Adrien B @Int2e_

Malware research and threat intel ex #DFIR responder at @Mandiant Joined June 2014

Tweets

499
Followers

2K
Following

95
Likes

618

Cyber_OSINT @Cyber_O51NT

a month ago

A recent analysis revealed MystRodX, a sophisticated C++ backdoor, employing dual-mode activation and advanced encryption, has been lurking undetected since 2024, posing a significant threat to network security. #MystRodX #CyberSecurity ift.tt/8vtwxFQ

5 17 44 5K 19

Lukasz Olejnik @lukOlejnik

4 months ago

Meta and Russian Yandex engaged in unprecedented internet tracking practices, likely illegal with EU data protection law. Companies designed tracking systems that exploited Android's localhost socket permissions to create covert communication channels between websites and native…

14 253 577 57K 329

Download Image

Ramin Nafisi @MalwareRE

9 months ago

The Microsoft Threat Intelligence Center (MSTIC) is looking for malware reverse engineers and security researchers to join our team! Come join our brilliant, world-class team of malware REs and intelligence researchers: Principal Security Researcher (United States):…

0 39 97 32K 32

Microsoft Threat Intelligence @MsftSecIntel

10 months ago

Based on our findings and those reported by governments and other security vendors, Microsoft Threat Intelligence assesses the Russian nation-state actor we track as Secret Blizzard has used the tools and infrastructure of at least 6 other threat actors during the past 7 years.

4 128 420 49K 115

Microsoft Threat Intelligence @MsftSecIntel

a year ago

Microsoft identified multiple vulnerabilities in the open-source platform OpenVPN, integrated into millions of devices worldwide, which could be exploited to create an attack chain allowing remote code execution (RCE) and local privilege escalation (LPE). msft.it/6014llDIQ

6 199 384 82K 129

mat @matthieu_faou

a year ago

We are looking for a strategic threat intel analyst to join @ESETresearch. Interested in cyber-espionage and geopolitics? Apply! ca.linkedin.com/jobs/view/anal…

3 42 68 9K 17

George Kurtz @George_Kurtz

a year ago

CrowdStrike is actively working with customers impacted by a defect found in a single content update for Windows hosts. Mac and Linux hosts are not impacted. This is not a security incident or cyberattack. The issue has been identified, isolated and a fix has been deployed. We…

4K 6K 21K 10.4M 4K

Victor M. Alvarez @plusvic

a year ago

Welcome to the future of YARA: virustotal.github.io/yara-x/blog/ya…

4 152 327 45K 82

Virus Bulletin @virusbtn

2 years ago

Trend Micro's Christopher So looks into two techniques used by Earth Freybug (a subset of APT41) in the UNAPIMON malware: dynamic-link library hijacking & application programming interface (API) unhooking to prevent child processes from being monitored. trendmicro.com/en_us/research…

3 37 69 7K 25

Download Image

Greg Lesnewich @greglesnewich

2 years ago

#100DaysofYARA Day 07 - another condition only rule this time looking for the HTTPSnoop and PipeSnoop families found by Talos a little avant garde, but both store config info in the .data section, XOR'd with a 1 byte key following the same structure github.com/100DaysofYARA/…

3 14 39 6K 12

Download Image

Thomas Roccia 🤘 @fr0gger_

2 years ago

#100DaysOfYara Day 6: Yara can be used to access specific data at a given position. 👇 This feature is often used to identify Magic Numbers (used to determine the file format) to match your rule against a specific file type, such as a PE (0x4D5A), for example. Today, no…

3 31 97 13K 38

Download Image

Greg Lesnewich @greglesnewich

2 years ago

#100DaysofYARA Day 6 sometimes our pals in TA404/Zinc/Temp.HERMIT/Diamond Sleet reuse export names and add a dubya ("W") to the end of the second name. lets create a loose rule looking for duplicates like that! Examples in the second pic thanks to Ronnie Coleman

3 12 41 6K 10

Download Image

Aleksandar Milenkoski @milenkowski

2 years ago

[1/4] Joined by @vmptrst (@PwC) and @MsftSecIntel, we release attribution information on the Sandman #APT, first revealed at @labscon_io '23. Link 👇 s1.ai/LuaDream

2 24 56 14K 11

Microsoft Threat Intelligence @MsftSecIntel

2 years ago

Microsoft has uncovered a supply chain attack by North Korean threat actor Diamond Sleet (ZINC) involving the modification of an installer file from software maker CyberLink. The payload calls back to attacker infrastructure for instructions. Learn more: msft.it/6013iHoQF

6 216 407 183K 81

Florian Roth ⚡️ @cyb3rops

2 years ago

Teaser: we're working on a new #YARA module to enhance in-memory matching, allowing detection engineers to craft more precise rules. Stay tuned

5 39 190 28K 24

Download Image

Adrien B @Int2e_

2 years ago

A few weeks ago I was honored to speak at @labscon_io . Great people, great talks, great venue. I honestly could not suggest any improvements except something closer to CET timezone!

1 1 26 3K 0

LABScon 2025 @labscon_io

2 years ago

Check this Microsoft x PwC research collab, coming to #LABScon23 labscon.io/speakers/adrie… labscon.io/speakers/bendi…

0 11 23 7K 1

Microsoft Threat Intelligence @MsftSecIntel

2 years ago

Microsoft has identified targeted attacks against the defense sector in Ukraine and Eastern Europe by the threat actor Secret Blizzard (KRYPTON, UAC-0003) leveraging DeliveryCheck, a novel .NET backdoor used to deliver a variety of second stage payloads. msft.it/6019gfoYU

3 143 258 71K 35

CERT-UA @_CERT_UA

2 years ago

CERT-UA in collab w/ @MsftSecIntel investigated UAC-0024 (susp. #Turla) using CAPIBAR & KAZUAR to target UA GOV entities. Details: cert.gov.ua/article/5213167 (UA only)