
Head of Cyber Threat Intelligence @ Würth IT, GCTI/CPENT/CEH/CND/CSA/ECSA/ECIH/CTIA, owner of SATAYO CTI platform & deepdarkCTI - member of @Curatedintel
Cyberspace (fastfire)
Joined January 2009
- Tweets5.4K
- Following657
- Followers2.5K
- Likes796
fastfire retweeted
Hunting ARTEX, Cairn and PentAGI, the AI harnesses behind recent intrusions? Start here:
ARTEX: title:"ARTEX — 自主渗透测试控制台" ?
Cairn: title:"Cairn" + server: uvicorn ?
PentAGI: http.favicon.hash:-1596753120 ?
Titles miss forks and renames. Full method: rstcloud.com/hunting-ai-harn… #ARTEX #CAIRN #PenAGI
fastfire retweeted
#Ransomware 📣 NEW FEATURE
La nuova sezione RF Domain Monitor permette il monitoraggio costante dei domini sotto controllo #Ransomfeed e di deepdarkCTI project (@fastfire), alla ricerca di variazioni DNS e law enforcement.
1/2
fastfire retweeted
Better patch your Veeam Backup & Replication servers! Full system takeover via CVE-2024-40711, discovered by our very own @frycos - no technical details from us this time because this might instantly be abused by ransomware gangs code-white.com/public-vulner…
fastfire retweeted
Finally the charges against Pavel Durov has been published:
- Complicity - Administration of an online platform to allow an illegal transaction in an organised band,
- Refusal to communicate, at the request of the authorised authorities, the information or documents necessary for the realisation and exploitation of interceptions authorised by law,
- Complicity - Detention of the image of a minor of a child-pornographic nature,
- Complicity - Dissemination, offer or making available in an organised tape of images of a minor of a pornographic nature,
- Complicity - Acquisition, transport, holding, offer or disposal of narcotic products,
- Complicity - Offer, assignment or making available without legitimate reason of equipment, an instrument, a program or data designed or adapted for the attack and access to the operation of an automated data processing system,
- Complicity - Organised gang scam,
- Association of criminals with a view to committing a crime or offence punishable by 5 years of imprisonment at least,
- Money laundering of crimes or offences in organised gangs,
- Provision of cryptology services to ensure confidentiality functions without a declaration of conformity,
- Provision of a cryptological means not exclusively ensuring authentication or integrity control functions without prior declaration,
- Import of a cryptology means that does not exclusively perform authentication or integrity control functions without prior declaration.
fastfire retweeted
Today, the famous hacker USDoD has been doxed by CrowdStrike.
You want to know how?
It's #OSINT time!
fastfire retweeted
⚠️PSA: Curated Intel DFIR has noticed a new trend among Akira Ransomware cases in Summer 2024. For a while, Akira has been exploiting Cisco ASA devices.
➡️ They are now targeting SonicWall SSL-VPNs for access with no MFA (!) and weak passwords (!). Other TTPs remain the same 🔍
fastfire retweeted
My latest blog about Bulletproof hosting services!
#Cybersecurity #Cybercrime #BulletproofHosting #BPH #TechBlog #CyberThreats #Infosec #ThreatIntelligence #CyberThreatIntelligence #CTI #InformationSecurity #Investigation #underground
#forums
cybercrimediaries.com/post/5…
fastfire retweeted
TeamViewer warns its corporate network was breached and that they will be transparent with updates.
However, they noindexed/nofollowed the breach notification page so its not indexed by search engines.
teamviewer.com/en/resources/…
fastfire retweeted
🚨 Ransomware attacks are currently one of the most serious threats to an organization's security.
🛡️ That's why, together with Polish cybersecurity experts, we have developed a document that describes possible ways to secure an organization and provides suggestions for responding in the event of a ransomware incident.
🔗 Link to the paper:
knf.gov.pl/en/?articleId=894…
fastfire retweeted
🚀 EDR Telemetry Project Update: New Comparison Feature
Thanks to one of our contributors, we now have a way to compare the EDRs in this project!
Now, the results are displayed in an easy-to-read table right in the terminal. Each EDR is ranked and scored based on its capabilities. Please see the PR to read about the scoring weight. Any comments/improvement suggestions are welcome! 🙏
Link to PR 🔗: github.com/tsale/EDR-Telemet…
fastfire retweeted
This new collective, High Society, has declared Italy its first target.
Italian networks can expect some possible DDoS and defacement attacks in the next day or so. If you've been a target previously of pro-Russian hacktivists, then expect they will target you again.
#cybersecurity #infosec #Italy #RussiaUkraineWar
Usersec has created a new collective. This collective has hacktivist groups from different regions, including Asian hacktivist groups.
There has been an increase in cross engagement between hacktivist groups of different intent and targeting recently, and this is an extension of that.
It's also not the first time pro-Russian hacktivists have created collectives with other hacktivist groups, and often, I have seen Russian and Indian teams work together.
Of all the pro-Russian hacktivists,Usersec seems to be the one most motivated to form broad reaching alliances. You'll notice this list also includes some closed groups, marking the first time, and some of them have had mass exposure.
(Yes, all the cybertrackers need an update 🙃🙃🙃)
#cybersecurity #infosec #RussiaUkraineWar #India #Russia
fastfire retweeted
Our team at @Volexity has identified a new 0day exploited in the wild. This time we caught a threat actor using an unauthenticated RCE in Palo Alto Networks GlobalProtect. It has been assigned CVE-2024-3400 and is covered in this @PaloAltoNtwks advisory security.paloaltonetworks.co…
fastfire retweeted
📌 STOP/DJVU ransomware stats panel.
53068 unique records of potential installations (includes sandboxes and others) 🧐
TOP 10 unique installs per country:
- United States: 4249
- Brazil: 3791
- Pakistan: 3661
- Algeria: 2278
- India: 2280
- Mexico: 1748
- Indonesia: 1570
- Thailand: 1304
- Colombia: 1225
- Morocco: 1168
* The data comes from one of the attackers' panels and corresponds to a campaign that has been active since at least the first week of January 2024.
[+] github.com/CronUp/EnAnalisis…
fastfire retweeted
Here's our PoC for the Connectwise ScreenConnect Auth Bypass:
github.com/watchtowrlabs/con…
The vuln is the definition of trivial and thus we won't release any analysis. Not sure what we would share - "Add a / and you too can pwn the world"?
fastfire retweeted
I have created a YARA rule to detect binaries that are signed with a potentially compromised AnyDesk signing certificate
(if the PE header info isn't AnyDesk -> other binaries signed with the compromised cert)
#100DaysOfYARA #AnyDesk
github.com/Neo23x0/signature…
fastfire retweeted
🔬Kryptina v2.1 - Ransomware-as-a-Service for Linux systems
🔒The ransomware landscape is changing: tools like Kryptina make initiating attacks on Linux systems easy, even for beginners. This trend of user-friendly ransomware tools poses a growing threat to cybersec
#ransomware
fastfire retweeted
Ummm @Mandiant - you good bro?
fastfire retweeted
Awesome research conducted by @gimchesh about the #infostealer ecosystem first.org/resources/papers/c… cc @ddd1ms @Gi7w0rm @g0njxa









































