Adam G.

what does a scanner see?

[Nick @kulinacs]

Excited to share the (now patched) AKS Privilege Escalation we found!
https://t.co/oDDrCf97B5

[Bryce @bryceabdo]

🚨📝 New #FIN7 threat research blog, "Power Hour", published today by @Mandiant. Please enjoy 🌶🌶

https://t.co/HZlyGg2q3M

Blog includes:
- FIN7 archaeology & evolution ⛏
- #POWERPLANT deep dive
- BIRDWATCH (~#JssLoader)
- Supply chain (😱)

neat stuff in thread 🧵⤵️

[b33f | 🇺🇦✊ @FuzzySec]

SilkETW is now available ✍️🧐💡! Check out my short introduction post here => https://t.co/XJLrC6CPi5, you can find the code on the @FireEye GitHub => https://t.co/d9qyZlkzn3

[Kimberly @tiskimber]

Well covered that Ryuk ❌ NK in blogs by @kryptoslogic @McAfee_Labs @Malwarebytes @CrowdStrike. Here we share an example of an initial infection vector, more details on how Ryuk has been deployed, and some info on the observed TrickBot gtags https://t.co/ki8sDMpDPK

[Matthew Dunwoody @matthewdunwoody]

New post is up! We pick apart the latest probable #APT29 phishing campaign and the nuance involved in dealing with, and attributing to, deceptive attackers. Written with @QW5kcmV3, @itsreallynick, @matonis, @jonleathery. Credit to @barryv for the title. https://t.co/eX5D28x1ds

[Nathan Brubaker @NathanBrubaker]

HOT OFF THE PRESS: Read our @FireEye_Intel #TRITON attribution blogpost tying TRITON actors to CNIIHM, a Russian Government-Owned research institute.

https://t.co/Ezl0FS0ntb

[Nathan Brubaker @NathanBrubaker]

In our new @FireEye blog post we analyze some of the most frequent ICS security risks observed in the field during @Mandiant ICS Healthcheck assessments. It is good to have some on-the-ground data to test commonly cited areas of ICS risk. https://t.co/wYWkxrMO0M

[Willi Ballenthin @williballenthin]

Stymied by my own #flareon5 challenge, so I developed idawasm: An IDA Pro loader and processor for WebAssembly.

details: https://t.co/w5P3dL6HD0

[Michael Sikorski @mikesiko]

Get ready for the 5th Annual FLARE On Challenge!!! #flareon5 https://t.co/HkOSEkpRlp

[Steve YARA Synapse Miller @stvemillertime]

The TRITON origin story is a still mystery with lots of missing pieces. @reesespcres and I did some poking and found some overlaps with legit Triconex DLLs. Nothing mind blowing, but still cool: https://t.co/yzWup76fjg #tristation #triton #tubular

[Doug Bienstock @doughsec]

Check out my blog post and tool release on OAuth Abuse! OAuth abuse is a social engineering technique that's managed to stay relatively under the radar until now. https://t.co/iaUmEyCahJ

[RANDI @_idnar]

#Blockchain domains as malicious infrastructure.

https://t.co/GYC1qiQZnH

[Daniel Bohannon @danielhbohannon]

After 9 months Invoke-DOSfuscation is finally released!! There is a lot of information for detection in the white paper, and the Invoke-DosTestHarness function is exactly what I used for detection dev & tuning.

Code: https://t.co/ARK97aDnHg
White paper: https://t.co/i3qz7jn2rs

[Christopher Glyer @cglyer]

Breaking: @Mandiant releases details on malware targeting critical infrastructure

https://t.co/uEEKEePau3

TLDR:
-Unknown nation state threat actor
-Attacker caused shutdown of operations
-First (public) incident targeting safety systems (that prevent further physical damage)

[Nick Carr @ItsReallyNick]

Cyber espionage is alive and well! My blog post is live: APT32 (Vietnam) targeting and TTPs: https://t.co/ktit15l0si #DFIR @Mandiant

[Adam G. @writingadam]

@FireEye details three zero-day vulnerabilities addressed on Patch Tuesday: https://t.co/40El8dsnv7

[Matthew Dunwoody @matthewdunwoody]

I wrote up the #APT29 TOR/meek domain fronting backdoor that we first discussed during our #noeasybreach talk. https://t.co/tESUjPS6WB

[Jake Valletta @jake_valletta]

Finally made it on the #FireEye blog! Check out my technical analysis of the recently patched CVE-2016-2060! https://t.co/iw0aSyuJfK

[Adam G. @writingadam]

Cisco's Monique Morrow on threat landscape evolution at NYIT Cybersecurity Conference