Ankur @kernelm0de

kernelm0de.github.io India Joined November 2017

Tweets

195
Followers

444
Following

471
Likes

3K

Volexity @Volexity

4 weeks ago

.@Volexity has released updates to its #opensource GoResolver project and more! This work was part of a project for one of our #summerinternship students. We are proud to contribute to the open source community + work alongside students in our annual #internship program!

1 8 26 3K 4

Volexity @Volexity

5 months ago

.@Volexity #threatintel: Multiple Russian threat actors are using Signal, WhatsApp & a compromised Ukrainian gov email address to impersonate EU officials. These phishing attacks abuse 1st-party Microsoft Entra apps + OAuth to compromise targets. volexity.com/blog/2025/04/2… #dfir

1 63 203 131K 122

Volexity @Volexity

7 months ago

.@Volexity recently identified multiple Russian threat actors targeting users via #socialengineering + #spearphishing campaigns with Microsoft 365 Device Code authentication (a well-known technique) with alarming success: volexity.com/blog/2025/02/1… #dfir #threatintel #m365security

1 51 100 30K 29

Volexity @Volexity

10 months ago

.@Volexity’s latest blog post describes in detail how a Russian APT used a new attack technique, the “Nearest Neighbor Attack”, to leverage Wi-Fi networks in close proximity to the intended target, while the attacker was halfway around the world. volexity.com/blog/2024/11/2… #dfir

7 178 386 93K 153

Volexity @Volexity

10 months ago

.@Volexity has published a blog post detailing variants of LIGHTSPY & DEEPDATA malware discovered in the summer of 2024, including exploitation of a vulnerability in FortiClient to extract credentials from memory. Read more here: volexity.com/blog/2024/11/1… #dfir #threatintel

0 50 83 12K 21

Paul Rascagnères @r00tbsd

a year ago

We released a blogpost concerning #StromBamboo (aka Evasive Panda). @Volexity was involved in an incident where the attackers compromised an ISP to poison the customers' DNS requests to hijack software updates (using the HTTP protocol): volexity.com/blog/2024/08/0… 1/3

3 33 80 13K 27

Virus Bulletin @virusbtn

a year ago

Volexity's Ankur Saini (@kernelm0de), Paul Rascagneres (@r00tbsd), Steven Adair (@stevenadair) & Thomas Lancaster (@tlansec) show how StormBamboo used DNS poisoning at the internet service provider level to deliver MACMA and POCOSTICK (aka MGBot). volexity.com/blog/2024/08/0…

0 19 44 7K 15

Download Image

RandomAccessMusings @RndmAccssMsngs

a year ago

Spicy Friday blog drop on an ISP compromise leading to DNS poisoning for downstream organisations and compromise via insecure application update methods. Great work as always @tlansec @r00tbsd @kernelm0de @stevenadair

Volexity @Volexity

a year ago

0 68 122 48K 33

1 4 12 1K 1

Download Gif

Volexity @Volexity

a year ago

.@Volexity shares #threatintel on how #StormBamboo compromised an ISP to conduct DNS poisoning attacks on targeted organizations & abuse insecure HTTP software updates, delivering custom malware on both macOS + Windows. Read the full analysis: volexity.com/blog/2024/08/0… #dfir

0 68 122 48K 33

Ankur @kernelm0de

a year ago

0 4 15 1K 1

Download Image

Volexity @Volexity

a year ago

.@Volexity analyzes #DISGOMOJI 🔥, Discord-based malware 💀 using emojis for C2. #DISGOMOJI is used by #UTA0137, a suspected Pakistan-based threat actor. Read the full analysis here: volexity.com/blog/2024/06/1… #dfir #threatintel

0 79 231 138K 73

Volexity @Volexity

a year ago

Our latest blog post details @Volexity's identification & incident response associated with the Palo Alto Networks GlobalProtect #0day vuln, assigned CVE-2024-3400, that the team found being exploited in the wild. Read more here: volexity.com/blog/2024/04/1… #DFIR #ThreatIntel

2 91 187 147K 53

Steven Adair @stevenadair

a year ago

Our team at @Volexity has identified a new 0day exploited in the wild. This time we caught a threat actor using an unauthenticated RCE in Palo Alto Networks GlobalProtect. It has been assigned CVE-2024-3400 and is covered in this @PaloAltoNtwks advisory security.paloaltonetworks.com/CVE-2024-3400

17 186 387 152K 82

RandomAccessMusings @RndmAccssMsngs

a year ago

security.paloaltonetworks.com/CVE-2024-3400 Casual CVSS 10 exploited in the wild...

0 4 3 2K 0

Volexity @Volexity

2 years ago

.@Volexity consistently observes Iranian #apt group CharmingCypress innovate ways to persistently pursue targets. This blog reviews the group's phishing tactics & malware + investigates an attack with Volexity Volcano: volexity.com/blog/2024/02/1… #dfir #threatintel #memoryforensics

1 46 82 17K 22

tlansec @tlansec

2 years ago

Roses are red, violets are blue... install my VPN, so I can pwn you. volexity.com/blog/2024/02/1…

1 14 46 4K 4

Paul Rascagnères @r00tbsd

2 years ago

If you missed it yesterday, Microsoft released an advisory concerning the CVE-2023-36884: msrc.microsoft.com/update-guide/v…. This RCE is currently used by a TA and there is no patch. You should apply the mitigation described in the advisory. 1/4

4 172 373 81K 91

Download Image

Steven Adair @stevenadair

2 years ago

Here at @Volexity we work with one of the organizations that was impacted by the use of forged authentication tokens to access a victim's @Microsoft365 email by a Chinese APT group as described (STORM-0558) by @Microsoft. blogs.microsoft.com/on-the-issues/… #STORM0558 1/7

5 70 167 37K 38

Volexity @Volexity

2 years ago

From the @Volexity #threatintel team: this blog post details #CharmingKitten's POWERSTAR malware, now with an InterPlanetary twist... Read more: volexity.com/blog/2023/06/2… #dfir

0 33 57 24K 11

Volexity @Volexity

2 years ago

The @Volexity #threatintel team takes a look at the #3CX supply chain compromise: the malware delivered, the infrastructure used & the initial set up of the attack. Here's what we know so far: volexity.com/blog/2023/03/3… #dfir