🇺🇦 #NowPlaying on #BBC6Music's #ChrisHawkins

Pebbledash:
🎵 Cartography

#Pebbledash

https://pebbledashband.bandcamp.com/track/cartography

https://open.spotify.com/track/0DcaDx6b5ycTUjIlWrfQmJ

Pebbledash – Asha’s Waltz

Die Band Pebbledash aus Cork hat ihrer aktuellen Tour den Namen Of Seaweed and Sandstone gegeben – ein Titel, der nicht nur schön klingt, sondern auch ziemlich gut beschreibt, worum es ihnen gerade geht. Da, wo Meer auf Fels trifft, entsteht Spannung – genau wie in ihren neuen Songs.

Hier ist die aktuelle und wunderschöne Single Asha’s Waltz.

https://youtu.be/t2FtHoAxtmg?si=lFRVEb4Ptb9LxO66

#Pebbledash

Pebble Dash im Café Herzhäuschen – live am 12.04.2025

Die Themen bleiben aber nicht so leicht und unbekümmert wie „die Bicke“ ist – Klimakrise, Social Justice. Ich sagte ja, Punk, aber mit deutlich mehr Akkorden und dadurch, jetzt lehn ich mich mal ein wenig aus dem Fenster, können auch Menschen, die diese Themen weit von sich rücken, hier hervorragend antizipieren.

Hier kommt der Konzertbericht von @AnneReif
https://vinyl-keks.eu/pebbledash-im-cafe-herzhaeuschen-live-am-12-04-2025/

#Bickendorf #CafeHerzhäuschen #Köln #Pebbledash #ReleaseDay

A common way for malware to disguise its C2 communication and stay under the radar is mimicking widely accepted protocols such as TLS and blend into the existing traffic.

The deep dive below into PebbleDash’s FakeTLS C2 protocol shows how North Korean APTs fake TLS handshakes and use hardcoded RC4 encryption to blend in with legit HTTPS traffic. Sneaky stuff — and a must-read for threat hunters. 🔍💻

https://malwareandstuff.com/reversing-pebbledashs-faketls-c2-protocol/

#malware #infosec #reverseengineering #pebbledash #cybersecurity #windows

Good day everyone!

The wonderful researchers at AhnLab, Inc. Security Intelligence Center (ASEC) publishes their findings on recent attacks they observed coming from the #Kimsuky group. The APT group delivered malicious .LNK files through spear-phishing attacks and these files contained the company's they were targeting names, which would suggested this was a targeted attack. As the attack progressed, the #PebbleDash backdoor and a custom version of #RDPWrapper (which is a software that enabled remote desktop on systems that may not support Windows Native RDP).

Behavior Summary (With MITRE ATT&CK):
Initial Access:
Phishing: Spearphishing Attachment (T1566.001) - Kimsuky delivered their malicious .LNK files through email.

Execution:
Comand and Scripting Interpreter: Powershell (T1059.001) - When the LNK file is executed, a powershell (or mshta.exe) is executed to download and execute addtional payloads from external sources.

Defense Evasion:
System Binary Proxy Execution: Mshta (T1218.005) - When the LNK file is executed it could lead to mshta executed to download and execute addtional payloads from external sources.

Masquerading: Masquerade File Type (T1036.008) - The .LNK files are disguised as a document file with an Office document icon such as PDF, Excel, or Word.

Collection/Credential Access:
Input Capture: Keylogging (T1056.001)
The APT group used a powershell script to perform keylogging and also installs keyloggers in executable file format.

You know the drill! Go check out the article for a lot more technical details! Enjoy and Happy Hunting!

Persistent Threats from the Kimsuky Group Using RDP Wrapper
https://asec.ahnlab.com/en/86098/

Intel 471 Cyborg Security, Now Part of Intel 471 #ThreatIntel #ThreatHunting #ThreatDetection #HappyHunting #readoftheday