Pinned Tweet
underattack-py: Let's start to use underattack ip reputation and feeds, with command line tool and python module #osint #ipreputation #infosec #community #tool #python #webattacks #ThreatHunting github.com/underattack-today…
Matteo Neri retweeted
INTEL DROP
Two AI-driven offensive-security agents fingerprinted (30+) in the Total Insights Feed, Strix and Cairn, across the US, China, Poland, and Turkey.
STRIX
193.111.117.98 strix + pentagi + risknet
103.83.86.254 strix + risknet
23.227.202.3 artex + strix
20.124.33.198 strix + gen-ai:agent-zero
CAIRN
8.152.193.50 cairn + ai-relay:sub2api
47.97.206.32 cobaltstrike + cairn
107.172.32.149 pentagi + cairn
117.50.187.123 cyberstrikeai + cairn
195.177.94.233 cairn + risknet
23.95.220.222 cairn + scopesentry
120.46.86.195 cairn + open-dir
49.233.127.206 cairn + open-dir
#TotalInsights #ThreatIntel #OffensiveSecurity
team-cymru.com/total-insight…
Matteo Neri retweeted
Yesterday a quasi-judicial body in Italy fined @Cloudflare $17 million for failing to go along with their scheme to censor the Internet. The scheme, which even the EU has called concerning, required us within a mere 30 minutes of notification to fully censor from the Internet any sites a shadowy cabal of European media elites deemed against their interests. No judicial oversight. No due process. No appeal. No transparency. It required us to not just remove customers, but also censor our 1.1.1.1 DNS resolver meaning it risked blacking out any site on the Internet. And it required us not just to censor the content in Italy but globally. In other words, Italy insists a shadowy, European media cabal should be able to dictate what is and is not allowed online.
That, of course, is DISGUSTING and even before yesterday’s fine we had multiple legal challenges pending against the underlying scheme. We, of course, will now fight the unjust fine. Not just because it’s wrong for us but because it is wrong for democratic values.
In addition, we are considering the following actions: 1) discontinuing the millions of dollars in pro bono cyber security services we are providing the upcoming Milano-Cortina Olympics; 2) discontinuing Cloudflare’s Free cyber security services for any Italy-based users; 3) removing all servers from Italian cities; and 4) terminating all plans to build an Italian Cloudflare office or make any investments in the country.
Play stupid games, win stupid prizes. While there are things I would handle differently than the current U.S. administration, I appreciate @JDVance taking a leadership role in recognizing this type of regulation is a fundamental unfair trade issue that also threatens democratic values. And in this case @ElonMusk is right: #FreeSpeech is critical and under attack from an out-of-touch cabal of very disturbed European policy makers.
I will be in DC first thing next week to discuss this with U.S. administration officials and I’ll be meeting with the IOC in Lausanne shortly after to outline the risk to the Olympic Games if @Cloudflare withdraws our cyber security protection.
In the meantime, we remain happy to discuss this with Italian government officials who, so far, have been unwilling to engage beyond issuing fines. We believe Italy, like all countries, has a right to regulate the content on networks inside its borders. But they must do so following the Rule of Law and principles of Due Process. And Italy certainly has no right to regulate what is and is not allowed on the Internet in the United States, the United Kingdom, Canada, China, Brazil, India or anywhere outside its borders.
THIS IS AN IMPORTANT FIGHT AND WE WILL WIN!!!
Matteo Neri retweeted
Microsoft has discovered post-compromise exploitation of CVE 2025-29824, a zero-day elevation of privilege vulnerability in Windows Common Log File System (CLFS), against a small number of targets. msft.it/6019qIVV9
Matteo Neri retweeted
Breaking Update on the ByBit Hack 🚨🚨🚨🚨
It has been confirmed that the Lazarus Group compromised Safe{Wallet}’s AWS S3 bucket and injected malicious javascript code that resulted in a $1,400,000,000 loss.
If you report this to Safe, you might get a $500 bounty.
Matteo Neri retweeted
BREAKING: BYBIT $1 BILLION HACK BOUNTY SOLVED BY ZACHXBT
At 19:09 UTC today, @zachxbt submitted definitive proof that this attack on Bybit was performed by the LAZARUS GROUP.
His submission included a detailed analysis of test transactions and connected wallets used ahead of the exploit, as well as multiple forensics graphs and timing analyses.
The submission has been shared with the Bybit team in support of their investigation. We wish them all the best.
NEW ARKHAM INTEL BOUNTY: BYBIT HACK
We’ve created & funded a bounty to help identify the person or organization behind today’s >$1B Bybit hack.
Submissions to this bounty will be shared with the Bybit team to support their investigation.
Reward: 50K ARKM
Bounty: intel.arkm.com/exchange/boun…
Matteo Neri retweeted
Microsoft Threat Intelligence has observed North Korean state actor Emerald Sleet (also known as Kimsuky and VELVET CHOLLIMA) using a new tactic: tricking targets into running PowerShell as an administrator and then pasting and running code provided by the threat actor.
Matteo Neri retweeted
Paragon's CEO Idan Nurick told me: “I don’t talk about our customers and activity."
Full story here.
techcrunch.com/2025/02/06/sp…
Matteo Neri retweeted
In case you are a medical institution, it may be worth blocking this in your firewall or if you're using the CMS features, at least search internet traffic logs for the IP 202.114.4[.]119 #iocs
Matteo Neri retweeted
Security Advisory: Ivanti Connect Secure, Policy Secure & ZTA Gateways
1️⃣ CVE-2025-0282
CVSS 9.0 (Critical)
⚠️ Exploited in-the-wild
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
2️⃣ CVE-2025-0283
CVSS 7.0 (High)
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges.
Shoutout to Mandiant & MSTIC
Matteo Neri retweeted
I found an issue in collaboration with Amnesty and TAG that we have indication may be used ITW, CVE-2024-43047. See
docs.qualcomm.com/product/pu…
for the details. Hopefully the bug will be patched on Android devices very soon ....
Matteo Neri retweeted
🚨 New #rootkit alert! We've discovered #Snapekit, a sophisticated rootkit targeting Arch Linux (6.10.2-arch1-1 x86_64). It hooks 21 syscalls, hides its payload, and evades detection by dropping in user space while dodging analysis tools & debuggers. Stay vigilant! #ThreatIntel #CyberSecurity #Rootkit #Linux
Matteo Neri retweeted
NEW: Apple's latest operating system, macOS 15 Sequoia, has broken some cybersecurity products and tools.
CrowdStrike, for example, has delayed support for Sequoia until Apple fixes the issues. Bugs impact Microsoft Defender for Mac, SentinelOne, etc.
techcrunch.com/2024/09/19/ap…
Matteo Neri retweeted
🚨 Fresh (potential) #ScatteredSpider Infra alert! 🚨
New spoofed domains targeting major companies:
🔗 eu-apple[.]center
🔗 applerevoke[.]com
🔗 acwa-internal[.]com
🔗 mcointernal-okta[.]com
🔗 binance-us-okta[.]com
🔗 stargate-okta[.]com
🔗 coinbase-okta[.]com
🔗 consensys-okta[.]com
🔗 livechat-salesforce[.]com
⚠️ IPs: 80.78.24.176, 80.78.24.166
@Apple @BinanceUS @Coinbase @Okta @Consensys @salesforce 🔐 #CyberSecurity #ThreatIntel #CTI
Matteo Neri retweeted
Korean-speaking threat actors are on fire!🔥 Their adoption of 0-days proves once again just how resourceful, skilled, and surprisingly agile they are these days.
🕵️♂️ Group: APT-C-60
🏠 Origin: Known as 🇰🇷
💥 0-day: CVE-2024-7262 and CVE-2024-7263
🔗 Ref: welivesecurity.com/en/eset-r…
🕵️♂️ Group: APT-Q-12
🏠 Origin: Known as 🇰🇷
💥 0-day: Win Platform Mail Client
🔗 Ref: ti.qianxin.com/blog/articles…
🕵️♂️ Group: Citrine Sleet
🏠 Origin: Known as 🇰🇵
💥 0-day: CVE-2024-7971
🔗 Ref: microsoft.com/en-us/security…
🕵️♂️ Group: Unknown
🏠 Origin: Not sure
🎯 Target: Orgs in 🇰🇷
💥 0-day: CVE-2024-38178
🔗 Ref: cve.org/CVERecord?id=CVE-202…
Big shoutout to all the vendors sharing their amazing findings!
Matteo Neri retweeted
NEW: A data breach at the stalkerware operation mSpy has exposed millions of its customers who bought access to the phone spyware app over the past decade, as well as the Ukrainian company behind it.
This is the third time (!) mSpy gets hacked.
techcrunch.com/2024/07/11/ms…
Matteo Neri retweeted
Ticket scalpers have reverse-engineered how Ticketmaster generates the revolving barcodes for its tickets. They are now able to generate authentic tickets on their own infrastructure, which removes resale restrictions and lets them sell
404media.co/scalpers-are-wor…
Matteo Neri retweeted
The award-winning Qualys Threat Research Unit (TRU) has discovered a critical vulnerability in OpenSSH, designated CVE-2024-6387 and aptly named "regreSSHion." This Remote Code Execution bug grants full root access, posing a significant exploitation risk. blog.qualys.com/vulnerabilit…
Matteo Neri retweeted
APT43/Kimsuky (Black Banshee)🇰🇵
/141.11.95.135
/67.217.60.68
/67.217.62.219
/185.141.171.31
/185.203.119.14
/note.iiiii.info
/share-defence.uberlingen.com
/imagedownload.ignorelist.com
/signin-ym.quest
/mnlp.quest
/oso-usps.com
/drives.youramys.com
/www.uidlogin.o-r.kr
/wilsoncenter.port0.org
/drive.wilsoncenter.port0.org
/wilsoncenter.0rg.us
/drive.wilsoncenter.0rg.us
/naververify.p-e.kr
/uidlogin.o-r.kr
/atlanticcouncil.youramys.com
/atlanticacouncil.org.youramys.com
H/T @1ZRR4H
Matteo Neri retweeted
Ransomware gang target Windows admins via PuTTy, WinSCP malvertising - @LawrenceAbrams
bleepingcomputer.com/news/se…
bleepingcomputer.com/news/se…
Matteo Neri retweeted
Attenzione alla #PEC di #phishing con oggetto "Abbiamo rilevato vari tentativi di accesso, sei stato tu?" che contiene link di cambio password che impersona sito della banca @intesasanpaolo e arriva da indirizzo PEC @Arubait "[email protected]".


































