The call for proposals for #Botconf2026 has been published. You have until January 2nd 2026 to send your submissions
| Blogs: @teamcymru_S2
| Ex @mcafee ATR
The call for proposals for #Botconf2026 has been published. You have until January 2nd 2026 to send your submissions
Hey :)
Yesterday we published the third blog about our #MoqHao's analysis. We detected at least 1.5 millions victims since the end of 2022, and now every continent is targeted, etc
IOCs (+port pairing 🍷) and TTPs here: https://team-cymru.com/post/moqhao-part-3-recent-global-targeting-trends
Introduction This blog post is part of an ongoing series of analysis on MoqHao (also referred to as Wroba and XLoader), a malware family commonly associated with Roaming Mantis. MoqHao is generally used to target Android users, often via an initial attack vector of phishing SMS messages (smishing). The threat group behind Roaming Mantis are characterized as Chinese-speaking and financially motivated, first public acknowledgement goes back to around 2018. The group has historically targeted count
Hey :)
I'm pleased to announce I'll present my research on Stark-Industries and friends at @CECyF | Coriin conference in April. The agenda looks pretty neat, hope to see you there: https://conf.cecyf.fr/event/2/timetable/#20230405
🫡🫡
Dans le cadre du FIC 2023, nous vous proposons de nous retrouver le premier jour de cet événement de référence (mercredi 05 avril 2023), pour la neuvième conférence de ce genre en France, dédiée aux techniques de la réponse aux incidents et de l’investigation numérique. Cette journée permettra aux enquêteurs spécialisés, experts judiciaires, chercheurs du monde académique ou industriel, juristes, spécialistes de la réponse aux incidents ou des CERTs de partager et échanger sur les techniques...
After years of attending the @botconf conference, this year, I will present for the first time.
With #JoshNeedsToBeOnMastodon we will discuss our IcedID tracking strategy over the past 24 months, with demonstrations.
Join us for “Bohemian IcedID”:
https://www.botconf.eu/botconf-2023/botconf-2023-list-of-workshops-and-talks/
😎
Additional talks will be added as soon as they are confirmed. This is the current list as of February 7th 2023. Workshops (11th April) Specific tickets should be purchased in addition to the main conference tickets to attend one of the following workshops: Workshop 1 (5 hours): "One SMALI ste
Hey :)
Earlier, we teased you some infrastructure details related to the pro-Russian hacktivist NoName057(16).
Today we published the full report, with all backend IPs, DDoS infrastructure IP ranges, some Stark-Industries insights,etc.:
Further Insight into the Hacktivist Operation Targeting NATO and Affiliated Nations Key Findings NoName057(16) is a pro-Russian hacktivist operator / group, which has claimed responsibility for repeated Distributed Denial of Service (DDoS) attacks against entities in perceived anti-Russian countries since March 2022. NoName057(16) back-end infrastructure is hosted in Russia and likely operated by individual(s) with experience in systems design / maintenance. DDoS attack targeting instructions in
Very pleased to announce I'll be presenting with #JoshNeedsToBeOnMastodon our recent research on info-stealer families at @BSidesCymru
in February 11 :)
#CoRIIN2023
Pour la 9e année consécutive, le #CECyF a le plaisir d'organiser sa Conférence sur la réponse aux incidents et l'investigation numérique
Dates clé:
- Conférence mercredi 05 avril 2023 à Lille Grand Palais, dans le cadre du FIC
- Appel à contributions ouvert jusqu'au 28 février 2023
Inscriptions:
Elles seront possibles via l'interface du FIC, avec une participation aux frais (étudiants/chercheurs d'emploi = tarif réduit)
Dans le cadre du FIC 2023, nous vous proposons de nous retrouver le premier jour de cet événement de référence (mercredi 05 avril 2023), pour la neuvième conférence de ce genre en France, dédiée aux techniques de la réponse aux incidents et de l’investigation numérique. Cette journée permettra aux enquêteurs spécialisés, experts judiciaires, chercheurs du monde académique ou industriel, juristes, spécialistes de la réponse aux incidents ou des CERTs de partager et échanger sur les techniques...
Summary Three key takeaways from our analysis of Vidar infrastructure: Russian VPN gateways are potentially providing anonymity for Vidar operators / customers, making it more challenging for analysts to have a complete overview of this threat. These gateways now appear to be migrating to Tor. Vidar operators appear to be expanding their infrastructure, so analysts need to keep them in their sights. We expect a new wave of customers and as a result, an increase of campaigns in the upcoming weeks