Another #malicious #gotoresolve / #logmeinrescue at: https://fbsi\ .org/Receipt_Copy.msi Company ID: 9119452146254695709 app.any.run/tasks/2b763be2…

Good morning! ☀️ #GootLoader woke up and chose violence (again) Grab your coffee, this one's JUICY 💣 huntress.com/blog/gootloade…

#malware #opendir #xloader (small one works, big one not so much) at: https://royfils\.com/encrypt/ 2cd9b8fb88e7cbbc5c049441fb61e0aea7be23dc7aa2c109c13abefe7a2ac943 4733feaca04e871d4e0bb052f2437a2f46f10852602ea4f8b2f0170f4838dd87

Details can be found here: job-boards.greenhouse.io/huntress/jobs/… 🤔Reach out if you have questions.

Happy to share the latest #STRT blog covering the updated version of the .NET Steganography Loader being used by several RATs and Trojan stealers, including #Lokibot. The blog includes the analysis, simple tooling, TTPs, and Splunk detections. 🙂 splunk.com/en_us/blog/sec…

🐈 Cat’s Got Your Files: Lynx Ransomware 🎉New report out by Friff, Daniel Casenove & Mattie Schuch!🎉 Attackers used stolen creds to access RDP, quickly pivoted to a DC with a second compromised admin, created impersonation accounts, mapped the environment, and more.

#evil #logmeinrescue at: https://www.filemail\.com/d/hxuvtnorqdzqppi Company ID: 172104807361994773

Evil #logmeinrescue at: https:// connectme-1ke.pages. dev/LogMeInResolve_Unattended.msi e56e5f1f37b6c2ae9f4f1b2e7ab2f7aee9ca91c4c84334dd5bb49675de619736 Company ID: 8400521075231559185

A new one on me... #mercury32 #loader (but still kinda #darkcloud) app.any.run/tasks/67c44d06…

"ALFV" cybersecuritytoday.libsyn.com/major-us-bank-…

Maybe I'm crazy, but I always thought explorer.exe ran at boot regardless?

Way to go Opera forums.opera.com/topic/87290/op…

An unusually large, moments ago #botnet scan all from source port 19000 (not the "usual" Amazon sourced scans that I see every morning like clockwork at 06:45). Raw logs and source IP's: gist.github.com/silence-is-bes…

A csv formatted list of #malspam campaigns that crossed my path in November to include #malware type, c2, hash, subject, and some email exfil addresses: gist.github.com/silence-is-bes… #retrohunt