Cyber_Decipher's profile picture. Security Analyst | BlueTeam | Security Researcher |

Root User

@Cyber_Decipher

Security Analyst | BlueTeam | Security Researcher |

Root User reposted

🚨 #FunkLocker is an AI-built #ransomware by #FunkSec, behind 120+ attacks in North America & Asia. Uses “AI snippets,” kills processes, abuses system tools, and reuses BTC wallets.   Read technical analysis from @MauroEldritch and gather TTPs: any.run/cybersecurity-…

anyrun_app's tweet image. 🚨 #FunkLocker is an AI-built #ransomware by #FunkSec, behind 120+ attacks in North America & Asia. Uses “AI snippets,” kills processes, abuses system tools, and reuses BTC wallets.
 
Read technical analysis from @MauroEldritch and gather TTPs: any.run/cybersecurity-…

Root User reposted

Turns out many Red Teamers and Penetration Testers were exploiting this as a zero day for the past decade 😂

vysecurity's tweet image. Turns out many Red Teamers and Penetration Testers were exploiting this as a zero day for the past decade 😂

Root User reposted

ClickFix just got clever-ditched Win+R for Win+X (Power User Menu) ⚠️ New variant drops Lumma after Defender exclusion: - Prompts for elevation till user accept - Add defender exclusion on %temp% - Drops & runs Lumma Multiple Sigma rules fired 💥 Process Tree👇

Securityinbits's tweet image. ClickFix just got clever-ditched Win+R for Win+X (Power User Menu) ⚠️

New variant drops Lumma after Defender exclusion:

- Prompts for elevation till user accept
- Add defender exclusion on %temp%
- Drops & runs Lumma

Multiple Sigma rules fired 💥

Process Tree👇
Securityinbits's tweet image. ClickFix just got clever-ditched Win+R for Win+X (Power User Menu) ⚠️

New variant drops Lumma after Defender exclusion:

- Prompts for elevation till user accept
- Add defender exclusion on %temp%
- Drops & runs Lumma

Multiple Sigma rules fired 💥

Process Tree👇
Securityinbits's tweet image. ClickFix just got clever-ditched Win+R for Win+X (Power User Menu) ⚠️

New variant drops Lumma after Defender exclusion:

- Prompts for elevation till user accept
- Add defender exclusion on %temp%
- Drops & runs Lumma

Multiple Sigma rules fired 💥

Process Tree👇
Securityinbits's tweet image. ClickFix just got clever-ditched Win+R for Win+X (Power User Menu) ⚠️

New variant drops Lumma after Defender exclusion:

- Prompts for elevation till user accept
- Add defender exclusion on %temp%
- Drops & runs Lumma

Multiple Sigma rules fired 💥

Process Tree👇

Root User reposted

#Censys Query for #Kimsuky #APT Infra Query: services.banner_hashes="sha256:bd049d589a4165a7b0e5541722f96fefa4c27b53c7949f41c66f155d03268a45" Link: t.ly/vIMoq Infra: 158.247.230[.]196 158.247.204[.]137 158.247.242[.]206 158.247.249[.]46 @500mk500 #Malware #ioc

Cyberteam008's tweet image. #Censys Query for #Kimsuky #APT Infra

Query: services.banner_hashes="sha256:bd049d589a4165a7b0e5541722f96fefa4c27b53c7949f41c66f155d03268a45"

Link: t.ly/vIMoq

Infra:
158.247.230[.]196
158.247.204[.]137
158.247.242[.]206
158.247.249[.]46

@500mk500 #Malware #ioc

Root User reposted

Just dropped a rapid-fire breakdown of 8 lateral movement techniques — and how to detect each one 🛠️ RDP 📁 Admin Shares 🛎️ Service Install 📦 PsExec 📆 Scheduled Tasks 🧪 WMI / WMIC 🧬 DCOM 💻 PowerShell Remoting ▶️ Watch here: youtu.be/eYNFl1w0W0g Based on my research in…

BriPwn's tweet card. 8 Ways to Attack & Detect Lateral Movement – Rapid Fire Edition

youtube.com

YouTube

8 Ways to Attack & Detect Lateral Movement – Rapid Fire Edition


Root User reposted

We (+@sagitz_ @ronenshh @hillai) found a series of unauthenticated RCEs in core @KubernetesIO project "Ingress-NGINX". The impact? From zero permissions ➡️ to complete cluster takeover 🤯 This is the story of #IngressNightmare 🧵⬇️

nirohfeld's tweet image. We (+@sagitz_ @ronenshh @hillai) found a series of unauthenticated RCEs in core @KubernetesIO project "Ingress-NGINX".

The impact?

From zero permissions ➡️ to complete cluster takeover 🤯

This is the story of #IngressNightmare 🧵⬇️

Root User reposted

1995: Launched Quick Heal. No one bought it. 1996: Couldn't hire engineers. They all went offshore. 1997: No funding. No investors. No bank support. 1998: Lost all developers. Worked solo in R&D. 1999: Dealers refused to sell an Indian antivirus. 1999: Approached…

sanjaykatkar's tweet image. 1995: Launched Quick Heal. No one bought it.

1996: Couldn't hire engineers. They all went offshore.

1997: No funding. No investors. No bank support.

1998: Lost all developers. Worked solo in R&D.

1999: Dealers refused to sell an Indian antivirus.

1999: Approached…

Root User reposted

The @haveibeenpwned UI/UX refresh is so clean, well done @troyhunt

vxdb's tweet image. The @haveibeenpwned UI/UX refresh is so clean, well done @troyhunt

Root User reposted

People will download Kali on VMware and adopt this entire persona.

daycyberwox's tweet image. People will download Kali on VMware and adopt this entire persona.

Root User reposted

Ultimate Cybersecurity Career Humble Bundle! Includes: - Incident Response for Windows - The OSINT Handbook - Ghidra Software Reverse-Engineering for Beginners - Effective Threat Investigation for SOC Analysts - Automating Security Detection Engineering - Hack the Cybersecurity…

DfirDiva's tweet image. Ultimate Cybersecurity Career Humble Bundle!

Includes:
- Incident Response for Windows
- The OSINT Handbook
- Ghidra Software Reverse-Engineering for Beginners
- Effective Threat Investigation for SOC Analysts
- Automating Security Detection Engineering
- Hack the Cybersecurity…

Root User reposted

Periodic Table of Windows Events #ThreatHunting #DFIR #Windows

ACEResponder's tweet image. Periodic Table of Windows Events

#ThreatHunting #DFIR #Windows

Root User reposted

I’ll keep on screaming this until I retire: it’s not the attackers I worry about, it’s the utterly shit engineering we continue to see from those promising to protect us. Stuff like this is inexcusable. horizon3.ai/attack-researc…


Root User reposted

> critical 9.9 cvss "unauthenticated" rce on linux!!!! > look inside > requires local network access, user interaction, and non-default configuration

BillDemirkapi's tweet image. > critical 9.9 cvss "unauthenticated" rce on linux!!!!
> look inside
> requires local network access, user interaction, and non-default configuration

Attacking UNIX Systems via CUPS, Part I evilsocket.net/2024/09/26/Att…



Root User reposted

A 9.9 CVE has been announced for Linux 👀 Remote code execution. No details yet. Heartbleed was 7.5, for reference. This is one of the worst in history. All GNU/Linux systems impacted.


Root User reposted

I am excited to share that the #PEAK #ThreatHunting Framework, which I wrote with @iknowuhack and @letswastetime, has been nominated for a SANS Difference Maker award as "Innovation of the Year." Vote here: sans.org/about/awards/d…

DavidJBianco's tweet image. I am excited to share that the #PEAK #ThreatHunting Framework, which I wrote with @iknowuhack and @letswastetime, has been nominated for a SANS Difference Maker award as "Innovation of the Year."

Vote here: sans.org/about/awards/d…

Root User reposted

Indian startup Dotpe, that raised ~$100M to build point of sale systems for restaurants left their entire API fully public. A clever hacker found out the most ordered thing at every Social in India. And did a prank to order what he wanted for a person next to him! Zero auth.

deedydas's tweet image. Indian startup Dotpe, that raised ~$100M to build point of sale systems for restaurants left their entire API fully public.

A clever hacker found out the most ordered thing at every Social in India.

And did a prank to order what he wanted for a person next to him! 

Zero auth.
deedydas's tweet image. Indian startup Dotpe, that raised ~$100M to build point of sale systems for restaurants left their entire API fully public.

A clever hacker found out the most ordered thing at every Social in India.

And did a prank to order what he wanted for a person next to him! 

Zero auth.

Root User reposted

🎁 GIVEAWAY! 🎁 I partnered with @13CubedDFIR for a giveaway of his Investigating Windows Bundle! This bundle includes 365-day access to the Investigating Windows Endpoints & Investigating Windows Memory courses. It also includes a certification attempt for each! To Enter:…

DfirDiva's tweet image. 🎁  GIVEAWAY! 🎁

I partnered with @13CubedDFIR for a giveaway of his Investigating Windows Bundle!

This bundle includes 365-day access to the Investigating Windows Endpoints & Investigating Windows Memory courses. It also includes a certification attempt for each!

To Enter:…

Loading...

Something went wrong.


Something went wrong.