_D4z3n_'s profile picture. Malware Researcher 🙈

_D4Z3N_

@_D4z3n_

Malware Researcher 🙈

_D4Z3N_ 님이 재게시함

We first introduced the term “Premier Pass” during my talk at @pivot_con — describing a trend of advanced collaboration among China-aligned APT groups like Earth Estries & Earth Naga. Today, we published a blog post that explores the concept in depth. trendmicro.com/en_us/research…


_D4Z3N_ 님이 재게시함

#ESETresearch discovered a new wave of the well-known 🇰🇵 Lazarus campaign Operation DreamJob, now targeting the drone industry. @pkalnai @alexis_rapin welivesecurity.com/en/eset-resear… 1/9


_D4Z3N_ 님이 재게시함

#ElasticSecurityLabs joins forces with @tamusystem and discloses TOLLBOOTH, an IIS module used for SEO abuse that relies on publicly exposed ASP. NET machine keys: go.es.io/3L68p57


_D4Z3N_ 님이 재게시함

Unit 42 shares a step-by-step guide to cloud incident response. Learn how cloud investigations differ from traditional incidents, focusing on identities, misconfigurations and service interactions. bit.ly/46JEbxn

Unit42_Intel's tweet image. Unit 42 shares a step-by-step guide to cloud incident response. Learn how cloud investigations differ from traditional incidents, focusing on identities, misconfigurations and service interactions. bit.ly/46JEbxn

_D4Z3N_ 님이 재게시함

Elastic Security Labs introduces nightMARE, a versatile Python library for malware analysis, featuring static analysis tools and configuration extractors for various malware families, now available in version 0.16. #MalwareAnalysis #PythonLibrary elastic.co/security-labs/…

elastic.co

NightMARE on 0xelm Street, a guided tour — Elastic Security Labs

This article describes nightMARE, a python-based library for malware researchers that was developed by Elastic Security Labs to help scale analysis. It describes how we use nightMARE to develop...


_D4Z3N_ 님이 재게시함

Unit 42 recently responded to a ransomware incident involving BlackSuit at a manufacturing client. This event illustrates how a single compromised VPN credential, obtained through a vishing attack, can lead to significant operational impact. bit.ly/42DUrO3

Unit42_Intel's tweet image. Unit 42 recently responded to a ransomware incident involving BlackSuit at a manufacturing client. This event illustrates how a single compromised VPN credential, obtained through a vishing attack, can lead to significant operational impact. bit.ly/42DUrO3

_D4Z3N_ 님이 재게시함

📡New blog about my talk "CTI: The Dark Cloak" where we explore how #intel teams collaborate to tackle real #TA 🕵️‍♂️ We analyze threats from #CTI, assisting other teams such as #TH and #DFIR, extracting max value from every piece of info 🔗Blogpost: rexorvc0.com #RE

RexorVc0's tweet image. 📡New blog about my talk "CTI: The Dark Cloak" where we explore how #intel teams collaborate to tackle real #TA 🕵️‍♂️

We analyze threats from #CTI, assisting other teams such as #TH and #DFIR, extracting max value from every piece of info

🔗Blogpost: rexorvc0.com

#RE
RexorVc0's tweet image. 📡New blog about my talk "CTI: The Dark Cloak" where we explore how #intel teams collaborate to tackle real #TA 🕵️‍♂️

We analyze threats from #CTI, assisting other teams such as #TH and #DFIR, extracting max value from every piece of info

🔗Blogpost: rexorvc0.com

#RE
RexorVc0's tweet image. 📡New blog about my talk "CTI: The Dark Cloak" where we explore how #intel teams collaborate to tackle real #TA 🕵️‍♂️

We analyze threats from #CTI, assisting other teams such as #TH and #DFIR, extracting max value from every piece of info

🔗Blogpost: rexorvc0.com

#RE
RexorVc0's tweet image. 📡New blog about my talk "CTI: The Dark Cloak" where we explore how #intel teams collaborate to tackle real #TA 🕵️‍♂️

We analyze threats from #CTI, assisting other teams such as #TH and #DFIR, extracting max value from every piece of info

🔗Blogpost: rexorvc0.com

#RE

_D4Z3N_ 님이 재게시함

Unit 42 presents a proof of concept on indirect prompt injection in AI agents. This method can store malicious instructions in an agent's memory, affecting future interactions. bit.ly/3L2ppcs

Unit42_Intel's tweet image. Unit 42 presents a proof of concept on indirect prompt injection in AI agents. This method can store malicious instructions in an agent's memory, affecting future interactions. bit.ly/3L2ppcs

_D4Z3N_ 님이 재게시함

We at @emproofsecurity open-sourced a free firmware reverse engineering workshop for self-study. Topics: ELF analysis, cracking, malware triage, embedded-Linux, bare-metal, crypto-key extraction, anti-analysis. Docker setup and solutions included. github.com/emproof-com/wo…


_D4Z3N_ 님이 재게시함

🚀 We are proud to announce the availability of Threatray Release v2.1, bringing an exciting set of additions and improvements to the platform. 🤝 We’ve partnered with @nextronsystems, a pioneer in YARA and Sigma rule detection, to bring their industry-leading detection…

threatray's tweet image. 🚀 We are proud to announce the availability of Threatray Release v2.1, bringing an exciting set of additions and improvements to the platform.

🤝 We’ve partnered with @nextronsystems, a pioneer in YARA and Sigma rule detection, to bring their industry-leading detection…

_D4Z3N_ 님이 재게시함

Relocatable - Write C-code that will be directly compiled into raw shellcode, which can be loaded into any process without the need for tools such as Donut or sRDI github.com/tijme/relocata…

github.com

GitHub - tijme/relocatable: Boilerplate to develop raw and truly Position Independent Code (PIC).

Boilerplate to develop raw and truly Position Independent Code (PIC). - tijme/relocatable


_D4Z3N_ 님이 재게시함

Ever wondered how Process Explorer builds the process tree? I wrote a guide on how to code your own in C++. We cover PID reuse, parent vs. creator, recursion, and more. Read it here: trainsec.net/library/window…

trainsec.net

How to Build a Process Tree in Windows with C++ » TrainSec

Learn how Windows builds process trees, why some processes appear parentless, how PIDs are reused, and how to code your own version in C++.


_D4Z3N_ 님이 재게시함

#ESETresearch has mapped the labyrinth of #AsyncRAT forks, identifying the most prevalent versions of this open-source malware. While some variants are mere curiosities, others pose a more tenacious threat. welivesecurity.com/en/eset-resear… 1/7


_D4Z3N_ 님이 재게시함

In May 2025, #ESET participated in operations that largely disrupted the infrastructure of two notorious infostealers: #LummaStealer and #Danabot. 1/6


_D4Z3N_ 님이 재게시함

⚡ Exciting Update ⚡ We're thrilled to announce our new partnership with @nextronsystems to take YARA rule development and malware classification to a whole new level. 🚀 This collaboration brings Nextron's high-quality YARA rules from THOR Thunderstorm directly into…

threatray.com

Threatray and Nextron Systems Partner to Take YARA Rule Development and Malware Classification to a...

Threatray announces a new partnership with Nextron Systems.


_D4Z3N_ 님이 재게시함

My hot take on AI 🌶️. It's less about efficincy and more about scale. byt3bl33d3r.substack.com/p/ai-doesnt-ma…


_D4Z3N_ 님이 재게시함

Threatray's @_n1ghtw0lf and @_jwagner in collaboration with @proofpoint Threat Research Team have undertaken a deep dive into the India-aligned #Bitter (TA397) cyber espionage group. Read part one over at Proofpoint, where they cover campaigns, infection chains, hand-on-keyboard…

threatray's tweet image. Threatray's @_n1ghtw0lf and @_jwagner in collaboration with @proofpoint Threat Research Team have undertaken a deep dive into the India-aligned #Bitter (TA397) cyber espionage group.

Read part one over at Proofpoint, where they cover campaigns, infection chains, hand-on-keyboard…

_D4Z3N_ 님이 재게시함

Also made a quick video on how to install TitanHide in Windows Sandbox using the SandboxBootkit project. It takes about 3 minutes end-to-end.

🔥 TitanHide has been updated to support the latest VMProtect 3.9.4 changes! The service name is now used as the device name as well, so the check for \\.\TitanHide will fail if you name the service differently 🧠

mrexodia's tweet image. 🔥 TitanHide has been updated to support the latest VMProtect 3.9.4 changes!

The service name is now used as the device name as well, so the check for \\.\TitanHide will fail if you name the service differently 🧠


Loading...

Something went wrong.


Something went wrong.