115 Followers
31 Following
13 Posts
Researcher at @teamcymru
| Blogs: @teamcymru_S2
| Ex @mcafee ATR

The call for proposals for #Botconf2026 has been published. You have until January 2nd 2026 to send your submissions

https://www.botconf.eu/call-for-proposals/

Call for proposals – Botconf 2026

Hey :)

Yesterday we published the third blog about our #MoqHao's analysis. We detected at least 1.5 millions victims since the end of 2022, and now every continent is targeted, etc

IOCs (+port pairing 🍷) and TTPs here: https://team-cymru.com/post/moqhao-part-3-recent-global-targeting-trends

@teamcymru_S2

MoqHao Part 3: Recent Global Targeting Trends

Introduction This blog post is part of an ongoing series of analysis on MoqHao (also referred to as Wroba and XLoader), a malware family commonly associated with Roaming Mantis. MoqHao is generally used to target Android users, often via an initial attack vector of phishing SMS messages (smishing). The threat group behind Roaming Mantis are characterized as Chinese-speaking and financially motivated, first public acknowledgement goes back to around 2018. The group has historically targeted count

Team Cymru

Hey :)

I'm pleased to announce I'll present my research on Stark-Industries and friends at @CECyF | Coriin conference in April. The agenda looks pretty neat, hope to see you there: https://conf.cecyf.fr/event/2/timetable/#20230405

🫡🫡

CoRIIN 2023 - Conférence sur la réponse aux incidents et l'investigation numérique 2023

Dans le cadre du FIC 2023, nous vous proposons de nous retrouver le premier jour de cet événement de référence (mercredi 05 avril 2023), pour la neuvième conférence de ce genre en France, dédiée aux techniques de la réponse aux incidents et de l’investigation numérique. Cette journée permettra aux enquêteurs spécialisés, experts judiciaires, chercheurs du monde académique ou industriel, juristes, spécialistes de la réponse aux incidents ou des CERTs de partager et échanger sur les techniques...

Conférences du CECyF (Indico)

After years of attending the @botconf conference, this year, I will present for the first time.
With #JoshNeedsToBeOnMastodon we will discuss our IcedID tracking strategy over the past 24 months, with demonstrations.
Join us for “Bohemian IcedID”:
https://www.botconf.eu/botconf-2023/botconf-2023-list-of-workshops-and-talks/

😎​

Botconf 2023 - List of workshops and talks

Additional talks will be added as soon as they are confirmed. This is the current list as of February 7th 2023. Workshops (11th April) Specific tickets should be purchased in addition to the main conference tickets to attend one of the following workshops: Workshop 1 (5 hours): "One SMALI ste

Botconf 2023
#Botconf2023 The tickets are now officially on sale ! https://www.billetweb.fr/botconf-2023
Tickets : Botconf 2023

Tickets : Botconf 2023 - Billetweb

Hey :)

Earlier, we teased you some infrastructure details related to the pro-Russian hacktivist NoName057(16).
Today we published the full report, with all backend IPs, DDoS infrastructure IP ranges, some Stark-Industries insights,etc.:

https://team-cymru.com/post/a-blog-with-noname

@teamcymru_S2

A Blog with NoName

Further Insight into the Hacktivist Operation Targeting NATO and Affiliated Nations Key Findings NoName057(16) is a pro-Russian hacktivist operator / group, which has claimed responsibility for repeated Distributed Denial of Service (DDoS) attacks against entities in perceived anti-Russian countries since March 2022. NoName057(16) back-end infrastructure is hosted in Russia and likely operated by individual(s) with experience in systems design / maintenance. DDoS attack targeting instructions in

Team Cymru

Very pleased to announce I'll be presenting with #JoshNeedsToBeOnMastodon our recent research on info-stealer families at @BSidesCymru
in February 11 :)

https://team-cymru.com/bsidescymru

@teamcymru_S2

bsidescymru | Team Cymru

Team Cymru

#CoRIIN2023
Pour la 9e année consécutive, le #CECyF a le plaisir d'organiser sa Conférence sur la réponse aux incidents et l'investigation numérique

Dates clé:
- Conférence mercredi 05 avril 2023 à Lille Grand Palais, dans le cadre du FIC
- Appel à contributions ouvert jusqu'au 28 février 2023

Inscriptions:
Elles seront possibles via l'interface du FIC, avec une participation aux frais (étudiants/chercheurs d'emploi = tarif réduit)

https://conf.cecyf.fr/event/2/

CoRIIN 2023 - Conférence sur la réponse aux incidents et l'investigation numérique 2023

Dans le cadre du FIC 2023, nous vous proposons de nous retrouver le premier jour de cet événement de référence (mercredi 05 avril 2023), pour la neuvième conférence de ce genre en France, dédiée aux techniques de la réponse aux incidents et de l’investigation numérique. Cette journée permettra aux enquêteurs spécialisés, experts judiciaires, chercheurs du monde académique ou industriel, juristes, spécialistes de la réponse aux incidents ou des CERTs de partager et échanger sur les techniques...

Conférences du CECyF (Indico)
TEAM CYMRU researchers analyse Vidar stealer's infrastructure and show how its operators and their customers access configs and data. https://www.team-cymru.com/post/darth-vidar-the-dark-side-of-evolving-threat-infrastructure
Darth Vidar: The Dark Side of Evolving Threat Infrastructure

Summary Three key takeaways from our analysis of Vidar infrastructure: Russian VPN gateways are potentially providing anonymity for Vidar operators / customers, making it more challenging for analysts to have a complete overview of this threat. These gateways now appear to be migrating to Tor. Vidar operators appear to be expanding their infrastructure, so analysts need to keep them in their sights. We expect a new wave of customers and as a result, an increase of campaigns in the upcoming weeks

Team Cymru
#Botconf2023 All notifications have been sent out and we will start publishing the programme tomorrow :)