KrakenLabs (@krakenlabs_team) 's Twitter Profile
KrakenLabs

@krakenlabs_team

🔍 KrakenLabs Team | Threat Intelligence at Outpost24 🌐 | Uncovering Threat Actors & Malware |Pioneering Digital Risk Protection Innovation 🚀 | #CyberSecurity

ID: 1699340579253948416

linkhttps://outpost24.com/blog/ calendar_today06-09-2023 08:36:13

98 Tweet

232 Followers

101 Following

KrakenLabs (@krakenlabs_team) 's Twitter Profile Photo

🚨 We've observed a ransomware campaign likely mocking Elon Musk supporters, using phishing-based .lnk droppers, multi-stage PowerShell, and Netlify-hosted payloads to execute a full infection chain. 🧵 🪤 Initial vector: A phishing PDF (“Pay Adjustment”) → links to

🚨 We've observed a ransomware campaign likely mocking Elon Musk supporters, using phishing-based .lnk droppers, multi-stage PowerShell, and Netlify-hosted payloads to execute a full infection chain. 🧵

🪤 Initial vector:
A phishing PDF (“Pay Adjustment”) → links to
KrakenLabs (@krakenlabs_team) 's Twitter Profile Photo

❓ Want to stay one step ahead of cybercriminals? Dive into our April 2025 Threat Context: — Threat actor of the month: EncryptHub. — Spotlight threat: Bulletproof hosting provider Media L and LLC. client’s data leaked — Emerging threats: Oracle Cloud data breach and StealC

❓ Want to stay one step ahead of cybercriminals?  
Dive into our April 2025 Threat Context: 
— Threat actor of the month: EncryptHub. 
— Spotlight threat: Bulletproof hosting provider Media L and LLC. client’s data leaked
— Emerging threats: Oracle Cloud data breach and StealC
KrakenLabs (@krakenlabs_team) 's Twitter Profile Photo

🚨 The #Qilin #Ransomware group has introduced new features to increase their extortion capabilities: 💼 Legal support to increase pressure on victims. 📁 1PB storage for stolen data. 📩 Spam tools for email and phone targeting. 📝 PR support with dedicated journalists. This is a

🚨 The #Qilin #Ransomware group has introduced new features to increase their extortion capabilities:
💼 Legal support to increase pressure on victims.
📁 1PB storage for stolen data.
📩 Spam tools for email and phone targeting.
📝 PR support with dedicated journalists.
This is a
KrakenLabs (@krakenlabs_team) 's Twitter Profile Photo

🚨🐍 Wonder who is the mastermind behind Noodlophile Stealer? 🕵️‍♂️ We’ve traced the alleged developer and seller behind Noodlophile Stealer using many aliases “kiemdev05” (aka NoodlophileVN, luci205, Tống Đức Kiếm & more), presumably a software developer from Vietnam that has

🚨🐍 Wonder who is the mastermind behind Noodlophile Stealer?

🕵️‍♂️ We’ve traced the alleged developer and seller behind Noodlophile Stealer using many aliases “kiemdev05” (aka NoodlophileVN, luci205, Tống Đức Kiếm & more), presumably a software developer from Vietnam that has
KrakenLabs (@krakenlabs_team) 's Twitter Profile Photo

🚨 Threat Alert: The previously reported ransomware campaign impersonating Edward Coristine "Big Balls" remains active. 🔗New Netlify subdomains have been identified hosting malicious content: elegant-starburst-d473a1.netlify[.]app hilarious-selkie-9c0de7.netlify[.]app

KrakenLabs (@krakenlabs_team) 's Twitter Profile Photo

🔍 DragonForce initially emerged as a pro-Palestinian hacktivist group before shifting to profit-driven ransomware operations, targeting major brands like Marks & Spencer, Harrods, and Co-op. ⚔️ Recently, DragonForce has been embroiled in a conflict with RansomHub on dark web

🔍 DragonForce initially emerged as a pro-Palestinian hacktivist group before shifting to profit-driven ransomware operations, targeting major brands like Marks & Spencer, Harrods, and Co-op.

⚔️ Recently, DragonForce has been embroiled in a conflict with RansomHub on dark web
KrakenLabs (@krakenlabs_team) 's Twitter Profile Photo

🚨 New MaaS Alert: “PhantomOS” is being sold by threat actor #ZeroCompile on a cybercrime forum. 📱 Android malware offers: • Remote APK injection • OTP/SMS hijacking • Hidden phishing panels • Full access to victim emails, banks & crypto 💰 $799/week + 15% profit share

🚨 New MaaS Alert: “PhantomOS” is being sold by threat actor #ZeroCompile on a cybercrime forum.

📱 Android malware offers:
 • Remote APK injection
 • OTP/SMS hijacking
 • Hidden phishing panels
 • Full access to victim emails, banks & crypto

💰 $799/week + 15% profit share
KrakenLabs (@krakenlabs_team) 's Twitter Profile Photo

📢ZeroCrumb browser cookie stealer released on GitHub #ZeroCrumb can steal cookies from Chrome, Brave, and Edge without triggering admin (UAC) alerts. 🛠️ It works by: - Impersonating Chrome using a technique called Transacted Hollowing - Exploiting a COM interface to grab

📢ZeroCrumb browser cookie stealer released on GitHub

#ZeroCrumb can steal cookies from Chrome, Brave, and Edge without triggering admin (UAC) alerts.

🛠️ It works by:

- Impersonating Chrome using a technique called Transacted Hollowing

- Exploiting a COM interface to grab
KrakenLabs (@krakenlabs_team) 's Twitter Profile Photo

🚨 The threat actor #LongNight is selling remote code execution (RCE) access to Burger King Spain’s AhsayCBS backup system for $4,000. AhsayCBS is a backup server platform with a web console that manages backups across local storage, FTP/SFTP, and cloud services like AWS &

🚨 The threat actor #LongNight is selling remote code execution (RCE) access to Burger King Spain’s AhsayCBS backup system for $4,000.

AhsayCBS is a backup server platform with a web console that manages backups across local storage, FTP/SFTP, and cloud services like AWS &
KrakenLabs (@krakenlabs_team) 's Twitter Profile Photo

📢 New extortion model spotted The ransomware group #weyhro offers flexible “partnerships” on their 💻 DLS. 💰 Traditional “extortion” (70%/30%): the partner provides stolen corporate data, and weyhro leaks it. 🔐 New “compromise” model (30%/70%): the partner supplies access,

📢 New extortion model spotted

The ransomware group #weyhro offers flexible “partnerships” on their 💻 DLS.
💰 Traditional “extortion” (70%/30%): the partner provides stolen corporate data, and weyhro leaks it.
🔐 New “compromise” model (30%/70%): the partner supplies access,
KrakenLabs (@krakenlabs_team) 's Twitter Profile Photo

📢 Dakar Stealer released on GitHub dakar1986 released yesterday #DakarStealer, a new malware that focuses on stealing information from Gecko and Chromium browsers. 🔐 Compatible with Chrome’s latest encryption standards. 💬 Allows uploading the stolen data to Discord, Telegram,

📢 Dakar Stealer released on GitHub

dakar1986 released yesterday #DakarStealer, a new malware that focuses on stealing information from Gecko and Chromium browsers.
🔐 Compatible with Chrome’s latest encryption standards.
💬 Allows uploading the stolen data to Discord, Telegram,
KrakenLabs (@krakenlabs_team) 's Twitter Profile Photo

Who is Dedale? The user posting data leaks massively these days... 🔙 He was linked to the administration of the underground forum Breached during July 2023 (x.com/FalconFeedsio/…). 🔄 Breached emerged as a replacement for the RaidForums forum, which is also a name mentioned