If I won the lottery, I might not tell anyone, but there would be signs.

Check out his full talk here: www.google.com/url?sa=t&sou...

Paul Melson joined us this year as our keynote speaker to talk about the history of crimeware and its evolution through the years. In his keynote he also gives some good advice to those who are in the field and creating their professional network. Check out what he had to say!

If you’re not already alerting on CONHOST.EXE spawning CMD.EXE spawning WGET.EXE or CONHOST.EXE spawning CONHOST.EXE spawning CONHOST.EXE you’re gonna want to close that gap today.

Are weekly dental cleanings a thing?

ICYMI: Paul Melson, VP of Cyber Intelligence Engineering at Capital One, delivered the SLEUTHCON 2025 keynote! Watch here >> www.youtube.com/watch?v=9FvB...

Happy International Dog Day, hope you spent it with your best friends

Don’t miss the use of ngrok for tunneling here. Continue to see malicious actors use this service to hide C2. Ngrok uses AWS IPs across multiple zones for egress NAT. I recommend sinkholing their domains across your network. ngrok[.]com ngrok[.]io ngrok-free[.]app www.microsoft.com/en-us/securi...

It’s that time again, apparently.

Paul Melson's Brief History of Crime[ware] was a lovely (?!) trip down memory lane. I'm old too, @pmelson.bsky.social #SLEUTHCON #traumamemories

It is my position that Chatham House rules and TLP should extend to any trolling that takes place in those channels and venues.

New keynote drop: Paul Melson is taking the SLEUTHCON stage to dissect the rise of crime[ware]—how it started, how it scaled, and how we shut it down. 23+ yrs defending networks. ScumBots founder. Now VP @ Capital One. 🎤 June 6 📍IRL + virtual 🎟️ Tix moving fast - sleuthcon.com 🗓️ CFP closes April 18

Today I am thankful for all of the folks working a shift and watching the wires to keep us safe. I see you and I appreciate you.

@volexity.com’s latest blog post describes in detail how a Russian APT used a new attack technique, the “Nearest Neighbor Attack”, to leverage Wi-Fi networks in close proximity to the intended target while the attacker was halfway around the world.    Read more here: www.volexity.com/blog/2024/11...

2024-11-22 (Friday) #XLoader / #Formbook: I've been fired by my non-existent HR department. At least I got a "salary-receipt.exe" bazaar.abuse.ch/sample/003b5... Tria.ge and Any.Run don't identify the malware, but Joe Sandbox does: www.joesandbox.com/analysis/156... Also runs in my lab just fine

I’m in the process of migrating ScumBots from Twitter to Mastodon / infosec.exchange. You can follow the bot here now: infosec.exchange/@ScumBots

I posted a writeup analyzing a malicious PDF file containing a heavily obfuscated PHP payload over on infosec[.]exchange: infosec.exchange/@pmelson/113...