@TuringAlex

Kernel Developer | Security REsearcher | Basketball Fan {Botconf | VirusBulletin | Kaspersky SAS} Speaker Current: @Xlab_qax EX: @360Netlab @Kaspersky AKA 渣兔

blog.xlab.qianxin.com
Joined December 2014
  • Tweets314
  • Following388
  • Followers1.4K
93Media
第一次见BBC上讨论php😂，黑客们的狂欢🙀
6
265
Alex. Turing retweeted
sagitz
@sagitz_Oct 21
Today we disclose PHP2Shell - remotely exploitable memory corruptions in PHP WordPress pre-auth RCE: ✅ Drupal pre-auth RCE: ✅ Joomla pre-auth RCE: ✅ Remote memory disclosure of any PHP application: ✅ Read more ⬇️🧵
66
568
94
3,100
469,638
That’s quite a story‑‑ straight out of a movie.🙀
Łukasz Olejnik
@prywatnikAug 19
Słowacki NBÚ znalazł w fotoradarach drogowych NERO R-ONE mechanizmy zdalnego dostępu i zarządzania, które można traktować jako potencjalny „backdoor”. Ich pełna konfiguracja nie jest dostępna użytkownikowi. Wbudowno nieudokumentowany moduł 3G/4G, który po włożeniu karty SIM umożliwiał zdalną łączność z urządzeniem. Kamera miała 12 rosyjskich numerów telefonu, niewidocznych w panelu administracyjnym, z których mogła przyjmować komendy przez SMS i połączenia.
323
哈哈，路虽远，行则将至，老中nb🎇
Sawyer Merritt
@SawyerMerrittAug 19
Chinese rocket company LandSpace has just successfully landed the first stage of its ZQ-3 rocket for the first time.
1
441
🚨Find an interesting 0 detaction #miner on a hacked website — so far it's only mined one #XMR, but the worker name "arina-a100-2-model-server" suggests an #A100-equipped machine might have been compromised? By the way, who is the "Bl4ckSh33P"?🤔#OSINT Happy hunting 🍷@Xlab_qax
3
568
🚨"self-propagating #miner #worm, blockchain C2 + bootstrap failover." 🤔 Everything is self-explanatory🤣，Is this attacker just lazy or what? Not even obfuscating? #ioc 📸http[:]//104.194.140.150:8080/54ac4810b1d01207/ca06059d5d3d81d2[.]sh 📸 Happy hunting 🍷@Xlab_qax
1
2
23
1,876
🚨The #AryStinger #Botnet is packing massdns, httpx, fscan, ksubdomain, tlsx, and even tcpdump all in one.🤣 The operators are repurposing old routers into a massive recon + #proxy infrastructure. Stockpiling intel and gearing up for something big?🤔 Happy hunting 🍷@Xlab_qax
Xlab@Xlab_qaxJun 17
More Than 4,000 Legacy Routers Compromised by #AryStinger, Turned into Global Attack Proxies for Hackers blog.xlab.qianxin.com/arysti…

More Than 4,000 Legacy Routers Compromised by AryStinger, Turned into Global Attack Proxies for...

Background On May 20, 2026, the Ministry of State Security's WeChat official account published an article "Your internet is slow, and the culprit turns out to be this!", highlighting that outdated...

blog.xlab.qianxin.com
2
4
1,304
🚨Finish a interesting #ClickFix case. Actors were probably thinking, “Why fake a site when I can just hack a real one?”🤣 Still surprised how many big sites delay patching CVE-2026-26980🫨有一句挺应景的中文:"世界就是一个巨大的草台班子"。😅 #GhostCMS Happy hunting 🍷@Xlab_qax
Xlab@Xlab_qaxMay 21
700+ Ghost CMS sites compromised via CVE-2026-26980 (SQLi → Admin API Key theft) and weaponized for ClickFix attacks. Victims include Harvard, Oxford, Auburn and more. Two threat actors now fighting over the same sites. blog.xlab.qianxin.com/ghost-…
1
1
5
1,533
🚨In a span of just 24 hours, #Harvard International Review @HarvardIR hit with code injections from two separate threat actors, both used for #ClickFix attacks.😅 It's absolutely wild. #Harvard #IOC Happy hunting 🍷@Xlab_qax
1
6
935
🚨写写简单的威胁快讯，刷一刷KPI也挺开心😂。 By the way, are there any #Telegram experts who can uncover the real identity of 0xWR?🤔 Happy hunting 🍷@Xlab_qax
Xlab@Xlab_qaxMay 11
A mysterious hacker group known as #Mr_Rot13, which has operated covertly for six years, is exploiting critical cPanel vulnerabilities to deploy backdoor malware. blog.xlab.qianxin.com/mr_rot…
794
#botnet #ioc #c2 👉 xlabslover[.]lol and the console output had us in stitches. 😂 📸"To love or hate, that is the question". 📸 By the way, @Huntio about "The xlab 2 Rivalry" part… hmm, I'm thinking "F-word xlab 2" — may be "F-word xlab too."🤣 Happy hunting 🍷@Xlab_qax
Hunt.io
@HuntioApr 29
🚨 NEW RESEARCH: xlabs_v1 DDoS-for-Hire IoT Botnet Exposed - One Open Directory. An Entire Operation Revealed. hunt.io/blog/xlabs-v1-ddos-f… The operator built a full commercial DDoS-for-hire operation. Tiered pricing, 21 flood variants, competitor-killing routines baked in. Then left the whole toolkit on a public server with no login. Hunt.io AttackCapture tool had it indexed before they noticed. Key findings: - Botnet branded xlabs_v1, operator handle Tadashi, targeting game servers and Minecraft hosts - 21 flood variants including RakNet and OpenVPN-shaped UDP to dodge common filters - TCP/5555 observed open on 4M+ hosts in the past 180 days, any running ADB is a potential target - ChaCha20 encryption broken via known-plaintext, full nonce reuse across all 16 calls - C2, staging, distribution, and Monero cryptojacking all inside one bulletproof /24 in the Netherlands 👉 Full IOCs, MITRE mapping, and HuntSQL queries: hunt.io/blog/xlabs-v1-ddos-f…
7
22
3,530
最近最有意思的故事 #fast16 🫡，真想当面八卦一下他们研究背后的故事😂，感觉大家还是低估了shadowbroker泄漏出来的东西，再研究研究，说不定还有新的发现或新的线索🧐🤔
Tom Hegel@TomHegelApr 23
Fresh research from the team (@vkamluk / @juanandres_gs) - this one goes back quite awhile! fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet sentinelone.com/labs/fast16-…

fast16 | Mystery Shadow Brokers Reference Reveals High-Precision Software Sabotage 5 Years Before...

A previously unknown 2005 cyber sabotage framework patches high-precision calculation software in memory to silently corrupt results.

sentinelone.com
1
16
2,608
🚨#fast16 🫡向大佬们脱帽致敬，这溯源能力太强了！ Lua brings me back to the days of analyzing Project Sauron and Godlua. For the lazy ones out there, I’ve uploaded the decrypted and preliminarily decompiled Lua payloads to VT 18735eebaa648c22d68a3a362d89dc6a. Happy hunting
1
15
66
8,261
🚨#APT41 Just spotted a fresh #Winnti #ELF backdoor f1403192ad7a762c235d670e13b703c3— 0 detections on VT and packed with VMProtect. 📸One of the #C2 "ai.qianxing[.]co" is clearly impersonating our company’s domain. They’re getting bold.🤣#IOC Happy hunting 🍷@Xlab_qax
3
34
4
128
20,447
🚨The iOS exploit kit #Coruna is a fascinating case. With XLAB #PDNS, its DGA C2s are easily exposed—we grabbed four ourselves. Stats show ~4,400+ infected IPs (or researchers) per day. Surprisingly, 98.5% of these IPs are located in China, why?🤔 Happy hunting 🍷@Xlab_qax
1
4
13
2,384
做了一些微小的工作，make the world a better place🫡 Happy hunting 🍷@Xlab_qax
1
9
848
🚨#Botnet In February, an invisible war broke out within #Android TV Boxes between #Bigpanzi and #Kimwolf. Bigpanzi issued the "pm uninstall" command to remove Kimwolf's APK，哈哈，果然同行是冤家😂 Happy hunting 🍷@Xlab_qax
1
8
40
5,689
🚨An interesting #ELF sample da2e396baf23de1881d06dd3377f84a6 on VT, packed by modified upx, appears to be a #PLC program for traffic light control, but why does it contain an embedded XOR code to establish a reverse shell to 173.180.247[.]200🤔? #IOC Happy hunting 🍷@Xlab_qax
2
20
92
7,071
🧨Just back from Spring Festival. 🧨 🚨a investigation into #Funnull : Udev #persistence, AES-CBC chained IV, "Azure Blob C2", malicious #Nginx module(badnginx2s)—all quite uncommon. #IOC And the stealthiest part is MacCMS supply-chain poisoning. Happy hunting 🍷@Xlab_qax
Xlab@Xlab_qaxMar 2
Our new blog. Exposing the Funnull RingH23 Arsenal and MacCMS Supply Chain Attacks blog.xlab.qianxin.com/funnul…

Funnull Resurfaces: Exposing RingH23 Arsenal and MacCMS Supply Chain Attacks

Background Funnull (Funnull Technology Inc.), also known as Fangneng CDN, is a Philippines-registered company that publicly claims to provide CDN services. In reality, it has long operated as a key...

blog.xlab.qianxin.com
3
8
1,776
哈哈，只做了微小的工作🤪#botnet
Xlab@Xlab_qaxJan 7
Here are APNIC's top three posts related to security for 2025. The first one is ours, and we're very honored.😄 blog.apnic.net/2026/01/02/th…
1
5
1,186
Load more