Tom Hegel Profile picture
Sep 5 9 tweets 6 min read Read on X
Can't help myself.. Taking a look into some of these 32 domains sheds light on a few unmentioned Doppelganger domains still active and personas posting on Twitter. Quick 🧵
lebelligerant[.]io
Twitter Account: @lebelligerant
Image 1 - Homepage.
Image 2 - Translated Main Article.
Image 3 - Fresh tweets.
Note: The webmail subdomain mistakenly uses the 50statesoflie[.]media domain content, which was listed in the Doppelgange raffidavit.

Image
Image
Image
interventionist[.]cc
Twitter Account: @Intrvntnst
Image 1 - Homepage.
Image 2 - Translated Main Article.
Image 3 - Fresh tweets.
Note: Same as above, multiple subdomains. First active around one month ago.

Image
Image
Image
lesifflet[.]cc
Image 1 - Homepage.
Image 2 - Subdomain https.
Note: Interesting content theme, broken subdomain content. No indication its a legitimate (compromised) website.
Image
Image
kaputteampel[.]cc
Twitter: @KaputteAmpel
Image 1 - Homepage.
Image 2 - Featured article content (translated).
Image 3 - Twitter.

Image
Image
Image
derrattenfanger[.]io
Twitter: @Rattenfangernet
Image 1 - Homepage.
Image 2 - Main article (some, translated).
image 3 - Tweets.
Note: Lots of AI images on this one, plus heavy video use.

Image
Image
Image
liesofwallstreet[.]io
Image 1/2 - Socials
Image 3 - Homepage
Note: No Twitter but an Instagram and Pinterest links 🤔

pinterest.co.kr/vondaobeq/_cre…
instagram.com/economic_pulse_


Image
Image
Image
secrettribunal[.]online
Image 1 - Homepage.
Image 2 - Featured US/Ukraine article (translated).
Note: Fits into the Ukraine Domains cluster in the affidavit.
Image
Image
To wrap this up, the most odd..
ukraine-inc[.]com (not the .info listed in affidavit).

Features a multi episode cartoon series, and a 'hit' or 'Catch' @ZelenskyyUa game. 🤦‍♂️

/end of Doppleganger thread.

Image
Image
Image

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Tom Hegel

Tom Hegel Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @TomHegel

Mar 25
I often get asked what tools I use for various aspects of threat research / analysis --

Here's a quick list of my favorites that most are not taking advantage of.. 🧵
1. Aeon Timeline (@AeonTimeline):
▪️ This is my replacement for most Maltigo-style mapping + time-lining chaotic events.
▪️ Everything I investigate starts with one of these to track pivots/clues.
▪️ $65 a year..

More about how I use it here: sentinelone.com/labs/putting-t…
This is outdated as hell, don't @me
2. Validin (@ValidinLLC):
▪️ DNS History, infra pivots, timeline of use, host response searching, OSINT references, etc.
▪️ Quickly developing from great analyst feedback.
▪️ $ Free Community Version!

🔥 An upgraded and affordable passivetotal replacement. Validin Timeline View
Read 6 tweets
Jul 20, 2023
💜 JumpCloud Intrusion | Attacker Infrastructure Links Compromise to North Korean APT Activity

I took a look into the IOCs shared by @JumpCloud and found links to APT Infrastructure we attribute to DPRK.

Quick 🧵..

#threatintelsentinelone.com/labs/jumpcloud…
Look how 144.217.92[.]197 is being used by npmaudit[.]com -- this domain links to @github's recent security alert. Nice!

Based on timing of this, I'm going to assume its related to the JumpCloud intrusion but thats just my outsider perspective here.

github.blog/2023-07-18-sec…
This then leads us further back to a lesser known report from @Phylum_IO's research team. About a month ago they published details on an ongoing NPM campaign.

We can quickly see infrastructure overlaps with the JumpCloud + GitHub findings. 🌶️

blog.phylum.io/author/phylum-…
Read 5 tweets
Mar 22, 2022
Today CERT-UA released two new posts on recent attacks on Ukraine Gov and enterprises.

- UAC-0026 Delivering HeaderTip.
cert.gov.ua/article/38097

- UAC-0088 Attacks with DoubleZero Wiper.
cert.gov.ua/article/38088

Follow along for a quick thread:
🧵1/x
@AeonTimeline 2/x: (threads are hard, sorry)

First lets look at UAC-0026:

Some (including me at first) are associating this with Symantec 2015's post on "Scarab", who was active since 2012.

At the time they were known to target a very small amount of individuals of interest (see map)
@AeonTimeline 3/x:

Here is Symantecs old blog: web.archive.org/web/2015012402…

Unfortunately the IOC file is no longer hosted there. Luckily our friends at AT&T (Alienvault OTX) pulled the IOCs back when that blog was posted: otx.alienvault.com/pulse/54c7e1e8…
Read 20 tweets
Feb 10, 2022
Today we published a new report on the new ModifiedElephant APT, and the years of attacks against groups and individuals in India.

Blog: s1.ai/m-elephant
Full Report: s1.ai/mod-elephant

Quick 🧵 on some highlights:
ME is responsible for targeted attacks on human rights activists, human rights defenders, academics, and lawyers across India with the objective of planting incriminating digital evidence.
Targets and known victims include those involved in the Bhima Koregaon case, in which the evidence presented in the case was planted by the actor prior to arrests.
Read 10 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(