIVOTcon @pivot_con]

Countdown is real ⌛️ Next week‼️
#ThreatResearch community gathers in Málaga 🇪🇸
Time to remind our PIVOTcon song: https://t.co/h2R5ZWAtvf
But watch out — it's a banger!
thx: @JReisdorffer

#CTI #ThreatIntel #PIVOTcon26

[Validin @ValidinLLC]

@RussianPanda9xx Thank you for the shout out!

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

Ok, real question: how many of you have mistyped regsvr32.exe too?

New blog is out! Got a chance to take a peek at CastleLoader 🏰 and a .NET stealer we are calling CastleStealer (duh)

Their launch_method 4 calls regsrv32.exe. Yes, regsrv32.exe. The devs typo'd a binary that's been shipping since the 90s and never noticed :C

I also didn't forget to give @ValidinLLC a shoutout this time.

Would you check out the blog, pretty please? https://t.co/QklbaYitoQ

[LABScon 2026 @labscon_io]

🚨 The LABScon 2026 Call for Papers is officially OPEN!

🗓️ Deadline to submit: June 19, 2026

🔗 https://t.co/WuzxCLC8Lt <- find the button here

[lazarusholic @lazarusholic]

""Hello? I can’t hear you": Investigating UNC1069’s Fake Meeting Tactics" published by @ValidinLLC. #CabbageRAT, #ClickFix, #UNC1069, #DPRK, #CTI https://t.co/fCJ7H8Wxdu

[Validin @ValidinLLC]

In this guest post, researchers @lontze7 and @cfotopoulos2000 analyze UNC1069 sample behavior and track related infrastructure with Validin. They provide IOCs and show great detail. Check out out! ⤵️

[Lontz @lontze7]

New blog on @ValidinLLC with @cfotopoulos2000 !

"Hello? I can’t hear you": Investigating UNC1069’s Fake Meeting Tactics

https://t.co/zUHnaMz0yy

[The Shadowserver Foundation @Shadowserver]

Raw IP data in Device ID reporting, with device_vendor set to Progress & device_model to ShareFile: https://t.co/1uPaaDBQcc

Thank you to @ValidinLLC for the collaboration!

Dashboard World Map view: https://t.co/MT2auFb71P

Dashboard Tree Map view:
https://t.co/FZnoeSIuWH

[Validin @ValidinLLC]

@andrewdanis @500mk500 @andrewdanis we do not have pivots that require a premium account (except for registration, which this is not). It appears that the data aged out of the community platform.

[The Shadowserver Foundation @Shadowserver]

657 instances shared for 2026-03-14. We expect to increase the volume of the feed in the future!

We would like to thank our Alliance partners and @ValidinLLC for the collaboration making this possible!

Background on investigating ClickFix/ClearFake: https://t.co/UY8NFEKr1C

[PIVOTcon @pivot_con]

📣#PIVOTcon26 Agenda is here 🤟 We are thrilled to announce the lineup for this year's speaker lineup.
2⃣days and 19 talks from leading #ThreatResearch experts.
The agenda link is in the first comment👇, and the talks and speakers are in the thread.🧵
#CTI #ThreatResearch
1/15

[Validin @ValidinLLC]

Read the original report from GTIG:
https://t.co/SGeWraRm2Q

[Validin @ValidinLLC]

We're tracking the rapid proliferation of this exploit chain. Read our analysis of the C2 domains and the discovery of many recent dropper pages.

Tracing the iOS Exploit Kit from Ukraine to Iran War Lures:
https://t.co/fVLUFYDXxs

[Validin @ValidinLLC]

Read the original report from @IsMyPhoneHacked
https://t.co/01aj3sQ202

[i✌️erify @IsMyPhoneHacked]

5 exploit chains, 23 exploits, nation-state grade malware has leaked with the capability to mass exploit iPhones. IOCs and technical overview on our blog:
https://t.co/LkpnXbjGau

#iOS #malware #mobilesecurity #cybersecurity #cyberattack