fastfire (@fastfire) header
fastfire (@fastfire) profile picture

Head of Cyber Threat Intelligence @ Würth IT, GCTI/CPENT/CEH/CND/CSA/ECSA/ECIH/CTIA, owner of SATAYO CTI platform & deepdarkCTI - member of @Curatedintel

Cyberspace (fastfire)
Joined January 2009
Photo by fastfire (@fastfire)Photo by fastfire (@fastfire)Photo by fastfire (@fastfire)Photo by fastfire (@fastfire)Photo by fastfire (@fastfire)Photo by fastfire (@fastfire)Photo by fastfire (@fastfire)Photo by fastfire (@fastfire)Photo by fastfire (@fastfire)Photo by fastfire (@fastfire)
fastfire retweeted
Hunting ARTEX, Cairn and PentAGI, the AI harnesses behind recent intrusions? Start here: ARTEX: title:"ARTEX — 自主渗透测试控制台" ? Cairn: title:"Cairn" + server: uvicorn ? PentAGI: http.favicon.hash:-1596753120 ? Titles miss forks and renames. Full method: rstcloud.com/hunting-ai-harn… #ARTEX #CAIRN #PenAGI
4
29
3
155
19,563
#Ransomware 📣 NEW FEATURE La nuova sezione RF Domain Monitor permette il monitoraggio costante dei domini sotto controllo #Ransomfeed e di deepdarkCTI project (@fastfire), alla ricerca di variazioni DNS e law enforcement. 1/2
1
1
3
2,727
🚨 Telekom Security detected a major #vishing campaign against multiple targets in #Germany, likely related to a ransomware group. We are still analyzing, but here is what we know so far 🧵1/x
6
50
8
163
41,142
Better patch your Veeam Backup & Replication servers! Full system takeover via CVE-2024-40711, discovered by our very own @frycos - no technical details from us this time because this might instantly be abused by ransomware gangs code-white.com/public-vulner…
5
97
6
269
37,430
Finally the charges against Pavel Durov has been published: - Complicity - Administration of an online platform to allow an illegal transaction in an organised band, - Refusal to communicate, at the request of the authorised authorities, the information or documents necessary for the realisation and exploitation of interceptions authorised by law, - Complicity - Detention of the image of a minor of a child-pornographic nature, - Complicity - Dissemination, offer or making available in an organised tape of images of a minor of a pornographic nature, - Complicity - Acquisition, transport, holding, offer or disposal of narcotic products, - Complicity - Offer, assignment or making available without legitimate reason of equipment, an instrument, a program or data designed or adapted for the attack and access to the operation of an automated data processing system, - Complicity - Organised gang scam, - Association of criminals with a view to committing a crime or offence punishable by 5 years of imprisonment at least, - Money laundering of crimes or offences in organised gangs, - Provision of cryptology services to ensure confidentiality functions without a declaration of conformity, - Provision of a cryptological means not exclusively ensuring authentication or integrity control functions without prior declaration, - Import of a cryptology means that does not exclusively perform authentication or integrity control functions without prior declaration.
On Linkedin, Jean-Michel Bernigaud, (OFMIN chief of staff) wrote "At the heart of this case is the lack of moderation and cooperation from the platform [..] particularly in the fight against pedocriminality." Ultimately, it's all about content moderation.
164
1,029
339
2,486
1,247,966
Today, the famous hacker USDoD has been doxed by CrowdStrike. You want to know how? It's #OSINT time!
71
701
130
5,980
2,050,139
⚠️PSA: Curated Intel DFIR has noticed a new trend among Akira Ransomware cases in Summer 2024. For a while, Akira has been exploiting Cisco ASA devices. ➡️ They are now targeting SonicWall SSL-VPNs for access with no MFA (!) and weak passwords (!). Other TTPs remain the same 🔍
25
50
10,017
TeamViewer warns its corporate network was breached and that they will be transparent with updates. However, they noindexed/nofollowed the breach notification page so its not indexed by search engines. teamviewer.com/en/resources/…
17
149
11
716
80,035
🚨 Ransomware attacks are currently one of the most serious threats to an organization's security. 🛡️ That's why, together with Polish cybersecurity experts, we have developed a document that describes possible ways to secure an organization and provides suggestions for responding in the event of a ransomware incident. 🔗 Link to the paper: knf.gov.pl/en/?articleId=894…
10
1
15
6,607
fastfire retweeted
🚀 EDR Telemetry Project Update: New Comparison Feature Thanks to one of our contributors, we now have a way to compare the EDRs in this project! Now, the results are displayed in an easy-to-read table right in the terminal. Each EDR is ranked and scored based on its capabilities. Please see the PR to read about the scoring weight. Any comments/improvement suggestions are welcome! 🙏 Link to PR 🔗: github.com/tsale/EDR-Telemet…
24
225
2
844
106,445
This new collective, High Society, has declared Italy its first target. Italian networks can expect some possible DDoS and defacement attacks in the next day or so. If you've been a target previously of pro-Russian hacktivists, then expect they will target you again. #cybersecurity #infosec #Italy #RussiaUkraineWar
Usersec has created a new collective. This collective has hacktivist groups from different regions, including Asian hacktivist groups. There has been an increase in cross engagement between hacktivist groups of different intent and targeting recently, and this is an extension of that. It's also not the first time pro-Russian hacktivists have created collectives with other hacktivist groups, and often, I have seen Russian and Indian teams work together. Of all the pro-Russian hacktivists,Usersec seems to be the one most motivated to form broad reaching alliances. You'll notice this list also includes some closed groups, marking the first time, and some of them have had mass exposure. (Yes, all the cybertrackers need an update 🙃🙃🙃) #cybersecurity #infosec #RussiaUkraineWar #India #Russia
8
13
3,394
📌 STOP/DJVU ransomware stats panel. 53068 unique records of potential installations (includes sandboxes and others) 🧐 TOP 10 unique installs per country: - United States: 4249 - Brazil: 3791 - Pakistan: 3661 - Algeria: 2278 - India: 2280 - Mexico: 1748 - Indonesia: 1570 - Thailand: 1304 - Colombia: 1225 - Morocco: 1168 * The data comes from one of the attackers' panels and corresponds to a campaign that has been active since at least the first week of January 2024. [+] github.com/CronUp/EnAnalisis…
1
23
2
42
12,855
Here's our PoC for the Connectwise ScreenConnect Auth Bypass: github.com/watchtowrlabs/con… The vuln is the definition of trivial and thus we won't release any analysis. Not sure what we would share - "Add a / and you too can pwn the world"?
16
77
5
239
59,965
So, you are looking for the #AnyDesk potential compromised signing certificate but do not have the serial number details of the processes in your EDR? What can you do? Well, for #Elastic, follow the thread.
1
19
1
71
23,497
I have created a YARA rule to detect binaries that are signed with a potentially compromised AnyDesk signing certificate (if the PE header info isn't AnyDesk -> other binaries signed with the compromised cert) #100DaysOfYARA #AnyDesk github.com/Neo23x0/signature…
12
195
18
567
217,489
🔬Kryptina v2.1 - Ransomware-as-a-Service for Linux systems 🔒The ransomware landscape is changing: tools like Kryptina make initiating attacks on Linux systems easy, even for beginners. This trend of user-friendly ransomware tools poses a growing threat to cybersec #ransomware
2
19
1
74
7,037
Ummm @Mandiant - you good bro?
23
61
24
426
174,187
Awesome research conducted by @gimchesh about the #infostealer ecosystem first.org/resources/papers/c… cc @ddd1ms @Gi7w0rm @g0njxa
3
29
89
21,870