Tony @tonydoublezero

Engineer | Threat Hunter | Reverser | APT Tracker Italia Joined February 2012

Tweets

371
Followers

500
Following

701
Likes

1K

SentinelOne @SentinelOne

10 months ago

🇨🇳 💻 New from @LabsSentinel: A Chinese threat actor has been targeting large B2B IT service providers in southern Europe to conduct cyberespionage. In new research from @LabsSentinel and @TinextaCyber, we have discovered the first instance of a suspected Chinese APT group…

1 12 20 6K 4

Download Image

Clint Gibler @clintgibler

11 months ago

🛠️ LOLESXi: Living Off The Land ESXi A comprehensive list of binaries/scripts natively available in VMware ESXi that adversaries have utilized in their operations By @blueteam0ps_ and @Wietze lolesxi-project.github.io/LOLESXi/

2 171 625 40K 441

Download Image

Andrea Naspi @andreanaspi

a year ago

#Pryx group actively distributing a Golang RAT against #UAE gov. The backdoor purpose is to download a Tor package to setup a Tor hidden service on the victim that act as a stealthy HTTP listener for backdoor-related activities. Backdoor versions & IoCs discussed in thread 🧵👇

2 4 8 2K 1

Download Image

Andrea Naspi @andreanaspi

2 years ago

As showed by Zscaler, almost one year later, APT29 used same TTPs to distribute a wine-tasting invitation (ring a bell?) to European diplomats by impersonating the Indian ambassador. As usual, the questionnaire link downloads a zipped HTA that starts the infection chain. 3/3

0 1 3 217 1

Download Image

Tony @tonydoublezero

2 years ago

Useful tool to extract #Astaroth #C2 config

microv @MikyRov

2 years ago

Useful tool to extract #Astaroth #C2 config

0 3 10 1K 3

0 0 1 116 0

Andrea Naspi @andreanaspi

2 years ago

#Patchwork #Spyder v3 downloader delivering #Remcos RAT Campaign reference: mp.weixin.qq.com/s?__biz=MzI2MD…

why2try @JVPv5sIM3eFmGyi

2 years ago

#Patchwork #Spyder v3 downloader delivering #Remcos RAT Campaign reference: mp.weixin.qq.com/s?__biz=MzI2MD…

1 1 3 2K 2

0 1 3 295 0

Cluster25 @cluster25_io

2 years ago

🚨@cluster25_io investigated a possible #APT campaign targeting #Russian dissidents. Using different lures, the #attacks aimed at organizations and citizens, leveraging a #reverseshell. Read more on: blog.cluster25.duskrise.com/2024/01/30/rus…

0 16 36 5K 7

Cluster25 @cluster25_io

2 years ago

🚨A seemingly legitimate #LinkedIn profile contacts you via direct message and offers you a job, sending a PDF file. This is the beginning of a bad story that leads to #DUCKTAIL infection. Read more on: blog.cluster25.duskrise.com/2023/10/25/the…

0 10 29 3K 6

Frost @fr0s7_

2 years ago

No no, everything is fine!

50 144 1K 192K 107

Download Image

Cluster25 @cluster25_io

2 years ago

🚨Beware of #BEC #attacks! Here, we are reporting a recent, well-prepared #fraud campaign involving the names of existing non-profit foundations as bait. Read more on: blog.cluster25.duskrise.com/2023/08/25/the… #cybersecurity #scam

0 6 11 1K 1

Cluster25 @cluster25_io

2 years ago

#BlackByte and his #ransomware continue operating all around the world, we dissected the latest version of this famous ransomware. Here the #Ida #Python script we used: github.com/Microv/BlackBy… Here the report: blog.cluster25.duskrise.com/2023/05/22/bac… Hoping this helps the community!

0 5 8 1K 1

Cluster25 @cluster25_io

2 years ago

@cluster25_io has become partner of @dns0eu project! Starting April 27, 2023, Cluster25 started sharing its #APT, #Phishing / #Fraud and #Malware indicators with DNS0 in order to further raise the #security levels of its users. blog.cluster25.duskrise.com/2023/05/02/c25…

0 7 10 962 1

Cluster25 @cluster25_io

2 years ago

The #chemical sector is definitely considered a critical infrastructure with #strategic goals, so it's a very attractive target for #threat actors. Check out our overview about the #cyber #risks of the chemical sector! blog.cluster25.duskrise.com/2023/04/12/cyb…

0 4 6 893 1

Cluster25 @cluster25_io

3 years ago

@cluster25_io joined the @virustotal community! Starting from March 2023, part of our intelligence data will be shared with this amazing community, allowing users to get insights about suspicious IPs, domains, and URLs. Enjoy our public #Intelligence! blog.cluster25.duskrise.com/2023/03/16/c25…

0 7 11 915 0

Andrea Naspi @andreanaspi

3 years ago

#Bitter #APT Initial Access implant (tutorial by #ChatGPT)

0 2 8 700 1

Download Image

Tony @tonydoublezero

3 years ago

Quite fresh #Gamaredon #APT drop-points http://194.180.174[.]158/16.01/separated.rtf http://194.180.174[.]158/16.01_ss/decidedly.rtf http://194.180.174[.]158/16.01_sb/rejoined.rtf http://194.180.174[.]158/16.01/refused.rtf

0 4 6 546 0

Tony @tonydoublezero

3 years ago

https://praditatech[.]com/icard/admin/js/images/hf/shades/html/ #sidecopy #APT

0 2 4 205 0

Cluster25 @cluster25_io

3 years ago

Another year has passed tracking #cybercriminals. This year has been particularly intense from a #cyber point of view also due to the conflict between Russia and Ukraine. We are pleased to share an infographic about the activities conducted by the Cluster25 team in the year 2022.

0 4 5 890 0

Download Image

̇ @r3dbU7z

3 years ago

🚮FYI: #censys #AsyncRAT C2s

1 7 12 2K 3

Download Image

Cluster25 @cluster25_io

3 years ago

The following image reports part of the targets list used by the group's bot. Among the targets of today's attacks there is also the website of the Poland #Sejm.