Jan

@_zero_q

- Security Researcher - Incident Responder - Lethal Forensicator - Reverse Engineering Enthusiast [Tweets are my own and not the views of my employer]

Bonn

zeroqblog.wordpress.com

Joined June 2017

568Posts 142Followers 263Following

You might like

@smoothimpact

@KseProso

@jstrosch

@daphiel

@lazy_daemon

@malmoeb

@0x3c7

@t_kowoll

@c0ns010

Jan

@_zero_q

Nov 20

Anyone working on an AI tarpit yet? Might be an interesting approach to slow down automated attacks or even trap them in an endless loop . #honeypot #DFIR #ThreatResearch #threathunting #DeceptionTechnology

Jan

@_zero_q

Oct 30

Rethinking identity security in the age of autonomous AI agents bleepingcomputer.com/news/security/…

_zero_q's tweet card. AI agents now make decisions and access systems on their own, creating identity blind spots traditional tools can't see. Learn how Token Security brings identity-first security to agentic AI — making...

Rethinking identity security in the age of autonomous AI agents

Source: bleepingcomputer.com

Jan

@_zero_q

Oct 20

CISA: High-severity Windows SMB flaw now exploited in attacks bleepingcomputer.com/news/security/…

_zero_q's tweet card. CISA says threat actors are now actively exploiting a high-severity Windows SMB privilege escalation vulnerability that can let them gain SYSTEM privileges on unpatched systems.

CISA: High-severity Windows SMB flaw now exploited in attacks

Source: bleepingcomputer.com

Jan

@_zero_q

Oct 16

Likely a new phishing domain: onedrive[.]eisnerlavv[.]com Trying to mimic domain of @EisnerLaw

Jan reposted

Ryan Naraine

@ryanaraine

Oct 9

ZDI drops barebones advisories on several Ivanti 0days. Here's one timeline zerodayinitiative.com/advisories/ZDI…

Jan

@_zero_q

Oct 8

Microsoft 365 outage blocks access to Teams, Exchange Online bleepingcomputer.com/news/microsoft…

_zero_q's tweet card. Microsoft is working to resolve an ongoing outage preventing users from accessing Microsoft 365 services, including Microsoft Teams, Exchange Online, and the admin center.

Microsoft 365 outage blocks access to Teams, Exchange Online

Source: bleepingcomputer.com

Jan

@_zero_q

Sep 22

bleepingcomputer.com/news/security/…

_zero_q's tweet card. A new method and proof-of-concept tool called EDR-Freeze demonstrates that evading security solutions is possible from user mode with Microsoft's Windows Error Reporting (WER) system.

New EDR-Freeze tool uses Windows WER to suspend security software

Source: bleepingcomputer.com

Jan

@_zero_q

Sep 17

bleepingcomputer.com/news/security/…

_zero_q's tweet card. ClickFix isn't just back—it's mutating. New variants use fake CAPTCHAs, File Explorer tricks & MSI lures to drop MetaStealer. Stay ahead with Huntress' Tradecraft Tuesday threat briefings.

From ClickFix to MetaStealer: Dissecting Evolving Threat Actor Techniques

Source: bleepingcomputer.com

Jan

@_zero_q

Sep 14

Added another post about click fix hunting. #ThreatHunting #Crowdstrike #Python #DFIR zeroqblog.wordpress.com/2025/09/14/cro…

zeroqblog.wordpress.com

Crowdstrike: Hunting for Clickfix

One of the rather recent kind of social engineering attacks we see is called Clickfix. The attacker tries to convince the victim to copy, paste, and execute code via the Windows Run dialog. The cod…

Source: zeroqblog.wordpress.com

Jan

@_zero_q

Sep 5

Critical, make-me-super-user SAP S/4HANA bug under active exploitation go.theregister.com/feed/www.there… via @Inoreader

_zero_q's tweet card. : 9.9-rated flaw on the loose, so patch now

Critical, make-me-super-user SAP S/4HANA bug being exploited

Source: theregister.com

Jan

@_zero_q

Aug 30

Extended my blog posts on Crowdstrike threat hunting. This time looking for registry autostart entries. #ThreatHunting #Python #Crowdstrike #DFIR zeroqblog.wordpress.com/2025/08/30/cro…

_zero_q's tweet card. One of the most common things most threat actors are trying to achieve is persistence. There are many different ways to do this, the most simple one is adding your little malicious software to the …

Crowdstrike: Hunting for Registry Autostart Entries

Source: zeroqblog.wordpress.com

Jan

@_zero_q

Aug 23

Good read, nice source for #ThreatHunting ideas. Murky Panda hackers exploit cloud trust to hack downstream customers bleepingcomputer.com/news/security/…

_zero_q's tweet card. A Chinese state-sponsored hacking group known as Murky Panda (Silk Typhoon) exploits trusted relationships in cloud environments to gain initial access to the networks and data of downstream custom...

Murky Panda hackers exploit cloud trust to hack downstream customers

Source: bleepingcomputer.com

Jan

@_zero_q

Aug 9

#ThreatHunting #DFIR Pro-Tip: hunt on the weekend, much less noise from people, mostly automated stuff happening => easier spotting of suspicious patterns

Jan

@_zero_q

Aug 7

securityweek.com/plob-a-behavio…

_zero_q's tweet card. Splunk researchers developed a system to fingerprint post-logon behavior, using AI to find subtle signals of intrusion.

PLoB: A Behavioral Fingerprinting Framework to Hunt for Malicious Logins

Source: securityweek.com

Jan

@_zero_q

Aug 6

Playing around with Crowdstrike search capabilities and Python API. #ThreatHunting #Python #Crowdstrike zeroqblog.wordpress.com/2025/08/06/cro…

_zero_q's tweet card. You all know that adversaries may use DNS information from a zone file for reconnaissance. In order to get the hands on this a so called AXFR request can be issued and if the DNS server is not prop…

Crowdstrike: Hunting for DNS Zone Transfer

Source: zeroqblog.wordpress.com

Jan

@_zero_q

Aug 2

Akira Ransomware Exploits SonicWall VPNs in Likely Zero-Day Attack on Fully-Patched Devices thehackernews.com/2025/08/akira-…

_zero_q's tweet card. Akira ransomware exploits SonicWall SSL VPNs, hitting patched devices. Organizations face risks from possible zero-day flaw.

Akira Ransomware Exploits SonicWall VPNs in Likely Zero-Day Attack on Fully-Patched Devices

Source: thehackernews.com

Jan reposted

The Shadowserver Foundation

@Shadowserver

Jul 31

Public Dashboard links: CVE-2025-53770 tracker: dashboard.shadowserver.org/statistics/com… CVE-2025-53770 vulnerable breakdown: dashboard.shadowserver.org/statistics/com… Compromised SharePoint (IPs only, not vhosts or orgs): dashboard.shadowserver.org/statistics/com…

Jan reposted

Konrad Rieck 🌈

@mlsec

Jul 30

🚨 Got a great idea for an AI + Security competition? @satml_conf is now accepting proposals for its Competition Track! Showcase your challenge and engage the community. 👉 satml.org/call-for-compe… 🗓️ Deadline: Aug 6