Your cyber threat intel is part of the North Korean strategy: DPRK operators are abusing CTI platforms to see if they’ve been seen—and moving faster because of it. 👀

💥 Fresh from LABS @philofishal.bsky.social and @syrion89.bsky.social Our guys untangle the knots of #NimDoor: compiled Nim, macOS process injection and signals-based persistence triggers, with AppleScript (⁉️) beacons (whatever will they think up next 😅) 🌶️🌶️. #dprk #apt #macOS s1.ai/nimdoor

More bad #Apple #malware from our "friends" from the #DPRK (again!). 🇰🇵 Similar to the one seen by Huntress, but uses some different Nim payloads and trickery to write persistence on reboot / kill. Heads up #macOS detection engineers! 👇 @syrion89.bsky.social www.sentinelone.com/labs/macos-n...

NEW 👉 FreeDrain Unmasked | Uncovering an Industrial-Scale Crypto Theft Network Months-long research project with Validin we just dropped @pivotcon.bsky.social 🖤~40k IOCs: github.com/Validin/indi... 💜 SentinelLabs: s1.ai/freedrain 💙 Validin: www.validin.com/blog/freedra... Enjoy!

Nothing much interesting in #XProtect update v5291, just a modification to a recent #Pirrit #adware rule. #macOS

🍎🚨🕵️‍♂️ The notoriously elusive macOS malware, ReaderUpdate, is back — stealthier than ever. @philofishal.bsky.social and @syrion89.bsky.social uncover how ReaderUpdate Reforged blends Go, Crystal, Nim, and Rust into a potent mix.

s1.ai/readup 🐚 Adware loaders are always the most complex! Props to @syrion89.bsky.social for helping me pull apart all these different bins and figuring out what they had in common and how to attribute and detect them. 🦾 #adware #malware #macOS #security @sentinelone.com @sentinellabs.bsky.social

🐴How eBPF runtime Cloud Security stops attacks like tj-actions (CVE-2025-3066), a trojan horse hidden in a trusted software component, integrated into over 23,000 software development projects ⬅️

From Russia with Love? #xcsset #malware #macOS #apple #security www.microsoft.com/en-us/securi...

Your daily reminder that #XProtect will not protect you against new malware because that’s not how it works (it also doesn’t protect against a lot of known malware because that’s not how #Apple works). #macOS #security

Sneaky! 🫣😶‍🌫️ #DPRK FERRET #macOS #malware has been tricking users into installing backdoors and trying to hide out behind fake Zoom, Chrome and Apple logd files. @philofishal.bsky.social @hegel.bsky.social s1.ai/Ferret

🚨🔒HellCat and Morpheus ransomware operations have been gaining momentum and notoriety in the past six months. Our new analysis shows how they use identical code despite operational differences in their brands and visibility. To learn more, read the full research by Jim Walter: s1.ai/Hellmor

🍎👿 The key macOS malware families of 2024: This past year saw a sharp rise in sophisticated campaigns targeting macOS users in the enterprise and the increasing adoption of cross-platform development frameworks.

This #macOS backdoor uses /usr/bin/SetFile to hide itself in the Finder. SetFile was deprecated in Xcode 6 (that's 2014 to humans)...not sure why it makes sense to declare smth 'deprecated' then leave it in the OS for 10+ years. 🤷‍♂️ #apple #malware SHA1: 609088c54b99432aab212f35cfe74030b52f0320

🇨🇳 💻 New from @sentinellabs.bsky.social and Tinexta Cyber: A Chinese threat actor has been targeting large B2B IT service providers in southern Europe to conduct cyberespionage. s1.ai/d-eye

💡Dr. Cristina Cifuentes, the Mother of Decompilation, reflects in her #LABScon2024 keynote on three decades of innovation in reverse engineering. 📺 Watch the full video: s1.ai/LC24-CC

We're expanding @sentinelone.com capabilities for intelligence, hunting, and the internal mechanisms to do these tasks better/faster/farther with every passing day. If you don't see the perfect role, please keep checking in as this is only the first wave of our expansion. www.sentinelone.com/jobs/

🇮🇳🇷🇺 A @sentinellabs.bsky.social deep dive into the pro-Russia #hacktivist collective that originated in India, #CyberVolk aka #GLORIAMIST. 📄 Read the research from Jim Walter: s1.ai/CVolk

Yesterday Banshee Stealer, the MacOS-based Malware-as-a-Service infostealer, had their source code leaked online. As a result of the leak they've shut down their operations. We've archived the leak and made it available for download on GitHub. github.com/vxundergroun...

🔥 🇰🇵 @sentinellabs.bsky.social has found an active network of North Korean IT Worker front companies linked to China, overlapping with four companies recently disrupted by U.S. government agencies. Read the research by @hegel.bsky.social and @dakotaindc.bsky.social: s1.ai/IT-Front

A band new Three Buddy Problem episode for your weekend earholes! 🔥 with @craiu.bsky.social @jags.bsky.social We cover Volexity’s discovery of Russian APT Wi-Fi “nearest neighbor attacks,” the Chinese surveillance state, Salt Typhoon realities, and more... LISTEN open.spotify.com/episode/2Bop...

Been a while since we've seen #macOS #malware abusing osacompile rather than plain osascript, but #Amos Atomic Stealer is nothing if not adaptable. SHA1: 51ef05c84eea3dde149a5dd3ea9916a824e95afc. A reminder that it's possible (didn't say easy 😅) to reverse compiled #applescript. s1.ai/fadedead

🚨 New Research Drop: 🇰🇵 DPRK IT Workers | A Network of Active Front Companies and Their Links to China Summary: ⚪ Newly Disrupted Front Companies by USG ⚪ Impersonating US based software and tech orgs ⚪ Links to still-active front orgs, CN association Report: www.sentinelone.com/labs/dprk-it...

What we saw with Hidden Risk (s1.ai/BNThief), we’ll see plenty more of in 2025: threat actors exploring all the old methods of #macOS persistence because the lazy LaunchAgents way is now too noisy thanks to changes Apple made in Ventura.(1/2)

🔥 New from Phil Stokes, Raffaele Sabato and Me: 🇰🇵 BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence www.sentinelone.com/labs/bluenor...

The Iran report is indeed a great bit of work that was pretty widely missed it seems. Much to explore, read it here: www.ic3.gov/CSA/2024/241...

Look who finally showed up!

I wrote a post on the realities of cloud & webserver ransomware. Check it out to see some of the toolsets & frameworks that can be used for these attacks.

Good stuff from our friends over at Jamf. We saw some of the same infrastructure and TTPs in our investigation for the #bluenoroff post (s1.ai/BNThief). The use of Flutter apps, though, that's novel! www.jamf.com/blog/jamf-th...

Last week, we released new research about new Mac #malware with TTPs consistent with suspected DPRK #APT BlueNoroff. s1.ai/BNThief. This week, friends-of-NK say we’re shills for US gov. 😂 easternherald.com/2024/11/10/s... Hate to break it to ‘em, but that ain’t how we roll. 😆