457 Followers
1.2K Following
2.2K Posts
🇺🇦 Malware Researcher 🇺🇦
Posts are my own and do not reflect my employer.
mlgethttp://github.com/xorhex/mlget
bloghttps://blog.xorhex.com
twittodonhttps://twittodon.com/share.php?t=xorhex&[email protected]
#ESETresearch is hiring! Passionate about geopolitics, cyberespionage and cyber threat intelligence? We have a new opening for a strategic threat intelligence analyst at our Montréal office. Come join the team!
https://eset.wd3.myworkdayjobs.com/ESET_External/job/Montreal/Analyste-du-renseignement-stratgique-sur-les-menaces---Cyberespionnage---Strategic-Threat-Intelligence-Analyst---Cyberespionage_JR-05715
Analyste du renseignement stratégique sur les menaces – Cyberespionnage / Strategic Threat Intelligence Analyst – Cyberespionage

Résumé du poste / Summary English version follows ------------------------------------------------------------------------------------------------------------------------------- Nous sommes à la recherche d'un.e Analyste du renseignement stratégique sur les menaces axé sur le cyberespionnage pour rejoindre l'un des centres de R&D suivants: Bratislava, Montréal, Prague – tous faisant partie d’ESET Recherche. Description du poste / Job description ESET Recherche ESET Recherche est une équipe de chercheur.euse.s du monde entier qui analysent et ont l'intention de perturber les opérations de cyberespionnage et de cybercriminalité les plus complexes. Nous travaillons en collaboration avec d'autres équipes internes pour améliorer les produits d’ESET et créer des détections de logiciels malveillants résilientes. Notre objectif principal est de comprendre comment les groupes de menaces opèrent pour mieux protéger notre clientèle et perturber les activités malveillantes. Notre équipe produit des rapports privés à la disposition de la clientèle d'ESET Threat Intelligence (https://www.eset.com/ca-fr/entreprises/services/threat-intelligence/). Nous partageons également notre expertise publiquement sur le blogue d'ESET (https://www.welivesecurity.com/fr/a-propos-eset-recherche/) et lors de conférences techniques renommées dans le monde entier, notamment Black Hat, Botconf, CYBERWARCON, RSA et Virus Bulletin. En tant qu'Analyste du renseignement stratégique sur les menaces, vous collaborerez avec des chercheurs.euse.s en logiciels malveillants spécialisé.e.s dans la rétro-ingénierie et le suivi du réseau, enrichirez nos rapports de renseignements stratégiques et informerez nos clients des dernières tendances dans le paysage cyber. Ce rôle n'implique pas la chasse aux menaces ou la recherche technique sur les menaces. Rôle et responsabilités Analyser les tendances et les impacts des opérations de cyberespionnage et de cybersabotage, et évaluer ces opérations d'un point de vue géopolitique. Rédiger des rapports du renseignement stratégique sur les menaces en tirant parti des recherches techniques existantes effectuées par les équipes de recherche en logiciels malveillants d'ESET, de l’OSINT et de votre propre analyse. Enrichir les rapports techniques d’informations sur la motivation des attaquants, la victimologie et le contexte géopolitique plus large pour améliorer le travail de l’équipe de recherche sur les logiciels malveillants. Résumer les données du renseignement, par exemple afin de contribuer à notre rapport d’activité APT semestriel. Intéragir et répondre aux solicitations de la clientèle de nos services de renseignement sur les menaces. Donner des présentations lors de conférences publiques. Déplacements internationaux, jusqu'à 20 % Compétences techniques, connaissances et qualifications 5 ans d'expérience dans le renseignement stratégique sur les cybermenaces ou dans un domaine connexe (géopolitique, etc.). Connaissance approfondie de la géopolitique régionale, en particulier en Asie ou en Europe de l'Est. Connaissance des auteurs de cybermenaces (APT) et du monde du renseignement. Expertise dans l'analyse du renseignement sur les menaces, y compris l'attribution de cyberincidents. Familiarité avec des frameworks tels que MITRE ATT&CK, la Kill Chain ou le diamond model. Solides compétences en rédaction et en expression orale en anglais (la plupart des publications et des engagements d’allocutions se feront en anglais). Capacité de transmettre du contenu technique à des personnes non techniques. Esprit de synthèse et capaciter à résumer des analyses complexes sous la forme de rapports et briefings courts. Connaissance de l’écosystème médiatique et maîtrise de l’évaluation des sources. En retour, nous vous proposons Culture décontractée, amicale et ouverte sans code vestimentaire formel Environnement de travail diversifié et multiculturel Activités d'équipe engageantes et événements de l'entreprise (y compris les consolidations d'équipe et les 5 à 7) Options de modèle de travail hybride Occasions d'assister à divers formations, cours, conférences et rencontres Avantages supplémentaires, tant financiers que non financiers ------------------------------------------------------------------------------------------------------------------------------- We are looking for a Strategic Threat Intelligence Analyst focused on cyberespionage to join one of the following R&D centers: Bratislava, Montreal, Prague - all part of ESET Research. ESET Research ESET Research is a team of researchers all over the world who analyze, and intend to disrupt, the most complex cyberespionage and cybercrime operations. We work in collaboration with other internal teams to improve ESET products and create resilient malware detections. Our primary goal is to understand how threat groups operate to better protect our customers and disrupt malicious activities. Our team produces private reports available to ESET Threat Intelligence customers (https://www.eset.com/int/business/services/threat-intelligence/). We also share our expertise publicly on ESET’s blog (https://www.welivesecurity.com/en/about-eset-research/) and at renowned technical conferences worldwide, including Black Hat, Botconf, CYBERWARCON, RSA, and Virus Bulletin. As a strategic threat intelligence analyst, you will collaborate with malware researchers specializing in reverse-engineering and network tracking, enhance our reporting with strategic-level insights, and brief our customers on the latest trends in the cyber landscape. This role does not involve threat hunting or technical threat research. Duties and responsibilities Analyze cyberespionage/cyber sabotage operations trends and impacts and evaluate these operations from a geopolitical perspective. Write strategic threat intelligence reports by leveraging existing technical research done by ESET malware researchers, OSINT, and your own analysis. Enrich technical reports with information about attackers’ motivation, victimology, and the broader geopolitical context to enhance malware researchers’ work. Summarize intelligence data, for example, by contributing to our bi-annual “APT Activity Report”. Brief customers of our threat intelligence services. Deliver presentations at public conferences. International travel, up to 20% Key technical skills, knowledge and qualifications 5 years of experience in strategic cyber threat intelligence or related field (geopolitics, etc.). In-depth knowledge of regional geopolitics, especially in Asia or Eastern Europe. Familiarity with cyberespionage threat actors (APTs) and the intelligence landscape. Expertise in threat intelligence analysis, including cyber-incident attribution. Familiarity with frameworks such as MITRE ATT&CK, the Kill Chain or the diamond model. Strong English writing and speaking skills (most of the publications and speaking engagements will be delivered in English). Ability to convey technical content to non-technical people. Ability to synthesize information and distill complex analyses into concise reports and briefings. Knowledge of the media ecosystem and strong source‑evaluation skills. In return, we offer you Casual, friendly and open culture with no formal dress code Diverse and multicultural work environment Engaging team activities and company events (including team buildings and after work gatherings) Hybrid work model options Opportunities for attending diverse trainings, courses, conferences, and meetups Additional benefits and perks, both financial and non-financial #LI-MF1 #senior #LI-Hybrid Avantages du poste / Benefits Santé et bien-être Régime d'assurance privée collective Plan d'épargne retraite collectif Programme d'activité physique Supports à vélos intérieurs et programme de partage de vélos Bureau à domicile Jours de congé supplémentaires Horaires de travail flexibles Bureau Rafraîchissements au bureau (fruits, snacks, boissons et café) Petit-déjeuner 5 à 7 / Réunions après le travail Activités de renforcement de l'esprit d'équipe Salon commun (« Living room ») avec PlayStation, ping-pong et baby-foot Activités de Noël Autres Apprentissage LinkedIn/ Udemi Programme de fidélisation (jours de vacances supplémentaires, bonus financier, gâteaux) Recommandation d'un ami Licence ESET gratuite pour les amis et la famille Cadeaux de Noël ________________ Health & well-being Group private insurance plan Group retirement savings plan Physical activity program Interior bike racks and bike sharing program Home office Extra days off Flexible work hours Office Refreshments in office (fruit, snacks, drinks & coffee) Breakfast 5 à 7 / Afterwork get togethers Teambuilding activities Common lounge ("Living room") with PlayStation, ping-pong and foosball tables Christmas activities Other LinkedIn Learning/ Udemi Loyalty program (extra vacation days, financial bonus, cake/cupcakes) Friend referral Christmas gifts Emplacement principal / Primary location Montreal Autres lieux d'implantation / Additional locations Type d'heure / Time type Full time Join ESET Talent Community and we will contact you. This is an option for candidates who haven't found any interesting job opening and would like to send us their CV. ESET® provides cutting-edge digital security to prevent attacks before they happen. By combining the power of AI and human expertise, ESET stays ahead of known and emerging cyberthreats — securing businesses, critical infrastructure, and individuals. Whether it’s endpoint, cloud or mobile protection, our AI-native, cloud-first solutions and services remain highly effective and easy to use. Driven by science, ESET technology includes robust detection and response, ultra-secure encryption, and multifactor authentication. With 24/7 real-time defense and strong local support, we keep users safe and businesses running without interruption. An ever-evolving digital landscape demands a progressive, evidence-based approach to security. ESET is committed to world-class scientific research and powerful threat intelligence, backed by R&D centers and a strong global partner network. ESET's purpose is not only to provides cutting-edge digital security, but also to actively contribute to a more innovative and responsible society in terms of education, science and research. At ESET, diversity, equity, and inclusion (DEI) are integral to our corporate culture. We believe in creating a respectful environment, where everyone feels valued and respected, welcoming applications from individuals of all backgrounds, including race, gender, age, religion, disability, and sexual orientation. Learn more about ESET.

Release nsjail-3.6 · google/nsjail

Added support for embedding the pasta userspace networking binary directly into nsjail (memfd) Improved mount handling so both legacy and new mount APIs more reliably enforce read-only remounts ...

GitHub

APT28 is now exploiting a Zimbra XSS bug patched last November in attacks against Ukrainian government entities:

https://www.seqrite.com/blog/operation-ghostmail-zimbra-xss-russian-apt-ukraine/

Added to CISA KEV this week: https://www.cisa.gov/news-events/alerts/2026/03/18/cisa-adds-one-known-exploited-vulnerability-catalog

Operation GhostMail: Russian APT Exploits Zimbra XSS to Target Ukraine Government

Operation GhostMail uncovers a Russian APT campaign exploiting a Zimbra XSS vulnerability (CVE-2025-66376) to target a Ukrainian government agency via phishing emails and browser-based data exfiltration.

Blogs on Information Technology, Network & Cybersecurity | Seqrite

🔴 A threat isn't much of a threat if it can't reach the right victims. 📦 That's why many modern threat actors rely on cloakers and traffic distribution systems (TDS) to target, route, and hide at scale. In a six‑month joint effort analyzing four months of data with Confiant, we identified 15,500 domains configured to Keitaro instances and actively used in cyber campaigns. Keitaro is a legitimate ad tracker, but it is frequently misused by cybercriminals as an all‑in‑one tracker + TDS + cloaker in scam and malware campaigns. We encounter Keitaro in our investigations nearly every day, and we set out to quantify that abuse in the broader landscape. We're publishing a three‑part series to share what we learned. Part 1 focuses on a subset of actors who leverage AI in their operations, most of whom are tied to investment scams. At the end of the report, you'll find a link to our github repository that contains thousands of related Keitaro iocs.

https://www.infoblox.com/blog/threat-intelligence/inside-keitaro-abuse-a-persistent-stream-of-ai-driven-investment-scams/

#dns #threatintel #threatintelligence #cybercrime #cybersecurity #infosec #infoblox #infobloxthreatintel #scam #ai #keitaro #adtech #tds #trafficdistributionsystem #cloaker #cloaking #landscape #malvertising

🔑New from DTI: Technical breakdown of the TLS private key exposure for Qihoo 360’s "Security Claw" AI Platform.
Read more here: https://dti.domaintools.com/research/exposure-of-tls-private-key-for-myclaw-360-in-qihoo-360-security-claw-ai-platform
#CyberSecurity #ThreatIntel #AI #InfoSec
DomainTools Investigations | Exposure of TLS Private Key for Myclaw 360 in Qihoo 360 “Security Claw” AI Platform

DTI analysis of a leaked TLS private key from Qihoo 360's AI security platform, covering cryptographic validation, threat scenarios, and incident response.

I have no idea when Virus Bulletin uploaded our paper - but here it is: our talk from last September at VB2025, where we talked about an APT41-adjacent group started using Google Calendar C2 as part of their espionage operation.

https://www.virusbulletin.com/uploads/pdf/conference/vb2025/slides/Slides-Google-Calendar-as-C2-Infrastructure-A%20-China-nexus-Campaign-with-Stealthy-Tactics.pdf
https://www.virusbulletin.com/uploads/pdf/conference/vb2025/papers/Google-Calendar-as-C2-infrastructure-a-China-nexus-campaign-with-stealthy-tactics.pdf

Catch Christopher Domas’ keynote from RE//verse 2026! fail: jmp fail (everything I got wrong in RE and security research) gets into the dead ends, bad ideas, and wasted hours behind real progress in RE and security work. Watch now: https://youtu.be/iOq8O_phwbA?si=65EWW3XT8BTww5px

The cloud threat research team at Proofpoint has discovered an account takeover campaign targeting around 40,000 users. Malicious activity has been recorded as early as Feb. 2nd, with a surge on Feb. 10th and a peak on Feb. 12th.

For a large number of users, the attacker initially attempted to login with the correct credentials, although in most cases, conditional access policies and MFA denied access. This suggests the attacker relied, at least in part, on stolen or leaked credentials.

Malicious login attempts correlated to this campaign seem to originate from an outdated Google Chrome browser, namely version 72, initially released in January 2019. Nowadays, this specific user agent is rarely observed in legitimate activity.

Login attempts correlated to this campaign originated from more than 200 distinct domains, most of which are commercial VPN providers and TOR exit nodes.

Moreover, this campaign solely targets the Microsoft Office 365 Portal.

IoCs:

User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36

Application ID: 00000006-0000-0ff1-ce00-000000000000 (Microsoft Office 365 Portal)

New: Group member labels, a way to describe yourself or your role in a group chat, only visible to that group chat.

Label yourself the “Goalie” to your soccer team or “Favorite Child” to your family to stir some drama.

Available on Android, Desktop & iOS
https://signal.org/blog/group-member-labels

Label yourself

We all take on different roles in relation to our friends, neighbors, family members, and colleagues. Keep those different roles clear in your many Signal group chats by using group member labels, now available in the latest versions of Signal for Android, Desktop, and iOS.

Signal Messenger

Taking Apart iOS Apps: Anti-Debugging and Anti-Tampering in the Wild

https://blog.calif.io/p/taking-apart-ios-apps-anti-debugging

#ios #reverseengineering #antidebug

Taking Apart iOS Apps: Anti-Debugging and Anti-Tampering in the Wild

Table Of Contents

Calif