Greg Leah retweeted
Don't miss the chance to speak at BSides Vancouver Island! The CFP is closing this week, we want to hear from you. Apply now at bsidesvi.com/callforpapers.h… and get ready to rock the stage!
Greg Leah retweeted
Interesting shift for #Vidar C2 servers: some communications occur on the port 11111 (why?)
Malware builds still use profiles on Telegram and Steam as Dead Drop Resolver.
Recent C2:
116.203.2.]149:11111
116.203.220.]83:11111
95.217.246.]227
116.203.240.]51
116.203.15.]24
Greg Leah retweeted
Interesting change in #Vidar infostealer C2 traffic. Instead as part of the multipart payload, the Id, Token and hwid are now sent as part of the header. Sample: tria.ge/230222-yxyhdsfb6z/be…
Greg Leah retweeted
If you've ever wondered what an active SmokeLoader malware campaign looks like, see attached images below
Greg Leah retweeted
The authors of #BumbleBee released a new version of their bot, which includes a new command: “plg” (plug-in?). For now, it has the same functionality as command “dij” (download, inject). We suspect that this malware family is being modularized like #TrickBot. #ESETresearch 1/5
Greg Leah retweeted
Deploying a Protective DNS solution can sharpen your security posture. Learn how in our new case study, featuring @SentinelOne, which highlights how HYAS Protect helped the security leader improve security hygiene and locate gaps. hubs.li/H0Tm7LF0
Greg Leah retweeted
T-24 hrs! Join us tomorrow @ 9 a.m. EDT (15:00 CET/14:00 UK) w/ @JulesDisso (BNP Paribas) & @powershellcode (HYAS) for our live webinar Linking Attacker Infrastructure & Optimizing Threat Intelligence Lessons in Financial Services hubs.li/H0N6F8k0 #DFIR #threatintelligence
Greg Leah retweeted
Join me and @powershellcode in our upcoming webinar on May 27 for a lesson in identifying and countering threat actor groups. @hyasinc #ThreatIntelligence #DFIR
hubs.ly/H0M12q50
Greg Leah retweeted
Want to understand APT33 latest moves and IoCs? Read July #HYAS Threat Research blog highlighting new infrastructure used in #APT33 attacks. Contact us to get IoCs. hyas.com/blog/apt33-during-c… #threatintelligence #cybersecurity.
Greg Leah retweeted
Deep dive into ZLOADER/SILENT NIGHT w/ @Malwarebytes.
⚡️Execution flow and behavior
🪞Comparison with Terdot and ZeuS
🛂C2 traffic and panel
📊Clustering of IoCs based on RC4 keys
Read more about the banking trojan: hyas.com/blog/the-silent-nig…
Greg Leah retweeted
Attend online Advanced Persistent Talks (APTs) on 26 March w HYAS’ Sasha Angus talking #threatintelligence and #attribution. Gain some knowledge & also help raise funds and awareness for Nurses House, non-profit helping registered nurses advancedpersistenttalks.com
Greg Leah retweeted
For you, here's a little bedtime tale..
Aggah: Not Exactly APT
#MalBeacon
link.medium.com/D30FeRsdS3
Greg Leah retweeted
A Nigerian actor behind the Drake themed #AZORult and #Lokibot campaigns, active since at least Nov 2019.
C2:
hxxp://107.175.150[.]73/~giftioz/.cttr/vob.php
Actor's devices: Win10x64 using Chrome and iPhone iOSv12 using Safari.
#MalBeacon
cc @AppRiver
Greg Leah retweeted
We are honored and proud to announce that HYAS has been named a finalist for the Microsoft Security 20/20 Partner Award for the ISV Disruptor category. hubs.ly/H0mkKr20 #cybersecurity
Greg Leah retweeted
Morning Botconf! After a conversation yesterday I have a poll for you! 😉
The question: What's the mobile app that you (would) use for secure communication?
It would be nice that we all contribute so we can know what's the preferred option 😊
RT, please!
@Botconf #botconf2019
6%Whatsapp
18%Telegram
65%Signal
12%Threema
226 votes • Final results Greg Leah retweeted
Thanks to @briankrebs for the @hyasinc shoutout. Always happy to help shine sunlight on services and actors like resnet and Joshua Powder aka "Joshua Hacker Powder", "Phantom_king", and as Brian mentioned, "bulletproofwebhost." hubs.ly/H0kkTzc0
#cybersecurity
