zom3y3

Network Security Researcher #Botnet #Pentest #Honeypot #Sandbox

[zom3y3 @zom3y3]

@_CPResearch_ @Shadowserver it is the test packet😅
https://t.co/4wU1UzIcrc

[zom3y3 @zom3y3]

#Muhstik #Botnet is spreading through #log4j2 RCE now.

Exp: http://45.130.229.168:9999/Exploit.class

[360 Netlab @360Netlab]

Our lasted (and possibly the last) update on the mozi botnet, https://t.co/YNDN6eIO8J

[zom3y3 @zom3y3]

@QNAP_nas @qnap_psirt
yes, we have captured and analyzed the zero-day attack.

[SecurityWeek @SecurityWeek]

QNAP Investigating New Attacks Targeting NAS Devices https://t.co/Tk3oisdE3i

[360 Netlab @360Netlab]

Our follow up blog on the mysterious RotaJakiro backdoor we published on Apr 28, RotaJakiro appears to be the Linux version of the OceanLotus APT. https://t.co/0ByKpGiokD

[360 Netlab @360Netlab]

Our latest blog, a mysterious trojan that has been active for more than 3 years with 0 Vt detection, we don't exactly know the motive behind this trojan though, ping us if anyone has more details on this.https://t.co/fe9x55Dsvr

[zom3y3 @zom3y3]

The attacker (182.160.112.151) spent a lot of time to attack the Microsoft Exchange servers.

[zom3y3 @zom3y3]

Two follow-ups about Exchange vulnerability attacks:
1. The target email address include: [email protected] , [email protected]

2. An attacker frequently attacks through the original webshell planting another webshell(http://182.160.112.151/test/2.aspx
).

[zom3y3 @zom3y3]

VT Dection
https://t.co/Oc7Kx1bQhA
https://t.co/9SEcC4ftPx

[zom3y3 @zom3y3]

#Prometei #botnet is attacking Microsoft Exchange server now.

URL:
http://178.21.164.68/dwn.php?b64=1&d=nethost64C.exe

Scanner IP:
209.37.253.178

[zom3y3 @zom3y3]

@Hacktheworld13 @360Netlab All the urls mentioned at the end of our blog are still alive, and you can download these samples :)

[zom3y3 @zom3y3]

#CVE_2021_26855 #XMRig mining attack

https://t.co/36zSKrt56q

[zom3y3 @zom3y3]

I have caught the PoC, such as implanting webshell, obtaining email information, etc., and then waiting to see the spread of malicious samples

[zom3y3 @zom3y3]

I have caught the PoC, such as implanting webshell, obtaining email information, etc., and then waiting to see the spread of malicious samples

[zom3y3 @zom3y3]

Anglerfish honeypot - Microsoft Exchange vulnerability (CVE-2021-26855) scan in the wild

[360 Netlab @360Netlab]

Our latest blog, a new botnet, ZHtrap, turns infected devices into honeypot to help it find more victims, as well as using process whitelist and taking snapshot of the system processes to prevent new program running, this is something we rarely see. https://t.co/7FeZYlrF6c

[zom3y3 @zom3y3]

@alex_bondage ClickHouse + Redash

[360 Netlab @360Netlab]

Our latest blog, QNAP NAS users, check your firmware now, we started to see attack targeting QNAP NAS 4 days ago, and the attacker uses tricks to make sure you don't see high CPU usage https://t.co/aucvD9N4PN

[zom3y3 @zom3y3]

We have seen #Fbot #botnet using multiple 0 days before(some of them we have not disclosed yet) and it has been targeting various IoT devices, now, it is aiming a new category, traffic and transportation smart devices.

[360 Netlab @360Netlab]

Our latest blog, Fbot is now recruiting traffic and transportation smart devices to its bot army, https://t.co/9O4o5KxtnB

[zom3y3 @zom3y3]

@sans_isc https://t.co/ruk2mnYUIx

[zom3y3 @zom3y3]

#WebLogic Console Portal vulnerability (CVE-2020-14882) in the wild

[zom3y3 @zom3y3]

#WebLogic Console Portal vulnerability (CVE-2020-14882) in the wild