AprĂšs on se souviendra de certains vainqueurs dans lâart du coupage de cĂąbles internetâŠ
Follow
Félix Aimé
@felixaime
Threat Intelligence stakhanovite at . Burn TAs' codes & infrastructures during breakfast 
. (Former GReAT & )
. (Former GReAT & )France, Poitiers Joined February 2009
FĂ©lix AimĂ©âs Tweets
Ma copine (avocate) « Mais bien sĂ»r »⊠đ
1
Show this thread
Reminder: "Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications."
docs.microsoft.com/en-us/windows/
42
665
2,328
đ§
Quote Tweet
A new #Industroyer2 sample popped on VT virustotal.com/gui/file/d6966
3
Next time it will be « use internal servers to pivot » đ
1
Show this thread
BTW I love the diamon model of « CHERNOVITE », especially the infrastructure. Or the art to say nothing.
1
3
Show this thread
Topics to follow
Sign up to get Tweets about the Topics you follow in your Home timeline.
Carousel
Blah blah blah. Still waiting (real) samples, no FUD for just marketing purpose. The published papers are completely empty regarding real and actionable intel.
Quote Tweet
PIPEDREAM should best be thought of as an ICS attack framework. It has numerous modules and can be modified easily to target different industries/equipment/environments. It is a very flexible framework that takes advantage of native functionality in these environments.
Show this thread
2
1
7
Show this thread
The fact that 12+ years after the last real improvement to BinDiff, people still use it, and it is still good, is among the proudest achievements of my life. That, and everybody please thank the heck out of for keeping BinDiff alive.
Quote Tweet
Even researchers who reversed then patch just assumed MS knew what it was talking about when it said SMB was involved. twitter.com/OphirHarpaz/stâŠ
4
18
163
I don't know what people like about the Incontroller / Chernovite reports
For me as a detection engineer, they contain 0 usable information
They're like "The Chronicles of Narnia" but without a wardrobe
I've never been more annoyed by an ATT&CK technique listing
8
19
95
Show this thread
Here is the sample I refer to: 6ac740ebf98df7217d31cb826a207af6
1
1
6
Show this thread
Looks like #NOBELIUM. They used a variant Trello downloader + unhooking of NTDLL quite recently and it matches our YARA on that.
Quote Tweet
Interesting docx that imitates the document of the Israeli embassy. Contains a js that unpacks the dll.
doc > bfc36f03b9752ca9d49ffb4d259129ad
dll > E031C9984F65A9060EC1E70FBB84746B
@InQuest @IdoNaor1 @James_inthe_box
#ThreatHunting #maldoc
Show this thread
1
16
56
Show this thread
I can't wait... too much time alone in my cave!
Show this thread
We wanted to share IOCs related to an infrastructure cluster that dubbed "Banana Sulfate". Still no attribution regarding the threat actor behind it đ» Download the IOCs below and check your logs đ§
Report: hubs.la/Q017bGRB0 | VT: bit.ly/3NCPFHj
13
27
BG.
Quote Tweet
Dernier jour Ă l'@ANSSI_FR en tant chef de la #CTI. Une extraordinaire aventure dans une administration d'exception qui a su donner sa chance au petit analyste que j'Ă©tais ! Je quitte l'ANSSI fier, mais aussi triste. J'aime cette Ă©quipe que je laisse !
Show this thread
1
2
Transfer your PC clipboard to a nearby mobile device:
xclip -o -s c | qrencode -o - | feh --force-aliasing -ZF -
read image description
ALT
20
255
1,258
Show this thread
I hope that one day Ukrainians will be able to forgive Russians for the war of Putin
2
4
24
US company published a CTI blog post in 2014âcompany was purchasedâthe new parent co was purchasedâblog disappears. The original post was never archived or saved in a public report repo. Where did I find a copy? The original co's never-deleted Korean blog on a public platform
GIF
read image description
ALT
1
1
21
Show this thread
âčïž Latest from our Threat Intelligence team: Spear phishing campaign targets Russian dissidents with Cobalt Strike and (new to us) RAT.
blog.malwarebytes.com/threat-intelli
1
26
49
Quand tu te lĂšves le matin et que t'entends sur France Inter qu'un expert (sic.) a parlĂ© de risque de "dissĂ©mination d'armes cyber" en UkraineđșđŠ, t'as juste envie de vomir ton petit dĂšj.
2
2
18
Show this thread
I just released DLLirant, a tool to automatize the DLL Hijacking researches on a specified binary, this is a first version, not perfect but useful anyway for red teamers #redteam #infosec
github.com/Sh0ckFR/DLLira
3
166
545
Me and the boys finding and replacing "BerserkBear; EnergeticBear; Dragonfly" with "FSB" without violating an NDA.
Quote Tweet
Me and the boys finding and replacing "APT 29" with "SVR" without violating an NDA.
2
9
51
Some re-use of #NOBELIUM EnvyScout HTML to execute Meterpreter?
HTML - 187dccf9b35ff7035b38d2806bc4aafd
EXE (Go!) - 3c04b3b04419d5a22f054318f8f25fbc
8
24
Breaking... breaking... euh...
Quote Tweet
#BREAKING #ESETresearch discovered an ongoing #MustangPanda campaign using new #Korplug variant deployed with elaborate custom loaders. Every stage of the deployment process uses anti-analysis techniques and control-flow obfuscation 1/6
@barberousse_bin
welivesecurity.com/2022/03/23/mus
Show this thread
4
đ„ The extorsion group Lapsus$ that already succeeded in breaching several high profile companies is running riot and sowing confusion.
In this blogpost, our Threat & Detection Research team answers your interrogations by drawing the profile of the group.
1
16
21
Replying to
Cyber security is the only industry in the world where 75% of the industry just writes policy and doesn't have any technical clue. It's like a mechanics garage where 75% of them write the procedure on how to change a tyre but only 25% know how.
3
12
57
LAPSUS$ is the new LulzSec. With OPSEC fails included.
1
4
19
Want to make a difference in the fight against #cybercrime ?
Due to continued growth, we are looking for an Operations Lead and for a DevOps Engineer.
Check the job profiles:
csis.com/operations-lea
csis.com/devops-enginee
#CyberSecurity #Jobs #jobsearch
4
2
Written a quick blog post about abusing Kerberos to locally bypass UAC. Unclear if this technique has been documented before, but at the very least I describe why it works :) tiraniddo.dev/2022/03/bypass
6
221
544
L'agenda est dispo: bit.ly/3KLMpqW! RDV le 7 Avril pour évoquer ensemble des sujets du Lab (Titan M, (Qb)bernetes, carhacking, Polkadot...) & des logiciels Quarkslab (attestation à distance, l'évaluation du niveau de sécurité d'une app & l'analyse de sécurité sur mesure)
8
7
The evolution of memory corruption exploit techniques & mitigations - By Mohamed Hassan
docs.google.com/presentation/d
7
425
1,154
