tlansec
@tlansec.bsky.social
📤 829
📥 301
📝 48
Threat Intel
@volexity.com
n stuff. London, UK.
reposted by
tlansec
Volexity
1 day ago
@volexity.com
Volcano Server & Volcano One v26.04.27 adds memory analysis for arm64 Windows, memory-only .NET assemblies, SRUM database, Linux systemd units, history & timers from RAM.
#memoryforensics
#memoryanalysis
#dfir
1
3
2
reposted by
tlansec
Andrew Case
29 days ago
Memory-only malware leaves no trace on the file system and is commonly used by threat actors ranging from criminal organizations to ransomware operators to APT groups. In our Volatility 3 training, students gain deep hands on experience analyzing such threats:
memoryanalysis.net/courses-malw...
0
5
7
reposted by
tlansec
Wesley Shields
about 1 month ago
github.com/VirusTotal/y...
- congrats to all involved! These new features are really great!
loading . . .
Release v1.15.0 · VirusTotal/yara-x
Add full support for WASM. The whole yara-x create now can be built for WASM (#583, #588, #598). New playground at https://virustotal.github.io/yara-x/playground/ (#601). The yr check command now n...
https://github.com/VirusTotal/yara-x/releases/tag/v1.15.0
1
6
1
reposted by
tlansec
evacide
about 1 month ago
High five to everyone who has suffered from anxiety, burnout, and depression without even once stealing 0-days from their employer and selling them to the Russians.
www.zetter-zeroday.com/trenchant-ex...
loading . . .
Trenchant Exec Says He Had Depression, Money Troubles When He Decided to Sell Zero Days to Russian Buyer; Also, New Info Reveals Nature of His Work for Australian Intelligence Agency
Peter Joseph Williams, a former L3 Trenchant executive recently convicted of secretly selling zero-day exploits to a Russian broker, says he was suffering anxiety, burnout, years of depression, and financial difficulties when he decided to steal exploits from his US employer and sell them to the Russian buyer. Williams, who
https://www.zetter-zeroday.com/trenchant-exec-says-he-had-depression-money-troubles-when-he-decided-to-sell-zero-days-to-russian-buyer-also-new-info-reveals-nature-of-his-work-for-australian-intelligence-agency/
7
309
53
reposted by
tlansec
Museum of Twitter
about 1 month ago
8
1822
336
reposted by
tlansec
Joseph Cox
about 2 months ago
The complete and utter failure of the metaverse is a reminder [...] that quite often these oligarchs quite simply cannot relate to real people, don’t know how or why people use their products, and very often have no idea what they’re doing
www.404media.co/rip-metavers...
loading . . .
RIP Metaverse, an $80 Billion Dumpster Fire Nobody Wanted
Who could have possibly predicted this, besides everyone?
https://www.404media.co/rip-metaverse-an-80-billion-dumpster-fire-nobody-wanted/
5
225
75
reposted by
tlansec
PIVOTcon
2 months ago
📣
#PIVOTcon26
Agenda is here 🤟 We are thrilled to announce the lineup for this year's edition! 2⃣ days and 19 talks from leading
#ThreatResearch
experts. The agenda link is in the first comment👇, and the talks and speakers are in the thread.🧵
#CTI
#ThreatIntel
1/15
1
16
11
reposted by
tlansec
Volexity
2 months ago
@volexity.com
recently released GoResolver v1.4, bringing significant updates to our
#opensource
tool for recovering symbol data from obfuscated Go binaries. This release is available on GitHub:
github.com/volexity/GoR...
[1/8]
loading . . .
GitHub - volexity/GoResolver: GoResolver is a Go analysis tool using both Go symbol extraction and Control Flow Graph (CFG) similarity to identify and resolve the function symbols of an obfuscated Go ...
GoResolver is a Go analysis tool using both Go symbol extraction and Control Flow Graph (CFG) similarity to identify and resolve the function symbols of an obfuscated Go binary. - volexity/GoResolver
https://github.com/volexity/GoResolver
1
8
4
reposted by
tlansec
Lorenzo Franceschi-Bicchierai
3 months ago
This is a bad take. You can’t counter far right narratives on a platform that is designed to amplify only those narratives. Politicians should set the example. And journalist should get off of it too.
add a skeleton here at some point
2
53
12
reposted by
tlansec
State of Statecraft Conference
3 months ago
SOS returns to Brussels on October 22, 2026! As the geopolitical landscape rifts, hybrid threats continue to adapt & evolve. We provide a forum for observers of state-aligned sabotage, espionage, and more to share research with an action-oriented community. Stay tuned for more announcements!
0
6
5
reposted by
tlansec
We're just normal men
3 months ago
We’re just normal men
loading . . .
17
2399
921
reposted by
tlansec
thesilence
3 months ago
Reminder that the
#PIVOTcon2026
CFP closes this Friday, February 6. Get those papers in. We want to see you at
@pivotcon.bsky.social
in Malaga! 😎
0
7
5
You say "Security Feature Bypass"... I say.... "Remote Code Execution":
msrc.microsoft.com/update-guide...
loading . . .
Security Update Guide - Microsoft Security Response Center
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21509
3 months ago
1
12
6
reposted by
tlansec
Kamil Bojarski
3 months ago
For folks looking for Notepad++ IoCs,
@rapid7.com
just dropped a write-up.
www.rapid7.com/blog/post/tr...
loading . . .
The Chrysalis Backdoor: A Deep Dive into Lotus Blossom’s toolkit
Rapid7 Labs, together with the Rapid7 MDR team, has uncovered a sophisticated campaign attributed to the Chinese APT group Lotus Blossom.
https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
1
7
5
reposted by
tlansec
StrikeReady Labs
3 months ago
#apt
#unk
via VT BULLETEN_H.doc 7c396677848776f9824ebe408bbba943 1291.doc d47261e52335b516a777da368208ee91 Courses.doc 2f7b4dca1c79e525aef8da537294a6c4 Consultation_Topics_Ukraine(Final).doc 95e59536455a089ced64f5af2539a449 freefoodaid[.]com wellnessmedcare[.]org
0
2
2
reposted by
tlansec
SwiftOnSecurity
3 months ago
I promise you. I absolutely guarantee. You are not ready for what happens when you click this link.
ovu.moe
119
246
83
reposted by
tlansec
Wesley Shields
4 months ago
github.com/VirusTotal/y...
- 1.11.0 is out! Lots of new features, modules and bug fixes. Read the release notes and congrats to Victor and the contributors!
loading . . .
Release v1.11.0 · VirusTotal/yara-x
Make the parser stricter (#502). Implement dex module (#458). Implement C api console log (#515). Implement permhash for the crx module (#510). Implement the imports() method for the Rules object i...
https://github.com/VirusTotal/yara-x/releases/tag/v1.11.0
0
7
3
reposted by
tlansec
vx-underground (automated mirror)
4 months ago
Microsoft is so fucking stupid. Microsoft renamed Microsoft Office to Microsoft 365 Copilot App I'm not joking
163
2190
1251
reposted by
tlansec
Volexity
4 months ago
Volexity Volcano Server & Volcano One v25.12.18 adds 300+ YARA rules, full parsing of Windows prefetch and Linux cron jobs, inline syscall hooking detection, and 5-level page table support. [1/3]
1
1
1
reposted by
tlansec
Drunk Binary
4 months ago
Narrator Voice: And so thousands of infosec people looking for relevance and attention logged into VirusTotal looking for samples uploaded from Venezuela in the last year.
0
11
2
reposted by
tlansec
derek guy
4 months ago
finally, we're living through precedented times
199
18323
2463
reposted by
tlansec
Catalin Cimpanu
5 months ago
Some phishers have taken inspiration from Russian cyber-espionage group UTA0355 and are using a technique that tricks users into sharing their OAuth material in a web page (UAT0355 did it via email replies)
pushsecurity.com/blog/consent...
0
11
1
reposted by
tlansec
Mark Kelly
5 months ago
A study in the evolution of SVR cyberespionage tradecraft
0
22
5
reposted by
tlansec
Volexity
5 months ago
@volexity.com
tracks a variety of threat actors abusing Device Code & OAuth authentication workflows to phish credentials, which continue to see success due to creative social engineering. Our latest blog post details Russian threat actor UTA0355’s campaigns impersonating European security events.
loading . . .
Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks
In early 2025, Volexity published two blog posts detailing a new trend among Russian threat actors targeting organizations through the abuse of Microsoft 365 OAuth and Device Code authentication workf...
https://www.volexity.com/blog/2025/12/04/dangerous-invitations-russian-threat-actor-spoofs-european-security-events-in-targeted-phishing-attacks/
0
10
8
On the plus side, everytime there's a Cloudflare outage 1000s of threat actors around the world have their malware C2 go down for a few hours.
5 months ago
0
11
1
reposted by
tlansec
Ollie Whitehouse
6 months ago
Weekly summary is out..
ctoatncsc.substack.com/p/cto-at-ncs...
loading . . .
CTO at NCSC Summary: week ending November 30th
“A lack of liability for software vendors is among the most pressing issues putting Britain’s economic and national security at risk"
https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-november-4ff
0
3
2
reposted by
tlansec
Łukasz
6 months ago
🎵🎶All I want for Christmas is… electrons 🎶🎵
add a skeleton here at some point
0
3
1
reposted by
tlansec
Wesley Shields
6 months ago
Yara-x 1.10.0 released today! It can now automatically fix some warnings, and some improvements in code generation. This is another great step forward for the project.
github.com/VirusTotal/y...
loading . . .
Release v1.10.0 · VirusTotal/yara-x
New yr fix warnings command (#493). Generate more efficient WASM code for some expressions, reducing the size of compiled rules (5efc214, a865681). Improve the API for traversing the AST in DFS ord...
https://github.com/VirusTotal/yara-x/releases/tag/v1.10.0
0
7
2
reposted by
tlansec
Cynthia Brumfield
6 months ago
Really digging this year’s CYBERWARCON logo
1
9
5
reposted by
tlansec
PIVOTcon
6 months ago
#PIVOTcon26
registration is now OPEN 🤟📷
#ThreatResearch
#ThreatIntel
📷https://pivotcon.org Please read carefully the whole 🧵 for the rules about invite -> registration (1/6)🌐
1
15
13
Enhance your CyberChef experience with GeoCities mode!
6 months ago
0
2
1
reposted by
tlansec
Lorenzo Franceschi-Bicchierai
6 months ago
Remember NFTs? 😂😂😂😂😂😂😂
11
77
15
This is so good. bahahaha:
www.youtube.com/watch?v=dr9M...
loading . . .
Private jets don't pay fuel tax. Now I don't either.
YouTube video by Oli Frost
https://www.youtube.com/watch?v=dr9MH0NuUtg
6 months ago
0
3
0
reposted by
tlansec
Ollie Whitehouse
6 months ago
At
@ncsc.gov.uk
we have just launched the CyberUK tech talks call for papers across three topics - Cyber applications of AI - What works: approaches that reduce cyber harm - The evolving threat
www.cyberuk.uk/2026/call-fo...
loading . . .
Tech Talks - Call for Papers
https://www.cyberuk.uk/2026/call-for-papers
0
5
9
reposted by
tlansec
Greg Otto
6 months ago
my response to this is the loudest OK BRO you've ever heard in your life
add a skeleton here at some point
1
16
2
reposted by
tlansec
Saher
6 months ago
New Iran drop from me tracking an attribution nightmare - UNK_SmudgedSerpent! A little Charming, a little Muddy, and a lot C5. Targeting policy experts with benign conversation starters, health-themed infra, OnlyOffice spoofs, and RMMs. Check out the full story
www.proofpoint.com/us/blog/thre...
loading . . .
Crossed wires: a case study of Iranian espionage and attribution | Proofpoint US
Proofpoint would like to thank Josh Miller for his initial research on UNK_SmudgedSerpent and contribution to this report. Key findings Between June and August 2025,
https://www.proofpoint.com/us/blog/threat-insight/crossed-wires-case-study-iranian-espionage-and-attribution
2
18
12
reposted by
tlansec
CYBERWARCON
6 months ago
Meet our speaker Patrick Whitsell! Patrick has expertise in monitoring and defending against cyber espionage threat actors. His talk, "Cyber(trade)war: Paradigm Shift in Economic Espionage", will cover the shift in PRC state-sponsored cyber espionage. Learn more!
www.cyberwarcon.com
0
4
4
reposted by
tlansec
Alex Lanstein
7 months ago
i heard my kids singing about "APT"s and i was sorely disappointed
www.youtube.com/watch?v=ekr2...
loading . . .
ROSÉ & Bruno Mars - APT. (Official Music Video)
YouTube video by ROSÉ
https://www.youtube.com/watch?v=ekr2nIex040
0
2
1
reposted by
tlansec
Wesley Shields
7 months ago
Thanks to @xorhex for an interesting discussion that is worth sharing here. I knew I read this somewhere but here's a fun thing you can do in YARA-X: 2 of ($a*, $b*, 3 of ($c*)) This is documented but not widely known:
virustotal.github.io/yara-x/docs/...
loading . . .
Differences with YARA
Documents the differences between YARA-X and YARA.
https://virustotal.github.io/yara-x/docs/writing_rules/differences-with-yara/#of-statement-accepts-tuples-of-boolean-expressions
2
5
5
reposted by
tlansec
We're just normal men
7 months ago
We’re just normal men
loading . . .
10
1644
637
reposted by
tlansec
RandomAccessMusings
7 months ago
This was an interesting one to work on! tldr: Chinese aligned actor uses LLM to empower their malware development, target gathering, and phishing operation. Goes wrong and starts randomly including pornographic material and other random files/info.
www.volexity.com/blog/2025/10...
loading . . .
APT Meets GPT: Targeted Operations with Untamed LLMs
Starting in June 2025, Volexity detected a series of spear phishing campaigns targeting several customers and their users in North America, Asia, and Europe. The initial observed campaigns were tailor...
https://www.volexity.com/blog/2025/10/08/apt-meets-gpt-targeted-operations-with-untamed-llms/
0
5
4
reposted by
tlansec
Volexity
7 months ago
APT meets GPT:
@volexity.com
#threatintel
is tracking
#threatactor
UTA0388's spear phishing campaigns against targets in North America, Europe & Asia, appearing to use LLMs to assist their ops. Letting
#AI
run your espionage operations? What could go wrong?
loading . . .
APT Meets GPT: Targeted Operations with Untamed LLMs
Starting in June 2025, Volexity detected a series of spear phishing campaigns targeting several customers and their users in North America, Asia, and Europe. The initial observed campaigns were tailor...
https://www.volexity.com/blog/2025/10/08/apt-meets-gpt-targeted-operations-with-untamed-llms
0
3
3
reposted by
tlansec
Volatility
7 months ago
We would like to thank
@volexity.com
for sponsoring the
#FTSCon
2025 Evening Reception, which will be at VUE Rooftop DC this year! If you haven’t registered for FTSCon yet, there’s still time! Registration closes Sunday Oct 12; learn more + register here:
volatilityfoundation.org/from-the-sou...
0
3
4
reposted by
tlansec
PJ 🇨🇦 🧬🔬📡💻 🥃
7 months ago
youtube.com/watch?v=5Z6a...
loading . . .
Bran Van 3000 - Drinking in LA (live at Nulle Part Ailleurs)
YouTube video by Pascal Burger
https://youtube.com/watch?v=5Z6aSO_BqIA&si=Wdy9UrCe3mebsf-v
0
1
1
reposted by
tlansec
State of Statecraft Conference
8 months ago
⏰ The inaugural SOS conference is 30 days away! Have you gotten your ticket yet?!? Listen to expert discussions on state-sponsored operations covering espionage, sabotage, and attribution of Russia, China, Iran, and more. Registration is still open!
stateofstatecraft.com/agenda
0
8
4
reposted by
tlansec
Wesley Shields
8 months ago
www.zscaler.com/blogs/securi...
- Nice writeup by zscaler on some COLDRIVER malware. I'm talking about this stuff at
#FTSCon
in a few weeks and will have lots more details there.
loading . . .
COLDRIVER Adds BAITSWITCH and SIMPLEFIX | ThreatLabz
The Russia-linked group COLDRIVER targeted dissidents and their supporters using a ClickFix technique, resulting in the deployment of BAITSWITCH and SIMPLEFIX.
https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix
0
7
4
reposted by
tlansec
The Banshee Queen 👑
8 months ago
First public report at Recorded Future by yours truly is out! RedNovember (formerly TAG-100, a.k.a. Storm-2077) is a Chinese state-sponsored threat group focused on intelligence collection, especially on flashpoint issues of strategic interest to China.
www.recordedfuture.com/research/red...
loading . . .
RedNovember Targets Government, Defense, and Technology Organizations
RedNovember, a likely Chinese state-sponsored cyber-espionage group, has targeted global government, defense, and tech sectors using advanced tools like Pantegana and Cobalt Strike. Discover the lates...
https://www.recordedfuture.com/research/rednovember-targets-government-defense-and-technology-organizations
2
22
14
reposted by
tlansec
Greg Lesnewich
8 months ago
Couple of openings here in our threat research org! Staff Security Research Engineer:
proofpoint.wd5.myworkdayjobs.com/en-US/Proofp...
Senior Threat Researcher (ecrime team):
proofpoint.wd5.myworkdayjobs.com/ProofpointCa...
loading . . .
Staff Security Research Engineer
About Us: We are the leader in human-centric cybersecurity. Half a million customers, including 87 of the Fortune 100, rely on Proofpoint to protect their organizations. We’re driven by a mission to s...
https://proofpoint.wd5.myworkdayjobs.com/en-US/ProofpointCareers/job/Staff-Security-Research-Engineer_R12883-1
0
9
5
reposted by
tlansec
Adam Sharp
8 months ago
In Swedish, a word for what you eat to bridge the gap between meals (or while waiting for the main course to cook) is stödmacka. It means "support sandwich." A similar word in Norwegian is ventepølse, or "waiting sausage."
61
2157
539
Load more
feeds!
log in