Picture

Matthew Mesa @mesa_matt

Tweets are my own. https://t.co/fpbUvfjlXS… Joined December 2014
  • Tweets
    2K
  • Followers
    5K
  • Following
    107
  • Likes
    266
Matthew Mesa retweeted
virusbtn Profile Picture

Virus Bulletin @virusbtn

10 months ago

Zscaler's Nikolaos Pantazopoulos analyses the functionality of Raspberry Robin (also known as Roshtyak), including its execution layers, obfuscation methods and network communication process, along with its latest exploits. zscaler.com/blogs/security…

Matthew Mesa retweeted
obnoxious4n6 Profile Picture

waymon @obnoxious4n6

12 months ago

aka.ms/ghostjobs

Matthew Mesa retweeted
obnoxious4n6 Profile Picture

waymon @obnoxious4n6

a year ago

I’ll be speaking @SLEUTHCON this year! The lineup is amazing. I can’t wait to learn from everyone. Full list of speakers here: sleuthcon.com/speakers

Matthew Mesa retweeted
node5 Profile Picture

William Metcalf @node5

2 years ago

Join me, @switchingtoguns, @a_de_pasquale, and our team as a Sr. Threat Researcher focusing on phishing detection. Use your skills in pattern-based detection, regex, HTML/HTTP, and current phishing landscape, to combat phishing threats for SAA customers splunk.com/en_us/careers/…

Matthew Mesa retweeted
Myrtus0x0 Profile Picture

Myrtus @Myrtus0x0

2 years ago

Ya Qbot is back, it sucks. But look what happened with Emotet when it came back. Was a half assed attempt at running a botnet which eventually disappeared without any LE. Lets make it so that becomes the case with Qbot as well.

Matthew Mesa retweeted
ffforward Profile Picture

Tommy M (TheAnalyst) @ffforward

2 years ago

Can confirm that we have seen the recent #Qbot #Quakbot #Qakbot activity. PDFs/URLs has been used since at least November 28, but can't confirm what payload it was earlier than December 11. URL example: urlhaus.abuse.ch/url/2741437/ MSI/DLL: bazaar.abuse.ch/browse/tag/teo…

Matthew Mesa retweeted
MsftSecIntel Profile Picture

Microsoft Threat Intelligence @MsftSecIntel

2 years ago

An embedded configuration EPOCH timestamp indicates the payload was generated on December 11. The campaign code was tchk06. Most notably, the delivered Qakbot payload was configured with the previously unseen version 0x500. Observed Qakbot C2: 45[.]138.74.191 65[.]108.218.24

mesa_matt Profile Picture

Matthew Mesa @mesa_matt

2 years ago

Unfortunately, I had to look at their email campaigns again this week.

mesa_matt Profile Picture

Matthew Mesa @mesa_matt

2 years ago

Unfortunately, I had to look at their email campaigns again this week.

Matthew Mesa retweeted
MsftSecIntel Profile Picture

Microsoft Threat Intelligence @MsftSecIntel

2 years ago

Microsoft has identified new Qakbot phishing campaigns following the August 2023 law enforcement disruption operation. The campaign began on December 11, was low in volume, and targeted the hospitality industry. Targets received a PDF from a user masquerading as an IRS employee.

Matthew Mesa retweeted
spfcyberlaw Profile Picture

Sean Farrell @spfcyberlaw

2 years ago

So proud to be a part of this collective effort at Microsoft. Badasses at Microsoft Threat Intelligence supporting significant Digital Crimes Unit legal disruptions. This is just the beginning, so many more targets, so much more we are doing and will do #staytuned

ItsReallyNick Profile Picture

Nick Carr @ItsReallyNick

2 years ago

So proud to be a part of this collective effort at Microsoft. Badasses at Microsoft Threat Intelligence supporting significant Digital Crimes Unit legal disruptions. This is just the beginning, so many more targets, so much more we are doing and will do #staytuned

Matthew Mesa retweeted
JoeHannon52 Profile Picture

Joe Hannon @JoeHannon52

2 years ago

Would you realise if java.exe spawning something dodgy was a 0-day? @0g_omkar and team did, patch your on-prem SysAid instances

MsftSecIntel Profile Picture

Microsoft Threat Intelligence @MsftSecIntel

2 years ago

Would you realise if java.exe spawning something dodgy was a 0-day? @0g_omkar and team did, patch your on-prem SysAid instances

Matthew Mesa retweeted
sysopfb Profile Picture

sysopfb @sysopfb

2 years ago

Coworker of mine on his first solo blog post! #smartapesg medium.com/walmartglobalt…

Matthew Mesa retweeted
H_Miser Profile Picture

Hash Miser @H_Miser

2 years ago

Malware delivered via teams, you should have a look at this. No log, no protection, except if you configure team to only allow trusted orgs to discuss with yours. But you can’t see if it’s already in use because you don’t have logs… truesec.com/hub/blog/darkg…

mesa_matt Profile Picture

Matthew Mesa @mesa_matt

2 years ago

RIP Qbot. After having to look at Qbot email campaigns on a regular basis since ~2017, I don't think I'll miss it.

Matthew Mesa retweeted
malwareforme Profile Picture

Jack @malwareforme

2 years ago

do you HATE miscreants? do you LOVE writing detections, hunting thru INSANE amounts of data, and protecting a LOT of orgs? @Microsoft is hiring Detection Engineering/Threat Hunting roles for email security. work with some of the smartest folks in the game: jobs.careers.microsoft.com/global/en/job/…

Matthew Mesa retweeted
MsftSecIntel Profile Picture

Microsoft Threat Intelligence @MsftSecIntel

2 years ago

Microsoft has identified a phishing campaign conducted by Storm-0978 targeting defense and government entities in Europe and North America. The campaign involved the abuse of CVE-2023-36884 to deliver a payload with similarities to the RomCom backdoor. msft.it/6015g0O8x

Trends for United States

#Overwatch2Sweepstakes
Game Pass
26,9 B posts
Snit
3.489 posts
Halloween
161 B posts
Ubisoft
6.680 posts
Lisa Cook
11,6 B posts
Yom Kippur
26,5 B posts
Qatar
108 B posts
Schumer
515 B posts
Medicaid
121 B posts
Fortnite Crew
3.996 posts
Sean Tucker
Braves
11,9 B posts
Luke Hughes
3.306 posts
Gabriel
74,4 B posts
Shedeur
8.198 posts
Pope
43 B posts
Sanders
18,5 B posts
#GateioTokenOfLove
2.234 posts
#JiminxDior
1,24 Mn posts

You might like

Threat Research Lead @SentinelOne, Advisor with @ValidinLLC
Tom Hegel
@TomHegel
7K Followers
Threat Intel and more. Opinions are my own, unless retweeted. Open DMs.
Bart
@bartblaze
14K Followers
James
@James_inthe_box
22K Followers
A Civil Engineer married with Mrs IDA Pro. Sons are WinDbg and OllyDbg. We live in a VM. We eat bread and malware, APT on Sunday
Antelox
@Antelox
5K Followers
Malware Intelligence
avman
@avman1995
7K Followers
#Independent #Malware #Hunter #CyberSecurity #InfoSec https://t.co/KCFBJcHHcW https://t.co/WODUKncjFy
JAMESWT
@JAMESWT_WT
37K Followers
SpyCloud - Director of Security Research, Cryptolaemus Coordinator, Emotet(Ivan)/QBot(Boris) Destroyer, gold prospector & former sysadmin.
Joe Roosen
@JRoosen
8K Followers
malware researcher, reverse engineer, blogger, conference speaker, programmer, IT security professional
JaromirHorejsi
@JaromirHorejsi
4K Followers
Previous SOC analyst and still wanna-be malware researcher. Manager @HuntressLabs. Stay awesome folks! https://t.co/iZPu82FWX0
Herbie Zimmerman
@HerbieZimmerman
3K Followers
Author of oletools, olefile, ViperMonkey, ExeFilter, Balbuzard. #DFIR, #malware analysis, maldocs, file formats, #Python. @decalage@mastodon.social
Philippe Lagadec
@decalage2
5K Followers
Security Research Analyst. Cyber Security Geek. Bookworm.
Artsiom Holub
@Mesiagh
3K Followers
Site d'entraide informatique. https://t.co/KskKm6r1VJ Aide : https://t.co/IJ9NWx6yTT Facebook : https://t.co/6aspUWnl6t BlueSky : https://t.co/h23ePYdk4m
Malekal's site
@malekal_morte
7K Followers
\_(ʘ_ʘ)_/
@pollo290987
4K Followers
Director of Threat Prevention Labs at @ESET
Jiri Kropac
@jiriatvirlab
3K Followers
it security & cyber guy, research @ https://t.co/M5rsSPPPWy, friendly, swiss | Opinions are my own | also https://t.co/v6cAL269P7
Corsin Camichel 🌻
@cocaman
4K Followers