Maximizing IOC Impact: Advice on extracting, verifying, and sharing IOCs for fast, broad protection. netresec.com?b=26653f3

PolarProxy 2.0.1 Released 🐻‍❄️ 💨 Improved performance 🐞 Bug fixes ⚖️ Prioritizes PCAP output over throughput netresec.com?b=266dc11

New release of CapLoader 🫆 JA3/JA4/SNI extraction from multi-segment TLS handshakes 🚨 Alerts on IOCs from Rösti (rosti.​dev) 👀 OSINT lookup on BGP.​Tools/IPinfo/Netify/ScanMalware 📦️ Extracts packets from more encapsulation protocols netresec.com?b=265c041

Tell me ChatGPT writes your articles without telling me ChatGPT writes your articles

PolarProxy 2.0 TLS inspection proxy released 📦️ Single self-contained binary release 🔀 Improved HTTP proxy 🐳 Builds for Linux musl (Alpine) ARM/ARM64 🪄 Simplified deployment netresec.com?b=2658a26

Viewing #remcos alerts from FlowCarp in @unx.ca's #EveBox netresec.com?b=2659fc0

New tool released: FlowCarp 🔍 Identifies protocols without port numbers 🔨 Build protocol detection from example traffic ➡️ Input: PCAP or PcapNG ⬅️ Output: Flows and/or Alerts netresec.com?b=265d268

This "JWT_SESSION" cookie sure looks funky, with base64 encoded data between "metaPrefix" and "metaSuffix"! 🔥 66.234.147.10:8080

✨ DFRWS EU 2026 Workshops Led by Erik Hjelmvik (Netresec, Sweden), the session is designed for practitioners and researchers working with network and memory forensics in real-world investigations. 📍 Workshop Dates 23–24 March 2026 🧿 Details here: buff.ly/oT8OtbE #MemoryForensics #PCAP #TOR

✨DFRWS EU 2026 Workshops All DFRWS #Workshops and Social Events are inclusive in Registration. 👍 📍 Workshop Dates 23–24 March 2026 📍 Hybrid • Linköping, Sweden Explore workshop details 👉 buff.ly/Q45nyji Register 👉 buff.ly/lsQrqiZ #NetworkTrafficAnalysis #MemoryForensics #DFIR #TorAnalysis

🔐 A major phishing-as-a-service platform disrupted. Tycoon2FA enabled large-scale account compromise by bypassing MFA protections. Through Europol’s Cyber Intelligence Extension Programme, industry intelligence was turned into operational results. Read more here: https://ow.ly/GECE50YoZIO

I'm interested in getting in touch with anyone who was involved in the WANK/OILZ worm outbreak at NASA/CERN/DoE in 1989. I've talked to a few folks, but there are still blanks in this story - if you were part of that please ping me.

21 of the world's best intelligence and security agencies cannot be wrong... right? netresec.com?b=26233f4

Do CISA analysts type out IOC domains by hand? netresec.com?b=26233f4

✨ DFRWS EU 2026 Workshops Led by Erik Hjelmvik (Netresec, Sweden), the session is designed for practitioners and researchers working with network and memory forensics in real-world investigations. 📍 Workshop Dates 23–24 March 2026 📍 Details here: 👉 buff.ly/oT8OtbE

Erik Hjelmvik will run a hands-on network forensic workshop at the upcoming Digital Forensics Research Conference in Sweden. Participants will get the chance to analyze: 🔪 Packets carved from memory dumps 🧅 Unencrypted Tor traffic dfrws.org/dfrws-eu-202...

Decoding #njRAT C2 traffic to extract screenshots, commands and transferred files netresec.com?b=262adb9

Some initial thoughts on recent disclosures concerning the December 2025 incident targeting the Polish electric sector - with a focus on #CTI elements such as attribution implications and methodology: pylos.co/2026/01/31/a...

Thank you for those kind words! 💜 www.linkedin.com/pulse/issue-...

The early bird discount, for our live online network forensics class, expires by the end of this week. Sign up if you’d like to analyze PCAP files together with Erik Hjelmvik (creator of NetworkMiner and PolarProxy). netresec.com?b=25A2e4f

DFRWS EU 2026 is seeking posters showcasing interesting digital forensics research for presentation in Linköping, Sweden, 24–27th March 2026. 📥 Submit via EasyChair (PDF) - Rolling notification until the program is full! #DFRWSEU2026 #DFRWS #DigitalForensics

🎬 Video: Decoding malware C2 with #CyberChef netresec.com?b=261f535

Extracting VNC screenshots and keylog data from #Latrodectus 🕷️ BackConnect netresec.com?b=25Cfd08

NetworkMiner 3.1 Released! 🔑 More usernames, passwords and hostnames from #PCAP 💻 Improved user interface 👾 Better details from malware C2 traffic netresec.com?b=25C4039

CN #APT targeting attendees of a diabetes conference in Singapore in December attd.z23.web.core[.]windows[.]net/ATTD-ASIA-2025.zip (live link, careful!) ATTD-ASIA-2025.lnk a12357ff6c0f7b021f32b0c9cd3d01c4 ATTD-ASIA-2025.zip a8082a80cef9ccee9d7a35f5366e3afb gzv.msi 32e7dcbd26b6455974d5b2c52c3ca421 🐴

I love the idea of calculating the decay rate of an IOC. It's not always strictly mathematical, because it also relies on threat actors' choices about how they use the IOCs, but as an estimate and for decision making, this seems promising. Also, I really like @netresec.com's ASCII art Pyramid. 😀

Monitoring for too many old indicators not only costs money, it can even inhibit detection of real intrusions. 📆 Include "last seen" date when publishing IOCs ❌ Prune old IOCs 📜 Prioritize long lived IOCs over short lived ones netresec.com?b=25Be9dd

🚨 The #DFRWSEU 2026 paper submission deadline has been extended to 10th October 2025 🎉 Submit your paper showcasing cutting-edge digital forensics research. 📤 Submit here: buff.ly/BN8Jlnb ℹ️ Conference details: buff.ly/KOw9Xpr #DFRWS #DigitalForensics #CFP

Gh0stKCP is a C2 transport protocol based on KCP. It has been used by malware families such as #PseudoManuscrypt and #ValleyRAT. netresec.com?b=259a5af

Video: Detecting #XenoRAT C2 connections using example traffic from known malware sample. 🔥 e0b465d3bd1ec5e95aee016951d55640 🔥 5ab23ac79ede02166d6f5013d89738f9 📡 Huy1612-24727.portmap[.]io:24727 📡 193.161.193.99:24727 📡 147.185.221.30:54661 netresec.com?b=258f641

How to identify #PureRAT (aka #ResolverRAT): ⛳️ C2 port is often 56001, 56002 or 56003 🔢 Bot sends 04 00 00 00, then TLS handshake 🔑 Client and server run TLS 1.0 🖊️ X.509 cert is self signed 📅 X.509 cert expires 9999-12-31 netresec.com?b=2589522

💧 Dropper connects to legitimate website 📄 Fake PDF is downloaded over HTTPS 💾 Fake PDF is decrypted to a #PureLogs DLL ⚙️ InstallUtil.exe or RegAsm.exe is started 💉 PureLogs DLL is injected into the running process 👾 PureLogs connects to C2 server netresec.com?b=257eead

CapLoader 2.0.1 Released ⚠️ IP lookup alert 🔎 Better protocol identification 🐛 Bug fixes netresec.com?b=2571527

Does anyone know what malware this is? C2 is on 104.16.0.0/13 (CloudFlare). C2 domains: 🔥 event-time-microsoft[.]org 🔥 windows-msgas[.]com 🔥 event-datamicrosoft[.]live 🔥 eventdata-microsoft[.]live PCAP from @malware-traffic-analysis.net infosec.exchange/@netresec/11...

Video: Detecting #PureLogs C2 traffic with #CapLoader netresec.com?b=256a8c4

CapLoader 2.0 released today! 🔎 Identifies over 250 protocols in #PCAP 🎨 Define protocols from example traffic 🇶 Extracts JA3, JA4 and SNI from QUIC 💻 10x faster user interface netresec.com?b=256dbbc

Thank you CISA, @ncsc.gov.uk, @bsi.bund.de et al. for publishing the advisory on Russian GRU Targeting Western Logistics Entities and Technology Companies. This list of mocking services is great for threat hunting! www.cisa.gov/news-events/...

Comparison of tools that extract files from #PCAP 📖 #Chaosreader ⛏️ #NetworkMiner 🐿️ #Suricata 🌊 #tcpflow 🦈 #Wireshark 👁️ #Zeek netresec.com?b=255329f

Did you know that NetworkMiner parses the #njRAT protocol? The following artefacts are extracted from njRAT C2 traffic: 🖥️ Screenshots of victim computer 📁 Transferred files 👾 Commands from C2 server 🤖 Replies from bot 🔑 Stolen credentials/passwords ⌨️ Keylog data netresec.com?b=2541a39

New instructions for installing NetworkMiner on Linux netresec.com?b=2542784

NetworkMiner 3.0 Released! 🔐 QUIC 🏭 CIP (EtherNet/IP) 🏭 UMAS (over Mobdus) 👾 Remcos RAT 🔍 Improved OS fingerprinting 🐧 Better Linux integration netresec.com?b=254caa9

How to set #PCAP as default savefile format in #Wireshark 📝 Edit 📃 Preferences 💡 Advanced ✍️ Change capture.pcap_ng to FALSE netresec.com?b=2523d40

Here's a feature request to have #Wireshark bring back PCAP as the default savefile format instead of pcapng. gitlab.com/wireshark/wi...

PolarProxy 1.0.1 Released 🆔 More #JA4 🔂 Fail-open on #TLS errors ⏩ Better performance netresec.com?b=2523c96

This is an interesting Kerberos relay attack! It leverages LLMNR spoofing/poisoning to trick victims to connect to the attacker's machine and authenticate using Kerberos.

A TLS firewall is similar to a DNS firewall, except it blocks connections to unwanted websites even if the DNS traffic is encrypted. netresec.com?b=2515cf0

We’ve now scheduled our next Network Forensics for Incident Response training 📅 Dates: May 12-15, 2025 🕑 Duration: Four half-days 🌐 Type: Live Online Network Forensics Training 💵 Price: € 960 EUR www.netresec.com?page=Training

APT29 / Midnight Blizzard / Earth Koshchei use RDP relays to gain control of victims’ machines. One RDP config pretends to be for Regeringskansliet (Swedish Gov). Thanks to @feikeh.bsky.social and @sjhilt.hilt.zip‬ for sharing indicators! www.trendmicro.com/en_us/resear... tria.ge/241023-qpfnl...