Python Bot Delivered Through DLL Side-Loading https://isc.sans.edu/diary/31778

Great talk! 🥳

Good morning from #Insomnihack! I’m here today, ping me if you want to meet!

Shellcode Encoded in UUID's https://isc.sans.edu/diary/31752

Njrat Campaign Using Microsoft Dev Tunnels isc.sans.edu/diary/31724 #SANSISC

Every once in a while you come across interesting PE Section names Hello Guy! www.virustotal.com/gui/file/051...

XWorm Cocktail:  A Mix of PE data with PowerShell Code isc.sans.edu/diary/31700 #SANSISC

Monday morning reading with your 0xC0FFEE: www.elastic.co/security-lab...

The Danger of IP Volatility isc.sans.edu/diary/31688 #SANSISC

Fake BSOD Delivered by Malicious Python Script https://isc.sans.edu/diary/31686

The Unbreakable Multi-Layer Anti-Debugging System isc.sans.edu/diary/31658

Be honest… we all do that… taking screenshots of important information! Be careful and don’t keep them for a long time! #InfoStealer #Malware #OCR t.co/cjI7gNLkW5

From PowerShell to a Python Obfuscation Race! https://isc.sans.edu/diary/31634

Fileless Python InfoStealer Targeting Exodus https://isc.sans.edu/diary/31630

Let’s wrap up the week with the malware analysis tournament! Wanna join the fun? My next class is in March in London #FOR610 #SANSEMEA

Make Malware Happy isc.sans.edu/diary/31560 #SANSISC

SwaetRAT Delivery Through Python isc.sans.edu/diary/31554

More SSH Fun! isc.sans.edu/diary/31542

Modiloader From Obfuscated Batch File isc.sans.edu/diary/31540

Christmas "Gift" Delivered Through SSH isc.sans.edu/diary/31538

Interesting read: Windows Server 2022 and MsMpEng.exe www.hexacorn.com/blog/2024/12...

Python Delivering AnyDesk Client as RAT isc.sans.edu/diary/31524

Is it me or the price of printer cartridges became really insane? @HP has a business more lucrative than #ransomware gangs! Hey Bad Guys, move to the printer business! 👿

“I see coins everywhere!” 😍

Cyber Defense #Netwars running at full speed in Frankfurt! #SANSEMEA

Full set of Belgian speakers at SANS@Night in Frankfurt tonight! 🇧🇪 The room was full! So exciting! #SANSEMEA

My last #FOR610 run for this year! Welcome Frankfurt!

From a Regular Infostealer to its Obfuscated Version isc.sans.edu/diary/31484 #SANSISC

Some attackers look like #scriptkiddies and need a GUI 😆 #Ransomware

IT Archeology… I found this today!

Me, writing #Python scripts for #malware analysis..

An Infostealer Searching for « BIP-0039 » Data isc.sans.edu/diary/31464

Best comment ever from one student here in #FOR710: « Although i have been an ida pro believer for 10+ years, i like how #Ghidra makes everything FUN while to IDA Pro you're only a sub :( » #QotD

Detecting the Presence of a Debugger in Linux isc.sans.edu/diary/31450

A nice hunting technique in #Splunk: www.hexacorn.com/blog/2024/01...

Interesting #lolbin: www.hexacorn.com/blog/2023/12...

Dear Followers, Happy 0x7E8!

From @sansisc.bsky.social : Python Keylogger Using Mailtrap.io i5c.us/d30512

From @sansisc.bsky.social: Shall We Play a Game? i5c.us/d30510

From @sansisc.bsky.social : An Example of RocketMQ Exploit Scanner i5c.us/d30492

From @sansisc.bsky.social: CSharp Payload Phoning to a CobaltStrike Server i5c.us/d30490

From @sansisc.bsky.social: Malicious Python Script with a TCL/TK GUI i5c.us/d30478

When you perform a brute force on a DNS zone, nothing is returned (even a simple 'www'), and you realize that you made a typo in the domain... 🤦 #FridayStory

Microsoft Patch Tuesday November 2023 i5c.us/d30400

Finally joined... Hello! \o