Based on the SFJ's description, sender information was recovered from a recipient device. Sender details were stored in a hash form, which SFJ cracked using rainbow tables of phone numbers and email addresses.
Oct 6, 2023 • 4 tweets • 1 min read
Looks like @socradar crossed a few lines when writing this report.
socradar.io/the-future-of-…
I also disagree with the conclusion that it was a honeypot. Damn Vulnerable Linux, cyrpto mining, multiple command attempts for the same action. Looks more like a student learning pentesting and mining on the side.
May 25, 2022 • 14 tweets • 6 min read
Righto. Lets talk about this data and how to use it. To start, I'm uploading a zip file of all samples as well to allow downloading in bulk. I'll also share out some more parts of this as we go. So, off we go...
For background, #CobaltStrike is an "adversary simulation tool" (pentesting tools vs malware sometimes are only philosophically different #FightMe). It is widely used for legitimate security testing, pre-ransomware operations and other malicious threat actors.
🧵(2/14)
Dec 7, 2019 • 8 tweets • 4 min read
So reading @DrunkBinary's Tweets tonight reminded me of something important - attribution and taxonomy are intrinsically linked. Attribution is about linking and clustering activity - not necessarily doxing and indictments.
@DrunkBinary A lot of #ThreatIntel shops have staunchly started heavily pushing the "we don't do attribution" line - when what they really mean is "We don't want to come up with another name for this activity"
