Matteo Neri (@nmatte90) profile picture

Malware Analyst - Security Analyst - Developer

Joined May 2011
Photo by Matteo Neri (@nmatte90)Photo by Matteo Neri (@nmatte90)Photo by Matteo Neri (@nmatte90)Photo by Matteo Neri (@nmatte90)Photo by Matteo Neri (@nmatte90)Photo by Matteo Neri (@nmatte90)Photo by Matteo Neri (@nmatte90)Photo by Matteo Neri (@nmatte90)Photo by Matteo Neri (@nmatte90)Photo by Matteo Neri (@nmatte90)
underattack-py: Let's start to use underattack ip reputation and feeds, with command line tool and python module #osint #ipreputation #infosec #community #tool #python #webattacks #ThreatHunting github.com/underattack-today…
12
18
INTEL DROP Two AI-driven offensive-security agents fingerprinted (30+) in the Total Insights Feed, Strix and Cairn, across the US, China, Poland, and Turkey. STRIX 193.111.117.98 strix + pentagi + risknet 103.83.86.254 strix + risknet 23.227.202.3 artex + strix 20.124.33.198 strix + gen-ai:agent-zero CAIRN 8.152.193.50 cairn + ai-relay:sub2api 47.97.206.32 cobaltstrike + cairn 107.172.32.149 pentagi + cairn 117.50.187.123 cyberstrikeai + cairn 195.177.94.233 cairn + risknet 23.95.220.222 cairn + scopesentry 120.46.86.195 cairn + open-dir 49.233.127.206 cairn + open-dir #TotalInsights #ThreatIntel #OffensiveSecurity team-cymru.com/total-insight…
18
3
101
12,310
Yesterday a quasi-judicial body in Italy fined @Cloudflare $17 million for failing to go along with their scheme to censor the Internet. The scheme, which even the EU has called concerning, required us within a mere 30 minutes of notification to fully censor from the Internet any sites a shadowy cabal of European media elites deemed against their interests. No judicial oversight. No due process. No appeal. No transparency. It required us to not just remove customers, but also censor our 1.1.1.1 DNS resolver meaning it risked blacking out any site on the Internet. And it required us not just to censor the content in Italy but globally. In other words, Italy insists a shadowy, European media cabal should be able to dictate what is and is not allowed online. That, of course, is DISGUSTING and even before yesterday’s fine we had multiple legal challenges pending against the underlying scheme. We, of course, will now fight the unjust fine. Not just because it’s wrong for us but because it is wrong for democratic values. In addition, we are considering the following actions: 1) discontinuing the millions of dollars in pro bono cyber security services we are providing the upcoming Milano-Cortina Olympics; 2) discontinuing Cloudflare’s Free cyber security services for any Italy-based users; 3) removing all servers from Italian cities; and 4) terminating all plans to build an Italian Cloudflare office or make any investments in the country. Play stupid games, win stupid prizes. While there are things I would handle differently than the current U.S. administration, I appreciate @JDVance taking a leadership role in recognizing this type of regulation is a fundamental unfair trade issue that also threatens democratic values. And in this case @ElonMusk is right: #FreeSpeech is critical and under attack from an out-of-touch cabal of very disturbed European policy makers. I will be in DC first thing next week to discuss this with U.S. administration officials and I’ll be meeting with the IOC in Lausanne shortly after to outline the risk to the Olympic Games if @Cloudflare withdraws our cyber security protection. In the meantime, we remain happy to discuss this with Italian government officials who, so far, have been unwilling to engage beyond issuing fines. We believe Italy, like all countries, has a right to regulate the content on networks inside its borders. But they must do so following the Rule of Law and principles of Due Process. And Italy certainly has no right to regulate what is and is not allowed on the Internet in the United States, the United Kingdom, Canada, China, Brazil, India or anywhere outside its borders. THIS IS AN IMPORTANT FIGHT AND WE WILL WIN!!!
2,334
6,990
1,354
33,502
9,500,288
Matteo Neri retweeted
Breaking Update on the ByBit Hack 🚨🚨🚨🚨 It has been confirmed that the Lazarus Group compromised Safe{Wallet}’s AWS S3 bucket and injected malicious javascript code that resulted in a $1,400,000,000 loss. If you report this to Safe, you might get a $500 bounty.
35
270
46
1,689
261,508
Matteo Neri retweeted
BREAKING: BYBIT $1 BILLION HACK BOUNTY SOLVED BY ZACHXBT At 19:09 UTC today, @zachxbt submitted definitive proof that this attack on Bybit was performed by the LAZARUS GROUP. His submission included a detailed analysis of test transactions and connected wallets used ahead of the exploit, as well as multiple forensics graphs and timing analyses. The submission has been shared with the Bybit team in support of their investigation. We wish them all the best.
NEW ARKHAM INTEL BOUNTY: BYBIT HACK We’ve created & funded a bounty to help identify the person or organization behind today’s >$1B Bybit hack. Submissions to this bounty will be shared with the Bybit team to support their investigation. Reward: 50K ARKM Bounty: intel.arkm.com/exchange/boun…
1,662
2,718
1,077
14,347
5,715,253
Microsoft Threat Intelligence has observed North Korean state actor Emerald Sleet (also known as Kimsuky and VELVET CHOLLIMA) using a new tactic: tricking targets into running PowerShell as an administrator and then pasting and running code provided by the threat actor.
16
184
33
590
125,763
Matteo Neri retweeted
In case you are a medical institution, it may be worth blocking this in your firewall or if you're using the CMS features, at least search internet traffic logs for the IP 202.114.4[.]119 #iocs
9
65
5
264
36,895
Matteo Neri retweeted
Security Advisory: Ivanti Connect Secure, Policy Secure & ZTA Gateways 1️⃣ CVE-2025-0282 CVSS 9.0 (Critical) ⚠️ Exploited in-the-wild A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution. 2️⃣ CVE-2025-0283 CVSS 7.0 (High) A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges. Shoutout to Mandiant & MSTIC
6
61
9
129
38,398
I found an issue in collaboration with Amnesty and TAG that we have indication may be used ITW, CVE-2024-43047. See docs.qualcomm.com/product/pu… for the details. Hopefully the bug will be patched on Android devices very soon ....
1
16
4
45
11,586
🚨 New #rootkit alert! We've discovered #Snapekit, a sophisticated rootkit targeting Arch Linux (6.10.2-arch1-1 x86_64). It hooks 21 syscalls, hides its payload, and evades detection by dropping in user space while dodging analysis tools & debuggers. Stay vigilant! #ThreatIntel #CyberSecurity #Rootkit #Linux
14
131
31
657
400,189
NEW: Apple's latest operating system, macOS 15 Sequoia, has broken some cybersecurity products and tools. CrowdStrike, for example, has delayed support for Sequoia until Apple fixes the issues. Bugs impact Microsoft Defender for Mac, SentinelOne, etc. techcrunch.com/2024/09/19/ap…
7
55
8
127
106,239
🚨 Fresh (potential) #ScatteredSpider Infra alert! 🚨 New spoofed domains targeting major companies: 🔗 eu-apple[.]center 🔗 applerevoke[.]com 🔗 acwa-internal[.]com 🔗 mcointernal-okta[.]com 🔗 binance-us-okta[.]com 🔗 stargate-okta[.]com 🔗 coinbase-okta[.]com 🔗 consensys-okta[.]com 🔗 livechat-salesforce[.]com ⚠️ IPs: 80.78.24.176, 80.78.24.166 @Apple @BinanceUS @Coinbase @Okta @Consensys @salesforce 🔐 #CyberSecurity #ThreatIntel #CTI
2
19
2
72
7,785
Matteo Neri retweeted
Korean-speaking threat actors are on fire!🔥 Their adoption of 0-days proves once again just how resourceful, skilled, and surprisingly agile they are these days. 🕵️‍♂️ Group: APT-C-60 🏠 Origin: Known as 🇰🇷 💥 0-day: CVE-2024-7262 and CVE-2024-7263 🔗 Ref: welivesecurity.com/en/eset-r… 🕵️‍♂️ Group: APT-Q-12 🏠 Origin: Known as 🇰🇷 💥 0-day: Win Platform Mail Client 🔗 Ref: ti.qianxin.com/blog/articles… 🕵️‍♂️ Group: Citrine Sleet 🏠 Origin: Known as 🇰🇵 💥 0-day: CVE-2024-7971 🔗 Ref: microsoft.com/en-us/security… 🕵️‍♂️ Group: Unknown 🏠 Origin: Not sure 🎯 Target: Orgs in 🇰🇷 💥 0-day: CVE-2024-38178 🔗 Ref: cve.org/CVERecord?id=CVE-202… Big shoutout to all the vendors sharing their amazing findings!
2
39
1
151
20,608
NEW: A data breach at the stalkerware operation mSpy has exposed millions of its customers who bought access to the phone spyware app over the past decade, as well as the Ukrainian company behind it. This is the third time (!) mSpy gets hacked. techcrunch.com/2024/07/11/ms…
2
63
5
99
12,626
Ticket scalpers have reverse-engineered how Ticketmaster generates the revolving barcodes for its tickets. They are now able to generate authentic tickets on their own infrastructure, which removes resale restrictions and lets them sell 404media.co/scalpers-are-wor…
32
822
129
5,472
554,020
Matteo Neri retweeted
The award-winning Qualys Threat Research Unit (TRU) has discovered a critical vulnerability in OpenSSH, designated CVE-2024-6387 and aptly named "regreSSHion." This Remote Code Execution bug grants full root access, posing a significant exploitation risk. blog.qualys.com/vulnerabilit…
24
758
185
1,230
525,653
APT43/Kimsuky (Black Banshee)🇰🇵 /141.11.95.135 /67.217.60.68 /67.217.62.219 /185.141.171.31 /185.203.119.14 /note.iiiii.info /share-defence.uberlingen.com /imagedownload.ignorelist.com /signin-ym.quest /mnlp.quest /oso-usps.com /drives.youramys.com /www.uidlogin.o-r.kr /wilsoncenter.port0.org /drive.wilsoncenter.port0.org /wilsoncenter.0rg.us /drive.wilsoncenter.0rg.us /naververify.p-e.kr /uidlogin.o-r.kr /atlanticcouncil.youramys.com /atlanticacouncil.org.youramys.com H/T @1ZRR4H
7
34
149
26,779
Attenzione alla #PEC di #phishing con oggetto "Abbiamo rilevato vari tentativi di accesso, sei stato tu?" che contiene link di cambio password che impersona sito della banca @intesasanpaolo e arriva da indirizzo PEC @Arubait "[email protected]".
1
11
1
19
1,764