Greg Leah

#Remus #Stealer's ETH fallback C2 rotated (2026-10-21 ~18:00 UTC). Contract 0x999941b74F6bbc921D5174A5b29911562cd2D7CF (eth_call 0xc2fb26a6) now returns: hxxp://24hocst[.]help:2538/ (159.223.150[.]218) #RemusStealer #EtherHiding

Join me at @BSidesVancouver on May 26 for my workshop "Precision #ThreatHunting: Unveiling Adversary Infrastructure using Free and Open Source Tools," designed to teach participants techniques for discovering and analyzing adversary infrastructure. Only 6 seats left! #OSINT

Captured a screenshot of a live #panel of the #Ermac 3.0 #Android #bot builder. Some interesting functionality here: ✅ #C2 connection URL ✅ Backend encryption key ✅ Crypt the #apk ✅ Emulator blocking ✅ Custom icon ✅ Build with a clean app #malware

Very low detection on VT with quite a few related samples dating back to 2023-06-10: virustotal.com/gui/ip-addres… virustotal.com/gui/ip-addres… virustotal.com/gui/ip-addres…

A few active #RisePro #stealer #c2 panels: hxxp://194.169.175[.]128:8081/login hxxp://38.47.220[.]202:8081/login hxxp://79.110.49[.]141:8081/login @ViriBack @g0njxa @JAMESWT_MHT @fastfire @ChrisUeland @0xrb #threathunting #malware

Some additional #IcedID #malware IPs from a related .pdf campaign: 80.77.23[.]154 80.77.23[.]155 80.77.23[.]170 80.77.23[.]176 80.77.23[.]64 91.240.202[.]190 91.240.202[.]195 pdf name: Document_[mm_dd]_[number].pdf

Did some hunting based on this excellent share by @0xperator and was able to find another active #Rhadamanthys #Stealer #c2 panel: hxxp://185.228.234[.]189:443/admin/console/index.html cc @ViriBack @0xrb

You were correct about the Azorult TTP for turkie[.]ac[.]ug ✔️

What a rabbit hole. Also related: marcapinyo[.]ac[.]ug Resolves to that same IP (91.215.85[.]173), with some interesting .lnk malware from today. Drops #Vidar stealer using mshta.exe - C2: 195.201.251[.]197 Reference: tria.ge/230411-s1p3jadc85

I've had a few people ask me recently where is a good place to get started with #MISP threat information sharing platform. If you are looking for a very detailed intro to MISP, I highly recommend this video series from @FIRSTdotOrg: youtube.com/watch?v=-NuODyh1… #threatintelligence

hxxp://umeed[.]app/zp/hk.exe (89fc9e853ee727056e8b434da32e65b7) is #RemcosRat

#PredatortheThief maldoc using the standard DocuSign lure, downloads payload from: transcot-bg[.]site C2: transcot[.]site/api/gate.get IP: 92.63.192[.]216 Filenames like lyft-19261154.doc Example hash: 97208d047c469467d79e84ff852a1f36 virustotal.com/gui/file/6d37…

@AirCanada Your member site altitude.aircanada.com has been down for Chrome users on OSX for at least a week. Works fine in Safari. Clearing browser cache did not fix.

#Magecart Group 4 – A link with #Cobalt Group? A collaborative blog between @hyasinc and @Malwarebytes hyas.com/news/magecart-group…