DFIR & AI Security
Malaysia
Joined October 2017
- Tweets1.2K
- Following343
- Followers312
- Likes4.1K
Blue Lobster retweeted
> be Malaysian company
> get invoice
> invoice_name.iso
> 3 files
> "open.exe", libcef.dll, wuaueng_ui.ime.png
> open.exe uses libcef.dll
> Chromium Embedded Framework
> hmmmm
> open.exe just does libcef.dll!cef_execute_process
> isnt even called correctly
> hmmmm
> look inside libcef.dll
> not the same libcef.dll
> libdef.dll!cef_execute_process reads png file
> extracts shellcode out of it
> low detection on VirusTotal
> no notes
> first seen yesterday
i guess we bonking this now
Blue Lobster retweeted
📢 Ransomware Alert: 🇲🇾
Mah Sing Group Bhd (mahsing.com.my), a Malaysia-based real estate company, has reportedly fallen victim to SCARLETTGROUP ransomware.
NB: The group intends to publish the data within 4–5 days.
🔍 Key Details:
🛡️ Threat Actor: SCARLETTGROUP
📅 Reported on: 26/10/26
Blue Lobster retweeted
Silver Fox phishing email targeted Malaysia.
Domain IOCs
homescapestaging[.]com
segertribute[.]com
musicmaxentertain[.]com
celialinde[.]com
samoliveira[.]com
thinnected[.]com
brendaeverson[.]com
ccaselma[.]com
ecomteck[.]com
shengshunxin[.]com
mohammadinuts[.]com
cc @salmanvsf
Blue Lobster retweeted
🚨 Important Security Notice
Commanders,
We've received reports of a suspicious verification page appearing on gfl-store.com.
⚠️ Please DO NOT follow any instructions asking you to open PowerShell, run commands, or install software. These are NOT part of our legitimate security verification process.
We're urgently investigating the issue with our technical team and will share updates as soon as possible.
We're sorry for the concern this has caused, and thank you to everyone who brought this to our attention.
Stay safe, Commanders. 🛠️
— IOP Gear Division
Blue Lobster retweeted
1/ EZ Tools 2026.10 is out, all on .NET 10 (LTS)
✅ More accurate: 331K more event log records, hive logs replayed as Windows does, every test hive loads
⚡ Faster: up to 9x; EvtxECmd and Registry 2x
📉 Less memory: up to 82% less
Update with Get-ZimmermanTools 🧵 #DFIR
Blue Lobster retweeted
Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.”
A significant blast radius.
This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression.
Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.
Blue Lobster retweeted
Imagine how bad a vuln is that MyCERT's X/Twitter woke up from deep slumber since 2019.
MA-1484.102026: MyCERT Advisory - Critical PHP2Shell Vulnerabilities in PHP Allowing Unauthenticated Remote Code Execution
#php2shell
mycert.org.my/portal/details…
Blue Lobster retweeted
Just published our high fidelity scanner for php2shell: github.com/assetnote/php2she…
See our detection logic here: slcyber.io/research/high-fid…
We've taken care in our detection logic and hope it helps defenders. Congrats to @calif_io and @lcfr_hax for the discovery.
Blue Lobster retweeted
A moron has released a POC early for php2shell so here is what you need to do:
If you’re on version prior to 8.2:
Edit php.ini: session.upload_progress.enabled = Off
Then reload php-fpm and restart apache
If you’re on later version:
Update (it’ll be available in a few hours)
In any case, the mitigation for the php.ini should work either way. Not sure if it’ll cover both vulns though so keep an eye on that. I’ll be reporting on follow up activity on windows as a target.
Good luck!
Blue Lobster retweeted
Okay, since the news is already out: an RCE vulnerability in PHP core, CVSS 10.0. Further details are scheduled for release on October 20. Only PHP 8 will receive patches.
Blue Lobster retweeted
HUGE news about the October release of EZTools is coming soon! You wont believe your eyes! #DFIR
Blue Lobster retweeted
I don't have anything against people using AI to reverse engineer malware, but PLEASE go back to the code and VERIFY. AI will confidently tell you a binary has "decrypt functions" or "reads browser credentials from memory" when the imports say otherwise. Always challenge it, ask 100 times if necessary. AI is an assistant for RE but don't rely on it, it's a terrible source of truth.