Threat Intelligence Researcher @esthreat 🚀🚀| Blue Teamer
Joined August 2014
- Tweets5.4K
- Following4K
- Followers2K
- Likes15.6K
Bohan Zhang retweeted
Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe.
Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.
Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.
Bohan Zhang retweeted
You know what, since ClickFix is still a thing, why not write ANOTHER blog about it?! Yeah? So enjoy 💙
tenex.ai/blog/wordpress-clea…
Bohan Zhang retweeted
‼️ BREAKING: ~$2.5B in crypto left a Binance hot wallet in one transaction, sent to a brand-new address.
The wallet that triggered it was funded through Tornado Cash. Founder CZ says it looks like a hack.
Tether and Circle have frozen ~$1.8B. Binance has not confirmed a hack.
Bohan Zhang retweeted
Ivanti announced today that it has patched the privilege escalation vulnerability (CVE-2026-111357) in the Ivanti Connect Secure zero-day chain @Volexity disclosed on October 13. Affected devices should be patched ASAP: hub.ivanti.com/s/article/Sec…
.@Volexity has discovered in-the-wild exploitation of a #zeroday exploit chain targeting Ivanti Connect Secure VPN appliances (CVE-2026-104935). Beginning October 3, a previously unknown threat actor, UTA0576, chained three vulnerabilities to gain unauthenticated root-level code execution on a fully patched device. Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool.
Using its #Volcano memory analysis platform, Volexity analyzed the compromised device’s memory to uncover the full exploit chain and the attacker’s post-exploitation activity, which focused on credential theft, Active Directory reconnaissance, and data exfiltration. Volexity reported these findings to Ivanti through coordinated disclosure.
Read the full analysis, including detection guidance and IOCs, in our blog post here: volexity.com/blog/2026/10/13…
#DFIR #threatintel #memoryforensics
Bohan Zhang retweeted
1/ Yet another finding which we analyzed, this time a VT FUD #macOS Mach-O implant that self-identifies at runtime as "JOCKY agent", shared by @malwrhunterteam.
Here's why nothing caught it statically, explained in a thread below👇
Bohan Zhang retweeted
‼️ An unknown APT group likely poisoned the supply chain of a custom Windows 10 build for Asian governments, Kaspersky says.
Its NetamLoader malware hid in a Windows Update folder among real Patch My PC files and ran via Microsoft-signed .NET code.
Bohan Zhang retweeted
I introduce you to a long running bulletproof hoster swissrdp[.].com hackforums.net/showthread.ph…
Is it a coincidence that the domain they use to advert bulletproof hosting is mapped to this ASN that also use the term 'swiss'?
plesk[.]swissrdp[.]com to 31.56.209[.]3 AS 209373
Bohan Zhang retweeted
#CyberAlert | AL26-028 – Ongoing Help Desk Voice Phishing Campaign Targeting Canadian Organizations
The Cyber Centre is aware of an ongoing voice phishing (vishing) campaign targeting Canadian organizations.
cyber.gc.ca/en/alerts-adviso…
@rcmpgrcpolice
Bohan Zhang retweeted
1/ Cloning a GitHub repo for a "technical interview" on your #Mac? Check .git/hooks first.
We found a cluster of trojanized repos where post-checkout is a multi-platform dropper for BeaverTail, the DPRK infostealer behind Contagious Interview. 🧵👇
Bohan Zhang retweeted
🚨 China-linked hackers exploited a VMware ESX zero-day to conceal activity from audit logs.
CrowdStrike links the attacks to Warp Panda, which targeted the U.S. legal sector.
CISA has now added CVE-2026-41709 to its KEV catalog.
Details: thehackernews.com/2026/10/ch…
Bohan Zhang retweeted
The @FBI and @TheJusticeDept have announced the disruption of Virtualine, a so-called “bulletproof hosting” service designed to help cybercriminals evade detection and law enforcement action.
Before the FBI and its partners shut it down, the Virtualine[.]net domain was used to facilitate the distribution of child sexual abuse material (CSAM), international money laundering, and numerous other cybercrimes.
The case was investigated by @FBIWFO, with significant assistance from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the UK’s National Crime Agency, and private sector partners OverRIPE and Lumen. The Justice Department’s Office of International Affairs provided additional support.
justice.gov/usao-edva/pr/bul…
ALT FBI seizure notice for Virtualine.net with logos of international law enforcement and private sector partners involved in Operation Omega Line.
Bohan Zhang retweeted
Oh boy …
🔐 ⚠️ phpMyAdmin 5.2.3 - 2FA Bypass! 0day++! ⚠️ 🔐
🚨 WebAuthn signatures are parsed but never COSE-verified against credentialPublicKey 🚨 Arbitrary bytes pass the structural checks, so 2FA falls over after password auth 💀
Exploit:
> CWE-347/287 ⚠️ CVSS 8.1
> 🐙 github.com/abraxas/PMA-5.2.3…
🧩 Root cause: web-auth/webauthn-lib is only a dev/suggest dependency 📦 The distributed tarball is built with `composer install --no-dev`, so `WebAuthn::createServer` instantiates `CustomServer` instead of `WebauthnLibServer` 👀
🔍 How? 🤦♂️ `CustomServer::parseAndValidateAssertionResponse` enforces structural checks only: clientData type, session challenge, origin host, rpIdHash, user-present, allowed credential id 📋 `response.signature` is decoded and never verified ❌ `credentialPublicKey` is never read 🕳️
💥 Impact: a well-formed assertion carrying correct structural fields and an arbitrary signature yields a full authenticated session 🔓 Impact is unauthorized database access through the application, not host-level code execution 🗄️
Bohan Zhang retweeted
🚨 PHP2Shell exploited in real-world attacks.
An attacker chained PHP2Shell with a Linux kernel flaw to gain root access to 25 servers across four countries, including three in a U.S. government-affiliated environment.
The intrusion extended into the internal network, where the attacker targeted Active Directory.
Suspected China nexus. Signs of AI-assisted tooling.
Read the full report: thehackernews.com/2026/10/ph…
Bohan Zhang retweeted
🚨🇺🇸 Discord will let search engines index messages from public servers
Starting in mid-December, messages posted in eligible public channels on Discoverable Discord servers may appear on server web pages and in search results on Google and other search engines.
⠀
The change only applies to Discoverable Servers, which have at least 1,000 members and can be joined without an invitation.
Private servers, restricted channels, direct messages and group DMs are excluded.
⠀
Discord says:
• Messages posted before the rollout will not be included
• Usernames and avatars will not appear beside indexed messages
• Participating channels will be clearly labeled
• Server administrators can exclude individual channels or disable the feature
• Users can prevent future messages from appearing through Data & Privacy settings
• Teen accounts are excluded entirely
⠀
The individual message setting will be enabled by default in most regions. It will be disabled by default in the EU/EEA, UK, Canada, Brazil, Australia and South Korea.
Turning the setting off only affects messages posted while it is disabled. Messages sent while the feature was enabled may remain public unless the original Discord message is deleted, and cached search results may take longer to disappear.
⠀
Beginning November 16, every Discoverable Server will also receive a public Server Web Page that may contain AI-generated summaries of discussions from selected public channels.
Bohan Zhang retweeted
In an international law enforcement operation 👮, the US Department of Justice 🇺🇸, in cooperation with private sector partners, have taken down notorious bulletproof hosting provider Virtualine 💥
➡️ justice.gov/usao-edva/pr/bul…
Operating as AS202412 (Omegatech LTD), Virtualine received upstream connectivity from German 🇩🇪 providers aurologic GmbH (AS30823) and Pfcloud UG (AS51396), as well as French 🇫🇷 PEERXY NETWORKS SAS (AS213382), as bgp .tools shows. This network connectivity is now gone, currently making it impossible for Omegatech to operate 🛑
Omegatech announced 24x /24 IPv4 CIDRs, totaling 6,144 IPs. Out of these, hundreds were seen daily participating in spamming, internet-wide scanning, and botnet C2 hosting ⤵️
🌐 URLhaus tracked over 10,000 malware distribution sites at Omegatech: urlhaus.abuse.ch/asn/202412
📡 ThreatFox logged 2,000+ community-shared IOCs tied directly to Omegatech: threatfox.abuse.ch/asn/20241…
The hoster primarily served malicious infrastructure associated with RATs 🖥️ (e.g., PureRAT and OverlordRAT), rogue ScreenConnect servers 🔌, and social engineering malware campaigns like ClickFix and ErrTraffic 🖱️. While internet abuse for sure can happen, Virtualine was not reacting on abuse reports at all and advertised their "bulletproof hosting services" on the darkweb, as investigation shows 🕵️♀️
The takedown of Omegatech is welcome news. However, its long-term impact remains uncertain. Bulletproof hosters commonly re-brand and resume operations under new ASNs quickly 🔃
Furthermore, Omegatech is just the tip of the iceberg. Other active bulletproof hosters include:
➡️ AS219502 (STORMCLOUD)
➡️ AS207043 (DEDIK-IO)
➡️ AS214351 (FEMOIT)
What do they all have in common? According to bgp .tools, they all receive upstream connectivity from German provider aurologic GmbH (AS30823) as well 🔍👀
If you don't want to worry about the threats posed by bulletproof hosters, just block any CIDRs and ASNs listed on @spamhaus 's Don't Router Or Peer List (DROP):
🛑 spamhaus.org/blocklists/do-n…
ALT bgp.tools showing historic BGP upstream connectivity of Omegatech LTD provided by AS213382 PEERYX, AS30823 aurologic GmbH and AS51396 Pfcloud UG
Bohan Zhang retweeted
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
