NexusFuzzy 💩

@NexusFuzzy

Infostealer hunter by night, threat actors’ headache 24/7. I track C2s, ruin botnets, and make cybercriminals rethink their life choices

github.com/NexusFuzzy

Joined June 2011

1KPosts 2KFollowers 318Following

You might like

@stvemillertime

@MichalKoczwara

@embee_research

@fr0gger_

@3xp0rtblog

@Myrtus0x0

@Intel471Inc

@ViriBack

@Wanna_VanTa

@vinopaljiri

@reecdeep

@d4rksystem

@jstrosch

@pmelson

@Wietze

NexusFuzzy 💩

@NexusFuzzy

Jul 24

If you do not want your commands to show up in history on Linux, just prepend them with a space character. Probably worth checking echo $HISTCONTROL on (compromised) servers indicating that history might not be trusted #DFIR #IncidentResponse

NexusFuzzy's tweet image. If you do not want your commands to show up in history on Linux, just prepend them with a space character. Probably worth checking echo $HISTCONTROL on (compromised) servers indicating that history might not be trusted #DFIR #IncidentResponse

NexusFuzzy 💩 reposted

Gi7w0rm

@Gi7w0rm

Jul 23

Quck analysis of new #ToolShell payload observed by @leak_ix: Paylaod is a .dll executed in memory. Sha-256: 3461da3a2ddcced4a00f87dcd7650af48f97998a3ac9ca649d7ef3b7332bd997 It collects System Info and the sensitive machine key. Sends back in response. Single Request takeover.

Gi7w0rm

@Gi7w0rm

Jul 23

⚠️ New payload in the relation to #ToolShell . Attackers now don't need the static file anymore, leaking keys from memory without leaving the file. This means the existence of a file is not a reliable IoC anymore.

NexusFuzzy 💩

@NexusFuzzy

Jun 30

Those funky looking IP addresses already give it away that it‘s AI generated garbage

NexusFuzzy 💩

@NexusFuzzy

Jun 25

„Silent“… That shit lights up every alert dashboard like it‘s a christmas tree

X

@TheMsterDoctor1

Jun 24

🚨 1 COMMAND TO OWN AN ENTIRE NETWORK 🧠 Advanced Nmap Recon + Grep Filtering + Banner Fingerprinting nmap -n -Pn -sS -sV -p80 --open --script=banner -T5 192.168.1.0/24 -oG - | grep 'open' | grep -v 'tcpwrapped' ✅ Fast ✅ Silent ✅ Filters noise ✅ IDs Apache, IIS, embedded…

TheMsterDoctor1's tweet image. 🚨 1 COMMAND TO OWN AN ENTIRE NETWORK

🧠 Advanced Nmap Recon + Grep Filtering + Banner Fingerprinting

nmap -n -Pn -sS -sV -p80 --open --script=banner -T5 192.168.1.0/24 -oG - | grep 'open' | grep -v 'tcpwrapped'

✅ Fast
✅ Silent
✅ Filters noise
✅ IDs Apache, IIS, embedded…

NexusFuzzy 💩

@NexusFuzzy

Jun 23

I think my ChatGPT session had a stroke

NexusFuzzy 💩

@NexusFuzzy

Jun 16

#Archetyp market has been taken down by law enforcement during #OperationDeepSentinel operation-deepsentinel.com

NexusFuzzy 💩

@NexusFuzzy

May 23

At this point, ransomware gangs really need to implement proper role-based access control - can’t have every low-level script kiddie leaking victim data like it’s happy hour at the breach buffet. Maybe start with a Data Leak Prevention Officer?

PRODAFT

@PRODAFT

May 23

🎁 Another unexpected gift for the threat intelligence community. In March 2025, the VanHelsing ransomware group first emerged. Now, in a surprising turn of events, the group’s administrator has leaked the entire source code on the RAMP forum. The leak includes Tor keys,…

PRODAFT's tweet image. 🎁 Another unexpected gift for the threat intelligence community.

In March 2025, the VanHelsing ransomware group first emerged. Now, in a surprising turn of events, the group’s administrator has leaked the entire source code on the RAMP forum. The leak includes Tor keys,…

NexusFuzzy 💩

@NexusFuzzy

May 22

Who's next? #Lumma #Infostealer

NexusFuzzy 💩 reposted

FBI

@FBI

May 21

This week, the FBI disrupted LummaC2, a popular infostealer service, which conducted millions of attacks against victims. With help from partners like Microsoft, the FBI is fulfilling its mission to disrupt key services in the cybercriminal ecosystem: justice.gov/opa/pr/justice…

FBI's tweet image. This week, the FBI disrupted LummaC2, a popular infostealer service, which conducted millions of attacks against victims. With help from partners like Microsoft, the FBI is fulfilling its mission to disrupt key services in the cybercriminal ecosystem: justice.gov/opa/pr/justice…

NexusFuzzy 💩

@NexusFuzzy

May 20

It‘s DNS I bet

WarMonitor🇺🇦🇬🇧

@WarMonitor3

May 20

Spain just suffered a full-scale telecom blackout. These are definitely cyber attacks!

NexusFuzzy 💩

@NexusFuzzy

May 17

NexusFuzzy 💩 reposted

abuse.ch

@abuse_ch

Apr 10

We're proud to announce our support for @CapeSandbox , a fully open-source malware sandbox developed and maintained by a dedicated group of volunteers. After almost a year of downtime, we are extremely happy that we were able to help CAPE get back online again! 🥳 👉…

abuse_ch's tweet image. We're proud to announce our support for @CapeSandbox , a fully open-source malware sandbox developed and maintained by a dedicated group of volunteers. After almost a year of downtime, we are extremely happy that we were able to help CAPE get back online again! 🥳

👉…

NexusFuzzy 💩

@NexusFuzzy

Apr 1

Oh Dmitry, can't you just stop? #RansomwareTycoon #Lockbit #lockbitsupp

NexusFuzzy 💩

@NexusFuzzy

Mar 31

Coming soon, featuring your favorite security researchers like @Gi7w0rm and @g0njxa #RansomwareTycoon Wanting to get featured? Let me know :)

NexusFuzzy's tweet image. Coming soon, featuring your favorite security researchers like @Gi7w0rm and @g0njxa #RansomwareTycoon Wanting to get featured? Let me know :)

NexusFuzzy 💩

@NexusFuzzy

Mar 17

Man, that gives me milw0rm vibes. Also, if you remember milw0rm, please don't forget to book your annual colonoscopy!

WarMonitor🇺🇦🇬🇧

@WarMonitor3

May 20

Spain just suffered a full-scale telecom blackout. These are definitely cyber attacks!

NexusFuzzy 💩

@NexusFuzzy

Mar 6

#Vidar #Infostealer vidars[.]su otx.alienvault.com/indicator/doma…

NexusFuzzy 💩

@NexusFuzzy

Mar 5

#Vidar #Infostealer ?

NexusFuzzy 💩

@NexusFuzzy

Feb 21

vxdb

@vxdb

Feb 21

Cryptocurrency exchange Bybit (@Bybit_Official ) has suffered a security breach. Threat actors exploited a 'masked' transaction to siphon over $1.4 billion in Ethereum (ETH) and staked Ethereum (stETH) from one of the exchanges cold wallets.