#Remus #Stealer's ETH fallback C2 rotated (2026-10-21 ~18:00 UTC).
Contract 0x999941b74F6bbc921D5174A5b29911562cd2D7CF (eth_call 0xc2fb26a6) now returns:
hxxp://24hocst[.]help:2538/ (159.223.150[.]218)
#RemusStealer #EtherHiding
Our website got a refresh! It’s now easier to explore our threat intelligence feeds, integrations, setup guides, API documentation, and more.
Take a look: precisionsec.com/blog/new-pr…
Our new PrecisionSec website is live!
It’s now easier to explore our threat intelligence feeds, preview detected indicators, find integrations, and access setup guides and API documentation.
See what’s new: precisionsec.com/blog/new-pr…
#ThreatIntelligence #ThreatDetection
Call for Beta Testers
We’re looking for beta testers for our new CTI Maltego Transforms.
If you have a Maltego Professional license and want early access in exchange for feedback, reply here or DM us.
#Maltego #CTI #ThreatIntelligence #DFIR
We’re opening beta access to our new CTI @MaltegoHQ Transforms.
Built to help analysts pivot through high-confidence threat intelligence directly inside Maltego.
If you have a Maltego Professional license and are interested,reply here or DM us.
#ThreatIntelligence #CTI #DFIR
Join me at @BSidesVancouver on May 26 for my workshop "Precision #ThreatHunting: Unveiling Adversary Infrastructure using Free and Open Source Tools," designed to teach participants techniques for discovering and analyzing adversary infrastructure. Only 6 seats left! #OSINT
Interesting interview with the author of #Amadey loader, which is consistently one of the top malware families observed in the wild recently
A few days ago, #Amadey owner and I did a brief interview.
We talk about past, present and future of the infamous #Amadey Loader, one of the biggest products in the MaaS environment. Something worth a read.
Please find it at:
g0njxa.medium.com/approachin…
2
2,053
Excited to present "ChatGPT for Security Analysts" at #BSidesCalgary tomorrow! I will be exploring using AI to streamline #securityanalyst workflows - from #malwareanalysis to #threatintelligence and #threathunting. See you there! #ChatGPT #AI
1
828
Greg Leah retweeted
Don't miss the chance to speak at BSides Vancouver Island! The CFP is closing this week, we want to hear from you. Apply now at bsidesvi.com/callforpapers.h… and get ready to rock the stage!
A few active #RisePro #stealer #c2 panels:
hxxp://194.169.175[.]128:8081/login
hxxp://38.47.220[.]202:8081/login
hxxp://79.110.49[.]141:8081/login
@ViriBack @g0njxa @JAMESWT_MHT @fastfire @ChrisUeland @0xrb
#threathunting #malware
Very low detection on VT with quite a few related samples dating back to 2023-06-10:
virustotal.com/gui/ip-addres…
virustotal.com/gui/ip-addres…
virustotal.com/gui/ip-addres…
3
289
Some additional #IcedID #malware IPs from a related .pdf campaign:
80.77.23[.]154
80.77.23[.]155
80.77.23[.]170
80.77.23[.]176
80.77.23[.]64
91.240.202[.]190
91.240.202[.]195
pdf name: Document_[mm_dd]_[number].pdf
Did some hunting based on this excellent share by @0xperator and was able to find another active #Rhadamanthys #Stealer #c2 panel:
hxxp://185.228.234[.]189:443/admin/console/index.html
cc @ViriBack @0xrb
This Post is from an account that no longer exists. Learn more
Greg Leah retweeted
Interesting shift for #Vidar C2 servers: some communications occur on the port 11111 (why?)
Malware builds still use profiles on Telegram and Steam as Dead Drop Resolver.
Recent C2:
116.203.2.]149:11111
116.203.220.]83:11111
95.217.246.]227
116.203.240.]51
116.203.15.]24
If you are interested in learning more about how you can use #ChatGPT for #cybersecurity investigations, check out my talk "ChatGPT for Security Analysts" at @BSidesVancouver next weekend. Pumped for the legendary Keynote speaker @mikko!
sites.google.com/fourthplane…
A deep dive into Aurora Stealer and some GO reversing KeyPoints.
If you have any comment/feedback please reply with it.
d01a.github.io/aurora-steale…
#malware #infosec #aurorastealer #stealer
2
598
If you are not able to be in Strasbourg this week for @Botconf, you can tune in to the livestream here. Some high quality #malware and #botnet talks on the agenda this year!
#cybersecurity #cybercrime #botnets #reverseengineering #malwareanalysis
youtube.com/live/XPXhnj8nXIs…
Greg Leah retweeted
Interesting change in #Vidar infostealer C2 traffic. Instead as part of the multipart payload, the Id, Token and hwid are now sent as part of the header. Sample: tria.ge/230222-yxyhdsfb6z/be…
I've had a few people ask me recently where is a good place to get started with #MISP threat information sharing platform. If you are looking for a very detailed intro to MISP, I highly recommend this video series from @FIRSTdotOrg:
youtube.com/watch?v=-NuODyh1…
#threatintelligence
