mal forsec retweeted
🌟New report out today!🌟
Confluence Exploit Leads to LockBit Ransomware
Analysis & reporting completed by Angelo Violetti, @malforsec, & @teddy_ROxPin
Audio: Available on Spotify, Apple, YouTube and more!
thedfirreport.com/2025/02/24…
mal forsec retweeted
If you have made a name in the industry and are paid to promote or post about a specific product, you must disclose that this is a paid ad!
If you don't, you are actively deceiving your audience!
/rant
mal forsec retweeted
Equinor CTF 2024 is history. Thank you to all the participants and congratulations to the winners 🥳
Open Division
🥇 @RumbleCTF
🥈 @bootplug_ctf
🥉 @mnemonic_sec
Student Division
🥇TH٤ N١٥
🥈SIFI
🥉Datasnok
mal forsec retweeted
Inside the Open Directory of the “You Dun” Threat Group
Analysis & reporting completed by @pcsc0ut & @svch0st.
Audio: Available on Spotify, Apple, YouTube and more!
Report: thedfirreport.com/2024/10/28…
mal forsec retweeted
🚀DFIR Labs CTF🚀
Our next CTF will be December 7 1600 UTC - 2000 UTC.
➡️Only $9.99 to join!
➡️Choose Elastic or Splunk as your SIEM
➡️Join our DFIR Labs CTF Discord Server
➡️Top 3 players win swag!
Register: the-dfir-report-store.myshop…
More info: thedfirreport.com/services/d…
At Cold Incident Response in Oslo today. Nice to be with friends #firsttcoslo
mal forsec retweeted
🌟New report out Monday, September 30th by @angelo_violetti, @0xtornado, & @v3t0_!
🕵️♂️ Follow the trail from an Advanced IP Scanner download to BlackCat ransomware!
📬 Want to be the first to know? Subscribe for updates: thedfirreport.com/subscribe/
mal forsec retweeted
🎉CTF this Saturday!🎉
➡️20+ challenges including bonus challenges
➡️Easy and hard challenges /w hints
➡️Challenges that'll make you pivot
➡️Access to 2 private ransomware cases
➡️100+ participants
🏆CTF winners page: thedfirreport.com/services/d…
⌚️Register: the-dfir-report-store.myshop…
mal forsec retweeted
🧙Want to Become a DFIR Report Analyst?🧙
Here’s your path to joining the team:
1️⃣ Rank in the top 3 in one of the next two CTFs
2️⃣ Write a detailed report on one of the CTF cases
3️⃣ Ace an interview with our analysts
Ready to prove your skills and make an impact? Let’s go!
mal forsec retweeted
I’ve always been a fan of the “Out of the Woods: The Threat Hunting Podcast” hosted by @CyborgSecInc. I particularly love their episodes where they analyze our reports to identify potential threat hunting opportunities and provide detailed explanations of any interesting findings!
Scott and Tom, the hosts of the podcast, are very knowledgeable folks! Give their podcast a listen and you’ll learn a lot! 🙏
Below is the portion of their latest podcast where they break down our latest report - BlackSuit Ransomware! Great breakdown and insightful commentary👏 👏
open.spotify.com/episode/3B3…
Link to our report: thedfirreport.com/2024/08/26…
mal forsec retweeted
Plenty of #DFIR insights were used from this #Blacksuit #ransomware case. It’s fascinating to see how event logs, shellcodes, PCAP, threat intelligence, and other artifacts were combined to capture the full picture of the intrusion @TheDFIRReport
thedfirreport.com/2024/08/26…
mal forsec retweeted
BlackSuit Ransomware
🌟Analysis & reporting completed by @MetallicHack, @yatinwad, & @malforsec.
🎵Audio: Available on Spotify, Apple, YouTube and more!
📚Report: thedfirreport.com/2024/08/26…
mal forsec retweeted
"AS-REP roasting was the first credential access activity performed by the threat actor. This was done with Rubeus on the beachhead host targeting a domain controller."
mal forsec retweeted
🌟New report drops Monday, August 26th by @MetallicHack, @yatinwad, and @malforsec!
🕵️♂️ Follow the trail from Cobalt Strike to BlackSuit ransomware!
📬 Want to be the first to know? Subscribe for updates: thedfirreport.com/subscribe/
mal forsec retweeted
⚠️0-click #RCE in Outlook⚠️
The #CVE-2024-30103 vulnerability leverages a flaw in how Microsoft Outlook handles specific types of email content. An attacker can embed malicious code within the body of an email, which gets executed as soon as the email is opened.
🚨Outlook Zero-Click🚨TLDR; Recommended Steps for Microsoft 365 Admins can be seen in this blog post.
ironscales.com/blog/zero-cli…
The CVE-2024-30103 vulnerability leverages a flaw in how Microsoft Outlook handles specific types of email content.
An attacker can embed malicious code within the body of an email, which gets executed as soon as the email is opened. This can lead to unauthorized access, data breaches, and further network compromise.
mal forsec retweeted
#Gootloader recently changed the library they are hiding their malicious code in. Here is a new #YARA rule to detect it. I currnently do not know which #JavaScript libray (or libraries) they are hiding in. If you know, drop a comment or DM. github.com/GootloaderSites/T…
mal forsec retweeted
ScriptBlock Smuggling is a new technique, developed by @_Hubbl3 & @Cx01N_ that allows that allows for the spoofing of PowerShell security logs & bypasses AMSI without the need for reflection or memory patching. Learn all about in our new blog post!
bc-security.org/scriptblock-…
mal forsec retweeted
Happy Wednesday! Releasing a blog today that explores telemetry options for function (ETW) patching and how that telemetry might be useful to detection engineers.
Let me know what you think!
jsecurity101.medium.com/refi…
















