Threat Research Lead @SentinelOne,
Advisor with @ValidinLLC
Oct 15 • 18 tweets • 4 min read
1/ A pro-Hamas persona is making noise from recent airport “hacks”, including broadcast system defacements in 🇨🇦 Kelowna & 🇺🇸 Harrisburg.
But digging deeper, their actions remain low-impact and opportunistic. Lets take a deeper look..🧵
2/ Their “operations” rely on publicly exposed CMS, display, and PA systems, seemingly no exploits, no malware, just abused public services which may lack proper authentication controls. The targets are selected for visibility and attention, not strategic value.
Sep 5, 2024 • 9 tweets • 6 min read
Can't help myself.. Taking a look into some of these 32 domains sheds light on a few unmentioned Doppelganger domains still active and personas posting on Twitter. Quick 🧵
lebelligerant[.]io
Twitter Account: @lebelligerant
Image 1 - Homepage.
Image 2 - Translated Main Article.
Image 3 - Fresh tweets.
Note: The webmail subdomain mistakenly uses the 50statesoflie[.]media domain content, which was listed in the Doppelgange raffidavit.
Mar 25, 2024 • 6 tweets • 3 min read
I often get asked what tools I use for various aspects of threat research / analysis --
Here's a quick list of my favorites that most are not taking advantage of.. 🧵
1. Aeon Timeline (@AeonTimeline):
▪️ This is my replacement for most Maltigo-style mapping + time-lining chaotic events.
▪️ Everything I investigate starts with one of these to track pivots/clues.
▪️ $65 a year..
💜 JumpCloud Intrusion | Attacker Infrastructure Links Compromise to North Korean APT Activity
I took a look into the IOCs shared by @JumpCloud and found links to APT Infrastructure we attribute to DPRK.
Quick 🧵..
#threatintelsentinelone.com/labs/jumpcloud…
Look how 144.217.92[.]197 is being used by npmaudit[.]com -- this domain links to @github's recent security alert. Nice!
Based on timing of this, I'm going to assume its related to the JumpCloud intrusion but thats just my outsider perspective here.
Quick 🧵 on some highlights:
ME is responsible for targeted attacks on human rights activists, human rights defenders, academics, and lawyers across India with the objective of planting incriminating digital evidence.
