Andrew Pease
@andythevariable
Elastic Security Labs Technical Lead. Lawful Neutral. Threat Hunting with the Elastic Stack author. Retired CW4.
You might like
It's not too often we get to work shoulder-to-shoulder with the practitioners and researchers on the front lines. #REF3927 is an intrusion set that deploys SEO cloaking capabilities, RATs, webshells, and RMMs - largely using a novel IIS module we named #TOLLBOOTH
#ElasticSecurityLabs joins forces with @tamusystem and discloses TOLLBOOTH, an IIS module used for SEO abuse that relies on publicly exposed ASP. NET machine keys: go.es.io/3L68p57
Excited to publish this in a few days…
@elasticseclabs is currently researching a new family of IIS malware impacting a large number of organizations globally. With a US university-based MDR provider, we’ve observed a novel attack chain, RMMs, a Godzilla-forked framework, and a malicious driver. Details coming soon.
YAAAHHHSSSS
Introducing our V1 Video Model. It's fun, easy, and beautiful. Available at 10$/month, it's the first video model for *everyone* and it's available now.
As defenders it’s always interesting to see how TAs view the landscape vs. the commercial checkboxes. Iron sharpens iron, good red teams make good blue teams.
Introducing our V1 Video Model. It's fun, easy, and beautiful. Available at 10$/month, it's the first video model for *everyone* and it's available now.
some detection/hunt rules to get started for SAP vuln CVE-2025-31324 : - JSP/JAVA/Class creation in the SAP IRJ dir. - Suspicious child processes indicating execution. github.com/elastic/detect…
Huh? That’s weird… what is that? It kind of looks like it’s a… new #cybersecurity report? 🤔 We’re excited about this one. Look out for more this week.
Sometimes naming intrusions and families can be tough - but sometimes TAs do all the hard work. Sorry Shelby's, but @soolidsnakee and @bluish_red_ had to put you to the canvas. #shelbyc2 #shelbyloader #ref8685
We’re exposing a newly discovered #malware family that has made its home on #GitHub. SHELBY targeted a middle east telecom company, uses GH commits for C2, and shares hard-coded tokens for authentication. Read the malware and campaign breakdown: go.es.io/3DXE8Cv
The significant thing to note with the ABYSSWORKER intrusion is that this isn't just BYOD; it's BYO(Malicious)D, something that's not super common. Solid research and analysis by @cyril_t_f
Join @cyril_t_f and #ElasticSecurityLabs in exposing ABYSSWORKER, a malicious driver that silences #EDR tools and is distributed via the MEDUSA #ransomware. Get the deep details: go.es.io/4bFKnr5
92 new OPEN, 106 new PRO (92 + 14) SocGholish, Lumma Stealer, REF7707, TA2726, NetSupport RAT, TA4903, TA399.... community.emergingthreats.net/t/ruleset-upda…
Elastic Security Labs researchers look into the REF7707 campaign targeting the foreign ministry of a South American country. The intrusion set utilized by REF7707 includes novel malware families such as FINALDRAFT, GUIDLOADER and PATHLOADER. elastic.co/security-labs/…
A very rewarding analysis of the #REF7707 intrusion set and infra as a compendium to the #FINALDRAFT and #PATHLOADER malware disclosure from #ElasticSecurityLabs.
You’ve learned about the malware, but what about the story behind it? Explore the twists and turns of REF7707 — an adversary campaign that spans the globe: go.es.io/41eeeTY #ElasticSecurityLabs #cybersecurity #cyberattack
adapter.radiws[.]com app.radiys[.]com support.anyconnact[.]com cloud.online-wsus[.]net probably related with @elastic report on #REF7707 infrastructure, naming convention also matches found with @ValidinLLC pivoting on indicators report: elastic.co/security-labs/…
![lontze7's tweet image. adapter.radiws[.]com
app.radiys[.]com
support.anyconnact[.]com
cloud.online-wsus[.]net
probably related with @elastic report on #REF7707 infrastructure, naming convention also matches
found with @ValidinLLC pivoting on indicators
report: elastic.co/security-labs/…](https://pbs.twimg.com/media/GjmMI51XMAA4Bz_.png)
![lontze7's tweet image. adapter.radiws[.]com
app.radiys[.]com
support.anyconnact[.]com
cloud.online-wsus[.]net
probably related with @elastic report on #REF7707 infrastructure, naming convention also matches
found with @ValidinLLC pivoting on indicators
report: elastic.co/security-labs/…](https://pbs.twimg.com/media/GjmMrmGWEAEjouH.png)
![lontze7's tweet image. adapter.radiws[.]com
app.radiys[.]com
support.anyconnact[.]com
cloud.online-wsus[.]net
probably related with @elastic report on #REF7707 infrastructure, naming convention also matches
found with @ValidinLLC pivoting on indicators
report: elastic.co/security-labs/…](https://pbs.twimg.com/media/GjmMuJfWYAAK3VQ.png)
This is tremendously exciting. Bug bounty for rules - the commitment to openness and improvement continues. Iron sharpens iron.
We’re adding a new section to @elastic’s HackerOne Bounty Program! Today, we’re opening our SIEM and EDR rules for testing. We’re excited to have another way to thank our community for their efforts on our #detectionengineering. Get more details here: go.es.io/4hdKQCI
Lets do an @elastic Behavior breakdown on this malicious #Python package, targeting #macOS, to include how we can detect and prevent threats like this featuring a sneak peek at one of the new data sources coming to our Elastic macOS agent very soon. Here is the link to the…
Researchers have uncovered a malicious Python package posing as a #cryptocurrency trading tool. Downloaded over 1,300 times before removal, this #malware affects Windows and macOS systems. Read: thehackernews.com/2024/10/resear… #infosec #cybersecurity
Cool research by @DefSecSentinel great walkthrough of these Python "coding challenges" that the DPRK is continuing to float around. elastic.co/security-labs/…
#ElasticSecurityLabs is introducing HexForge, our tool that enhances #IDAPro with manipulation capabilities built into the hex and disassembly views. HexForge makes it easy to copy and patch binary data and currently supports RC4, AES, ChaCha20, and XOR: go.es.io/4cTCME2
Another banger. Second part of the series. Dense, but I’ve not seen all this assembled together in the past.
The #linux detection engineering saga continues! Breakdown persistence techniques both simple and complex in this new article from @RFGroenewoud: go.es.io/3X6w7k9 #ElasticSecurityLabs #detectionengineering
Brand new research on this newly discovered family. YARA, detection logic, rules included.
#ElasticSecurityLabs is exposing Banshee Stealer — a brand new macOS infostealer with ties to browsers and cryptocurrency. This MaaS collects an immense amount of data, but you can get the details and protections here: go.es.io/3YNQeWY #malware #cryptocurrency #macos
This is crazy. Wild it’s been exploitable so long. 🤞 a patch comes soon 🤞 Catch @dez_ at #BHUSA to get the skinny.
This new article from @dez_ reveals 4 attack techniques linked to SmartScreen and SmartAppControl. Check it out: go.es.io/4d5L2BR Will you be at #BHUSA? Stop by @elastic booth #2350 to chat with Joe or catch his lightning talk! #ElasticSecurityLabs #threattechnique
To the engineers at CS and at the impacted organizations, thank you for the herculean work you're all doing.
All of CrowdStrike continues to work closely with impacted customers and partners to ensure that all systems are restored. I’m sharing the letter I sent to CrowdStrike’s customers and partners. As this incident is resolved, you have my commitment to provide full transparency on…
United States Trends
- 1. Jonathan Taylor 19.4K posts
- 2. Falcons 30.4K posts
- 3. Colts 50.2K posts
- 4. Kyle Williams 4,672 posts
- 5. Daniel Jones 9,875 posts
- 6. Penix 10.6K posts
- 7. Parker Washington 2,560 posts
- 8. #Browns 2,105 posts
- 9. Jaxson Dart 2,759 posts
- 10. Joe Brady 1,317 posts
- 11. Dillon Gabriel 1,276 posts
- 12. #BillsMafia 5,251 posts
- 13. Liverpool 213K posts
- 14. Bijan 6,585 posts
- 15. Starks 1,771 posts
- 16. #DawgPound 1,561 posts
- 17. Max B 24.3K posts
- 18. #ForTheShoe 3,771 posts
- 19. Mooney 4,105 posts
- 20. #NYGiants 1,681 posts
You might like
-
Elastic Security Labs
@elasticseclabs -
Steve YARA Synapse Miller
@stvemillertime -
Jonny Johnson
@JonnyJohnson_ -
Tony Lambert
@ForensicITGuy -
Mehmet Ergene
@Cyb3rMonk -
Jai Minton
@CyberRaiju -
DefSecSentinel
@DefSecSentinel -
Joe Desimone
@dez_ -
The Haag™
@M_haggis -
Devon Kerr
@_devonkerr_ -
James
@jamesspi -
Mauricio Velazco
@mvelazco -
Ramin Nafisi
@MalwareRE -
0xBurgers
@0xBurgers -
J⩜⃝mie Williams
@jamieantisocial
Something went wrong.
Something went wrong.