Greg Leah (@powershellcode) profile picture

Hunting #malware and #C2 frameworks.

British Columbia, Canada
Joined January 2018
Photo by Greg Leah (@powershellcode)Photo by Greg Leah (@powershellcode)Photo by Greg Leah (@powershellcode)Photo by Greg Leah (@powershellcode)Photo by Greg Leah (@powershellcode)Photo by Greg Leah (@powershellcode)Photo by Greg Leah (@powershellcode)Photo by Greg Leah (@powershellcode)Photo by Greg Leah (@powershellcode)Photo by Greg Leah (@powershellcode)
#Remus #Stealer's ETH fallback C2 rotated (2026-10-21 ~18:00 UTC). Contract 0x999941b74F6bbc921D5174A5b29911562cd2D7CF (eth_call 0xc2fb26a6) now returns: hxxp://24hocst[.]help:2538/ (159.223.150[.]218) #RemusStealer #EtherHiding
1
3
758
Call for Beta Testers We’re looking for beta testers for our new CTI Maltego Transforms. If you have a Maltego Professional license and want early access in exchange for feedback, reply here or DM us. #Maltego #CTI #ThreatIntelligence #DFIR
We’re opening beta access to our new CTI @MaltegoHQ Transforms. Built to help analysts pivot through high-confidence threat intelligence directly inside Maltego. If you have a Maltego Professional license and are interested,reply here or DM us. #ThreatIntelligence #CTI #DFIR
1
2
2,003
Replying to @threatintel
Also using "DocuSign Shared File"
601
Join me at @BSidesVancouver on May 26 for my workshop "Precision #ThreatHunting: Unveiling Adversary Infrastructure using Free and Open Source Tools," designed to teach participants techniques for discovering and analyzing adversary infrastructure. Only 6 seats left! #OSINT
3
3
4,021
Replying to @sjhilt
Yea man I was saying I literally haven’t seen that in years
1,641
Replying to @NoLogsNoCrime
💯 what a game
1
1,648
Replying to @BCFerries
Update that this is running again would have been appreciated
767
Today is 123123
1
3
7
2,066
Captured a screenshot of a live #panel of the #Ermac 3.0 #Android #bot builder. Some interesting functionality here: ✅ #C2 connection URL ✅ Backend encryption key ✅ Crypt the #apk ✅ Emulator blocking ✅ Custom icon ✅ Build with a clean app #malware
1
2
1,270
Interesting interview with the author of #Amadey loader, which is consistently one of the top malware families observed in the wild recently
A few days ago, #Amadey owner and I did a brief interview. We talk about past, present and future of the infamous #Amadey Loader, one of the biggest products in the MaaS environment. Something worth a read. Please find it at: g0njxa.medium.com/approachin…
2
2,053
Excited to present "ChatGPT for Security Analysts" at #BSidesCalgary tomorrow! I will be exploring using AI to streamline #securityanalyst workflows - from #malwareanalysis to #threatintelligence and #threathunting. See you there! #ChatGPT #AI
1
828
Don't miss the chance to speak at BSides Vancouver Island! The CFP is closing this week, we want to hear from you. Apply now at bsidesvi.com/callforpapers.h… and get ready to rock the stage!
5
5
881
A few active #RisePro #stealer #c2 panels: hxxp://194.169.175[.]128:8081/login hxxp://38.47.220[.]202:8081/login hxxp://79.110.49[.]141:8081/login @ViriBack @g0njxa @JAMESWT_MHT @fastfire @ChrisUeland @0xrb #threathunting #malware
4
4
16
3,915
Some additional #IcedID #malware IPs from a related .pdf campaign: 80.77.23[.]154 80.77.23[.]155 80.77.23[.]170 80.77.23[.]176 80.77.23[.]64 91.240.202[.]190 91.240.202[.]195 pdf name: Document_[mm_dd]_[number].pdf
#IcedID spotted also in #italy 🇮🇹 - campaign ID 2704445589 mail(old conv) > .pdf > url > .zip> .exe 🔥skofilldrom.]com
5
22
4,829
🤚 see you tonight!
1
1
3
376