Thread by @hatr

In 2019, a mysterious account called @m4lwatch started dumping extremely relevant information on #Sandworm. Shortly thereafter, they mentioned a company: NTC Vulcan. Fast-forward three years and that company is in the spotlights #VulkanFiles
spiegel.de/netzwelt/web/v…

Short thread

Almost every researcher tracking Russian APTs was following @m4lwatch. This screenshot tells you why: m4lwatch is talking about infrastructure related to #Sandworm almost six months before it showed up in an advisory sent out by the NSA (PDF).

media.defense.gov/2020/May/28/20…

(h/t to @jfslowik who alerted us to this piece of information and helped us understand big chunks of the files.) Anyway, m4lwatch started publishing information on "NTC Vulkan". He even posted diagrams on a supposed exploitation framework called "Znatok"

m4lwatch never followed up with relevant information. No hashes/domains, nothing to work with. Many people we spoke with, think this account could've been an intelligence agency, trying to "burn" some Sandworm-related toolsets. Think "ShadowBrokers", who've dumped NSA-toolsets.

When asked if they're running this account, one intelligence agency analyst laughed: "We'd love to take credit", they said. But in their telling, it wasn't them.

In the #Vulkanfiles, we can see references to "Znatok", e.g. somebody installs a virtual machine called "znatok-flat.vdmk". But not much more. So "Znatok" remains a mystery, very much like m4lwatch.

In 2020, I had a brief exchange with him over Twitter. He asked me about this company and whether I knew them. I didn't reply back then.

(We were investigating #APT32 at the time and writing scripts and looking for clues in PassiveDNS-databases.)

When I reached out during this investigation, the account already had gone silent. They stopped tweeting in February 2020.

My DMs are open is all I'm gonna say.

/end

damn, 2022.