Pinned Tweet
Looking for me elsewhere?
🐘infosec.exchange/@goretsky
🦋bsky.app/profile/goretsky.bs…
Aryeh Goretsky {@infosec.exchange} retweeted
#cybersecurity #macos #malware
Phexia macOS infostealer new C2 domains:
pobruog[.]wiki
samehoo229[.]fun
gran1xea[.]xyz
payload1717[.]pro
xzttyt[.]xyz
zmngfjl[.]fun
zttrych[.]icu
secdarvin2026[.]icu
oreshnik[.]top
Phexia uses the Polygon #blockchain to store C2 domain names.
Aryeh Goretsky {@infosec.exchange} retweeted
Public exploit for GitLab CVE-2026-110264 dropped on 23 October, the same day Ruby shipped Regexp fixes in three releases. threatcluster.io/cluster/reg…
Aryeh Goretsky {@infosec.exchange} retweeted
ESET researchers Anton Cherepanov & Peter Strýček uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – which paved the way for a destructive attack against a Ukrainian grain firm. welivesecurity.com/en/eset-r…
Aryeh Goretsky {@infosec.exchange} retweeted
CrashStealer
FollowUpUIAgent.dmg
f8842e867499e126d1638451affeed3f
Aryeh Goretsky {@infosec.exchange} retweeted
Related 'NARCOTICS NETWORK AND POLICE FACILITATION.doc' seen from Pakistan @abuse_ch
e6eca876f1e4423eadde8298c879774118f094d0b714a9dd202883b50ddc02dc
bazaar.abuse.ch/sample/e6eca…
Aryeh Goretsky {@infosec.exchange} retweeted
🚨 SpyNote Android RAT
A fake Google Play Store page is distributing a suspicious APK identified as SpyNote.
IOCs:
Domain:
play-googlese[.]app
APK host:
psoz96apk[.]9yyl9[.]net
psoz96apk[.]9yyl9[.]net/psoz96apk/kobaiapp
Filename: kobai app.apk
312ccddffce813529d27c0962b140c031e6d7e8aa8eec3f4c6ada40d16d775d0
#SpyNote #AndroidMalware #ThreatIntel @500mk500 @skocherhan
Aryeh Goretsky {@infosec.exchange} retweeted
INTEL DROP
Top 20 tools in Total Insights detection pipeline, ranked by the number of distinct IPs observed today per family.
C2 by IP count:
1,200+ CyberStrikeAI
500+ VShell
400+ PureRAT
300+ Cobalt Strike
300+ Sliver
200+ AdaptixC2
200+ XWorm
200+ Metasploit
200+ DarkSword
200+ OverlordRAT
200+ Hak5 Cloud C2
200+ Mirai
200+ RemcosRAT
100+ Mythic
90+ QuasarRAT
70+ PlugX
70+ Stealc
60+ Havoc
50+ SuperShell
50+ AsyncRAT
Offensive-security tools by IP count:
2,000+ Nessus
1,400+ ARL
1,400+ GoPhish
1,200+ ARTEX
1,200+ Interactsh
1,200+ Acunetix
600+ Burp Collaborator
400+ PentAGI
200+ Kali Linux
200+ Scope Sentry
200+ Java-Chains
80+ DeepAudit
60+ Hashtopolis
60+ reNgine
50+ Ligolo-ng
50+ Evilginx
40+ Xingrin
20+ Modlishka
10+ HTTP-revshell
10+ JspSpy
**This is not meant to convey a detection priorities ranking and is purely statistical observation (with unknowns). All organizations detection priorities are unique.
#TotalInsights #ThreatIntel #ThreatHunting #C2
team-cymru.com/total-insight…
Aryeh Goretsky {@infosec.exchange} retweeted
First observed in April 2026, #SiriusQT is more than just another Windows RAT. Our investigation uncovered more than 280 publicly available SiriusQT client samples linked to different campaigns and identified 146 unique licenses, 110 of which were leaked. At least 30 users purchased valid licenses, while 30-day, 90-day, lifetime, and customized license periods point to an active commercial ecosystem around the #malware. #ThreatIntelligence
Aryeh Goretsky {@infosec.exchange} retweeted
#ESETresearch uncovered #MythicRatatoskr, an undocumented Go backdoor hiding its C&C server inside the #Yggdrasil mesh network. It was used against a Ukrainian 🇺🇦 grain logistics firm in an intrusion that ended in a destructive #Sandworm attack.
welivesecurity.com/en/eset-r… 1/6
Aryeh Goretsky {@infosec.exchange} retweeted
SOCRadar found INC and The Gentlemen affiliates using LLMs in intrusions and extortion. Seven servers held 8,257 AI messages and 46 encryptors staged for six victims. socradar.io/blog/inc-gentlem…
Aryeh Goretsky {@infosec.exchange} retweeted
Highly Suspicious ChatGPT-6 Website
URL: chatgpt-6[.]app
Potential OpenAI brand impersonation. Credential theft is not confirmed.
#phishing @500mk500 @skocherhan @TheKn0ck0ut @KirkDerpca #OpenAI
Aryeh Goretsky {@infosec.exchange} retweeted
Sekoia's Flowise honeypot caught an attacker stealing credentials and trying to use a decoy AI agent to analyse a Nightingale target in the iGaming sector. sekoia.com/blog/a-honeypots-…
Aryeh Goretsky {@infosec.exchange} retweeted
🚨 Google Meet Phishing
Two domains hosting fake Google Meet pages designed to steal Google credentials and facilitate 2FA phishing.
Misconfiguration: An exposed /install page reveals database configuration and a prefilled DB password!
IOCs:
meet-google[.]cyou
qooglo[.]com
/meet
/install
/assets/js/demo.js
/api/demo/sessions
/api/demo/sessions/{token}
/api/demo/sessions/{token}/resend
#Phishing #Google @500mk500 @skocherhan @Namecheap
Aryeh Goretsky {@infosec.exchange} retweeted
ThreatFabric researchers identified Hirudo, a new Android banking RAT delivered via fake app updates. It replaces eight Indonesian banking apps with patched copies to bypass signature, accessibility, screen-capture and Play integrity checks. threatfabric.com/blogs/hirud…
Aryeh Goretsky {@infosec.exchange} retweeted
A red team tool that packages a Windows PE payload into a .wsl file spoofing a real Linux distro installer github.com/shaheeryasiroffic…
Aryeh Goretsky {@infosec.exchange} retweeted
🚨 Found websites impersonating Google Slides using identical Russian-language templates.
Clicking "Try It" redirects users to app[.]slidy[.]ai instead of Google Slides.
IOCs:
workspacegoogle[.]org[.]ru
workspacegoogle[.]pp[.]ru
workspacegoogle[.]net[.]ru
#Phishing #BrandImpersonation #ThreatIntel #Google @500mk500 @skocherhan @KirkDerpca
Aryeh Goretsky {@infosec.exchange} retweeted
'screen9059163822525044318.jar' @abuse_ch
b9472cc080b4fef1cbc38bad1f1981380a7d71fc74138c7f4c41f18d8e6dacb1
bazaar.abuse.ch/sample/b9472…
Domain: 5kiwqdzvhip5yjx5u6ms2hsv3yozpslxocjhyf4cyimrg33fcb7devid(.)onion
Aryeh Goretsky {@infosec.exchange} retweeted
Clearnet IPs of The Seven Deadly Sins Ransomware group.
185.100.85.146
37.72.140.179
193.24.123.177
@malwrhunterteam @skocherhan
#ThreatIntel #Malware #Ransomware
Aryeh Goretsky {@infosec.exchange} retweeted
Our research team identified a second downloader variant linked to the WebSockets backdoor campaign recently analyzed by @dmpdump.
While the original downloader was written in native C++, this new variant uses C# (.NET 8).
Same seven payload files, same NVIDIA-themed disguise, but a very different implementation: no obfuscation, plaintext strings, and extensive retry logic designed to handle hours of unreliable connectivity.
An interesting detail: it ships as a 14 MB self-contained .NET single-file executable. Open it in IDA and you'll mainly see the native .NET runtime host rather than the actual downloader logic.
We've developed three new YARA detection rules covering both downloader variants and the WebSockets backdoor, and added them to our THOR scanners.
You can explore the rules' matches on VirusTotal through our Valhalla pages:
valhalla.nextron-systems.com…
valhalla.nextron-systems.com…
valhalla.nextron-systems.com…
Full technical analysis, decompiled source and IOCs:
github.com/NextronSystems/io…
