kuhakusec's profile picture. BLANK

kuuhaku

@kuhakusec

BLANK

kuuhaku reposted
vxunderground's tweet image.

kuuhaku reposted

Tango Down #RagnarLocker 🎯

BushidoToken's tweet image. Tango Down #RagnarLocker 🎯

kuuhaku reposted

Threat Actors when they trip the EDR


kuuhaku reposted

The Operation Duck Hunt 🎯🦆 #QakBot takedown, from a perspective of bot (victim) connections to recently-polled active C2s. Things started to go south around 20:30 UTC on Friday evening (25 August). team-cymru.com/malware-and-bo… #BARS

teamcymru_S2's tweet image. The Operation Duck Hunt 🎯🦆 #QakBot takedown, from a perspective of bot (victim) connections to recently-polled active C2s.

Things started to go south around 20:30 UTC on Friday evening (25 August).

team-cymru.com/malware-and-bo…

#BARS

kuuhaku reposted

🎯#Qakbot Botnet Takedown in Operation Duck Hunt! 💻 700,000 Victim Computers 💰 $8.6m in cryptocurrency seized by DOJ 💰 Qakbot has earned $58m in ransoms 🔒 Qakbot used by Conti, ProLock, Egregor, REvil, MegaCortex, and Black Basta ransomware groups justice.gov/usao-cdca/pr/q…


kuuhaku reposted

🌐 #Ransomware Groups Statistics May 2023: - Lockbit: 77 🔻 - BlackCat: 42 🔻 - Royal: 31 🔺 - Play: 23 🔺 - BianLian: 22 🔺 - Akira: 21 🔺 - Medusa: 14 🔺 - Black Basta: 12 🔻 - Trigona: 10 🔺 - 8Base: 9 🆕 Total Victims: 351 (April 347) 🔺 ➡️ DARKFEED.IO

ido_cohen2's tweet image. 🌐 #Ransomware Groups Statistics May 2023:  

- Lockbit: 77 🔻
- BlackCat: 42 🔻
- Royal: 31 🔺
- Play: 23 🔺
- BianLian: 22 🔺
- Akira: 21 🔺
- Medusa: 14 🔺
- Black Basta: 12 🔻
- Trigona: 10 🔺
- 8Base: 9 🆕

Total Victims: 351 (April 347)  🔺

➡️ DARKFEED.IO

kuuhaku reposted

De Digger A search/discovery engine that allows you to find public files on Google Drive dedigger.com #OSINT

DailyDarkWeb's tweet image. De Digger

A search/discovery engine that allows you to find public files on Google Drive

dedigger.com

#OSINT

kuuhaku reposted

#OffensiveCon23 recordings are now live! Hope you enjoy :) youtube.com/playlist?list=…


kuuhaku reposted

*hacker voice*: "I'm in"


kuuhaku reposted

Hello. This is a message to the many up and coming ransomware groups we see. STOP. USING. BABUK. It is buggy. It fails decrypting large files and other edge cases. If you're going to be a criminal group, do it correctly. Your victims won't be able to recover files, dumbie.


kuuhaku reposted

Major concerns as Google is launching new #TLD s .zip and .mov which are valid file endings as well. Expecting frequent use for #phishing.

Today, Google Registry is launching eight new top-level domains: .dad, .phd, .prof, .esq, .foo, .zip, .mov and .nexus. Learn more ↓ blog.google/products/regis…



kuuhaku reposted

SparkRAT Infrastructure 🔍 There's been some excellent reporting on SparkRAT, but I have yet to find steps to identify possible infrastructure. The below Shodan query uses the default port, 8000, and HTTP response to identify servers. *Manual verification may be needed.

nahamike01's tweet image. SparkRAT Infrastructure 🔍

There's been some excellent reporting on SparkRAT, but I have yet to find steps to identify possible infrastructure.  

The below Shodan query uses the default port, 8000, and HTTP response to identify servers. 

*Manual verification may be needed.

kuuhaku reposted

Vshell infra 🎯 073fb179ccb5a8ecad40fad2c940ef3bd3ce06f1 search.censys.io/search?resourc… "Is cobalt strike hard to use? Lets try vshell" vshell is a remote administration tool written in Go (RAT) github.com/veo/vshell/blo… 8.222.140.105 39.98.173.197 43.136.116.140 45.76.97.205…

MichalKoczwara's tweet image. Vshell infra 🎯

073fb179ccb5a8ecad40fad2c940ef3bd3ce06f1

search.censys.io/search?resourc…

"Is cobalt strike hard to use? Lets try vshell"

vshell is a remote administration tool written in Go (RAT)

github.com/veo/vshell/blo…

8.222.140.105
39.98.173.197
43.136.116.140
45.76.97.205…
MichalKoczwara's tweet image. Vshell infra 🎯

073fb179ccb5a8ecad40fad2c940ef3bd3ce06f1

search.censys.io/search?resourc…

"Is cobalt strike hard to use? Lets try vshell"

vshell is a remote administration tool written in Go (RAT)

github.com/veo/vshell/blo…

8.222.140.105
39.98.173.197
43.136.116.140
45.76.97.205…

kuuhaku reposted

Go-Based #Kaiji #botnet #malware aka #Ares group Total Active C2 Panel count is (13)👇 threatfox.abuse.ch/browse/malware… which owns multiple botnets and provides rental services for #DDoS #attacks. Payload hosted Link: 154.19.243.107:8868 154.7.10.30:89 cc: @r3dbU7z

0xrb's tweet image. Go-Based #Kaiji #botnet  #malware aka #Ares group 
Total Active C2 Panel count is (13)👇 
threatfox.abuse.ch/browse/malware…
which owns multiple botnets and provides rental services for #DDoS #attacks.
Payload hosted Link: 
154.19.243.107:8868 
154.7.10.30:89
cc: @r3dbU7z
0xrb's tweet image. Go-Based #Kaiji #botnet  #malware aka #Ares group 
Total Active C2 Panel count is (13)👇 
threatfox.abuse.ch/browse/malware…
which owns multiple botnets and provides rental services for #DDoS #attacks.
Payload hosted Link: 
154.19.243.107:8868 
154.7.10.30:89
cc: @r3dbU7z
0xrb's tweet image. Go-Based #Kaiji #botnet  #malware aka #Ares group 
Total Active C2 Panel count is (13)👇 
threatfox.abuse.ch/browse/malware…
which owns multiple botnets and provides rental services for #DDoS #attacks.
Payload hosted Link: 
154.19.243.107:8868 
154.7.10.30:89
cc: @r3dbU7z
0xrb's tweet image. Go-Based #Kaiji #botnet  #malware aka #Ares group 
Total Active C2 Panel count is (13)👇 
threatfox.abuse.ch/browse/malware…
which owns multiple botnets and provides rental services for #DDoS #attacks.
Payload hosted Link: 
154.19.243.107:8868 
154.7.10.30:89
cc: @r3dbU7z

kuuhaku reposted

Currently #Nexus #Android #Banking #Botnet Targeting Turkey | Threat actor made turkey injects. cc: @TheHackersNews @3xp0rtblog

0xrb's tweet image. Currently  #Nexus #Android #Banking #Botnet Targeting Turkey  | Threat actor made turkey injects.
cc: @TheHackersNews @3xp0rtblog
0xrb's tweet image. Currently  #Nexus #Android #Banking #Botnet Targeting Turkey  | Threat actor made turkey injects.
cc: @TheHackersNews @3xp0rtblog
0xrb's tweet image. Currently  #Nexus #Android #Banking #Botnet Targeting Turkey  | Threat actor made turkey injects.
cc: @TheHackersNews @3xp0rtblog
0xrb's tweet image. Currently  #Nexus #Android #Banking #Botnet Targeting Turkey  | Threat actor made turkey injects.
cc: @TheHackersNews @3xp0rtblog

kuuhaku reposted

Very intelligent #android #malware actor filming his #C2 and giving away the URL. Targeting #spain and #portugal it seems. C2: hxxps://190.211.255.218/YTFlMzViNjNiNWM3/OTI0NGRhMTFlMDNk/index.php Probably: #Octo / #Coper android banker. malpedia.caad.fkie.fraunhofer.de/details/apk.co… @1ZRR4H


kuuhaku reposted

I am happy to release a new malware analysis tool. VISION-Process. A fast and cross platform Procmon visualization application written in Rust & TS. github.com/forensicxlab/V… An demo with QBOT : forensicxlab.com/posts/vision-p… Happy Hunting ! @pr0xylife #DFIR

k1nd0ne's tweet image. I am happy to release a new malware analysis tool.
VISION-Process. 

A fast and cross platform Procmon visualization application written in Rust & TS.

github.com/forensicxlab/V…

An demo with QBOT : 
forensicxlab.com/posts/vision-p…

Happy Hunting !
@pr0xylife #DFIR
k1nd0ne's tweet image. I am happy to release a new malware analysis tool.
VISION-Process. 

A fast and cross platform Procmon visualization application written in Rust & TS.

github.com/forensicxlab/V…

An demo with QBOT : 
forensicxlab.com/posts/vision-p…

Happy Hunting !
@pr0xylife #DFIR
k1nd0ne's tweet image. I am happy to release a new malware analysis tool.
VISION-Process. 

A fast and cross platform Procmon visualization application written in Rust & TS.

github.com/forensicxlab/V…

An demo with QBOT : 
forensicxlab.com/posts/vision-p…

Happy Hunting !
@pr0xylife #DFIR

kuuhaku reposted

Recent #truebot #malware activities #silence b7fed593e8eb3646f876367b56725e6c dbecfe9d5421d319534e0bfa5a6ac162 82d4025b84cf569ec82d21918d641540 ee1ccb6a0e38bf95e44b73c3c46268c5 c2: qweastradoc.]com (92.118.36.]213) Currently 54 infections See: huntress.com/blog/investiga…

ViriBack's tweet image. Recent #truebot #malware activities #silence

b7fed593e8eb3646f876367b56725e6c
dbecfe9d5421d319534e0bfa5a6ac162
82d4025b84cf569ec82d21918d641540
ee1ccb6a0e38bf95e44b73c3c46268c5

c2: qweastradoc.]com (92.118.36.]213)

Currently 54 infections

See: huntress.com/blog/investiga…

kuuhaku reposted

#eversoul #AIイラスト #에버소울 Velanna from Eversoul

Rurri00's tweet image. #eversoul   #AIイラスト  #에버소울 
Velanna from Eversoul

Loading...

Something went wrong.


Something went wrong.