Vanja Svajcer (@vanjasvajcer) 's Twitter Profile
Vanja Svajcer

@vanjasvajcer

Working for Cisco Talos. Mostly security related stuff. @[email protected]

ID: 63156481

linkhttp://www.talosintelligence.com/ calendar_today05-08-2009 15:06:28

837 Tweet

1,1K Followers

1,1K Following

Cisco Talos Intelligence Group (@talossecurity) 's Twitter Profile Photo

Continuing our research into the #Turla APT, we now have a rundown of the full kill chain this group is using as part of its #TinyTurla operations, including the most recent tooling we discovered. More details up on the blog now cs.co/6010k27Rs

Vanja Svajcer (@vanjasvajcer) 's Twitter Profile Photo

While hunting for maldocs/lures I stumbled upon this virus that looked interesting and it was still active in some organizations in Ukraine blog.talosintelligence.com/offlrouter-vir…

サイバー犯罪さん🔻 (@g0jirasan) 's Twitter Profile Photo

I released the second part to my "Exploring malicious Windows drivers" series 👀 it focuses mainly on the I/O system, IRPs and the basics of IOCTLs blog.talosintelligence.com/exploring-mali…

Vanja Svajcer (@vanjasvajcer) 's Twitter Profile Photo

This started as an investigation into a maldoc with obfuscated VBA code and some unused legit functions lead to discovery of other maldocs generated by MacroPack. blog.talosintelligence.com/threat-actors-…

Vanja Svajcer (@vanjasvajcer) 's Twitter Profile Photo

Talos discovered previously undocumented backdoors and additional components used by Romcom blog.talosintelligence.com/uat-5647-romco…

Vanja Svajcer (@vanjasvajcer) 's Twitter Profile Photo

I presented part of this work on learning about vulnerable Windows drivers at this year's AVAR. This is a follow up post blog.talosintelligence.com/exploring-vuln…

Vanja Svajcer (@vanjasvajcer) 's Twitter Profile Photo

We published our findings about a Python variant of a Golang RAT used by Famous Chollima (aka Wagemole). This has been recently used with limited success. blog.talosintelligence.com/python-version…

Vanja Svajcer (@vanjasvajcer) 's Twitter Profile Photo

MaaS operation using Emmenhtal and Amadey linked to threats against Ukrainian entities blog.talosintelligence.com/maas-operation…

Vanja Svajcer (@vanjasvajcer) 's Twitter Profile Photo

Cisco Talos Incident Response (Talos IR) recently observed attacks by Chaos, a relatively new ransomware-as-a-service (RaaS) group conducting big-game hunting and double extortion attacks. blog.talosintelligence.com/new-chaos-rans…

Vanja Svajcer (@vanjasvajcer) 's Twitter Profile Photo

Cisco Talos has observed an ongoing malware campaign that seeks to infect victims with a multi-stage malware framework, implemented in PowerShell and C#, which we are referring to as “PS1Bot.” blog.talosintelligence.com/ps1bot-malvert…

Vanja Svajcer (@vanjasvajcer) 's Twitter Profile Photo

Although these malware families have historically been associated with campaigns attributed to Naikon or BackdoorDiplomacy, our analysis indicates a connection. blog.talosintelligence.com/how-rainyday-t…

Vanja Svajcer (@vanjasvajcer) 's Twitter Profile Photo

DPRK alligned Famous Chollima keeps their operational tempo high and although not the most sophisticated actors, they have been consistently adding new features to their tools. blog.talosintelligence.com/beavertail-and…