crep1x
@crep1x.bsky.social
📤 87
📥 41
📝 23
Lead cybercrime analyst, tracking adversaries activities & infrastructure, at
@sekoia.io
Open directory at 104.168.81.]229/BJ/ containing phishing pages for Zimbra, Outlook, Adobe, and various Chinese services 104.168.81.]229 microsoftstorage.duckdns[.]org outllook.duckdns[.]org outlookspace.duckdns[.]org patnerrshipp.duckdns[.]org ⬇️
about 1 month ago
1
0
0
reposted by
crep1x
Sekoia.io
2 months ago
#TDR
analysts dig into a modus operandi targeting the hospitality industry and the related cybercrime ecosystem that facilitates
#phishing
and
#fraud
campaigns.
blog.sekoia.io/phishing-cam...
1
5
3
reposted by
crep1x
Sekoia.io
7 months ago
📝 Our latest
#TDR
report delivers an in-depth analysis of Adversary-in-the-Middle (#AitM)
#phishing
threats - targeting Microsoft 365 and Google accounts - and their ecosystem. This report shares actionable intelligence to help analysts detect and investigate AitM phishing.
1
10
7
Check out our new blog post by the TDR team, presenting the latest TTPs used by the
#Interlock
ransomware group! It includes their use of the ClickFix tactic, PyInstaller, Node.js, Cloudflare Tunnels, and new PowerShell loader/backdoor ⬇️
bsky.app/profile/seko...
✍️
@kseznec.bsky.social
add a skeleton here at some point
9 months ago
1
2
0
reposted by
crep1x
Sekoia.io
9 months ago
Since the apparition of the
#Interlock
ransomware, the Sekoia
#TDR
team observed its operators evolving, improving their toolset (#LummaStealer and
#BerserkStealer
), and leveraging new techniques such as
#ClickFix
to deploy the ransomware payload.
blog.sekoia.io/interlock-ra...
0
2
6
Tycoon 2FA (a prominent AitM phishing kit), targeting Microsoft and Google accounts, uses a new CAPTCHA page instead of the custom Cloudflare Turnstile page e.g. hxxps://ymi.bvyunz.]ru/3v4jfQ-cUo/ hxxps://xau.kolivax.]ru/ckYHFJN/ hxxps://ffqt.lzirleg.]es/VajlR/ ⬇️
10 months ago
1
2
1
Here is our in-depth analysis of the latest
#ClearFake
variant using the Binance Smart Chain and two new ClickFix lures. ClearFake is injected into thousands of compromised sites to distribute the
#Emmental
Loader,
#Lumma
,
#Rhadamanthys
, and
#Vidar
. ⬇️
bsky.app/profile/seko...
add a skeleton here at some point
10 months ago
1
4
1
reposted by
crep1x
Sekoia.io
10 months ago
TDR analysts published an analysis of the new
#ClearFake
variant that relies on compromised websites injected with the malicious JavaScript framework, the
#EtherHiding
technique, and the
#ClickFix
social engineering tactic.
buff.ly/vbiVbsN
loading . . .
ClearFake’s New Widespread Variant: Increased Web3 Exploitation for Malware Delivery
ClearFake spreads malware via compromised websites, using fake CAPTCHAs, JavaScript injections, and drive-by downloads.
https://blog.sekoia.io/clearfakes-new-widespread-variant-increased-web3-exploitation-for-malware-delivery/
1
5
4
#ClearFake
variant is now spreading
#Rhadamanthys
Stealer via
#Emmenhtal
Loader. cc
@plebourhis.bsky.social
@sekoia.io
1. ClearFake framework is injected on compromised WordPress and relies on EtherHiding 2. The
#ClickFix
lure uses a fake Cloudflare Turnstile with unusual web traffic ⬇️
10 months ago
2
3
2
For those who did not monitor the supply chain attack against Chrome extensions in December 2024, our article provides an overview of: - the targeted phishing attack against extension developers - malicious code - the adversary's infrastructure ⬇️
bsky.app/profile/seko...
add a skeleton here at some point
12 months ago
0
3
3
reposted by
crep1x
Sekoia.io
12 months ago
TDR analysts analysed the supply chain attack targeting Chrome browser extensions, which potentially affected hundreds of thousands of end users in December 2024.
https://buff.ly/4auQ0HN
1
8
5
Around 1,000 malicious domains are hosting webpages impersonating Reddit and WeTransfer, redirecting users to download password-protected archives These archives contain an AutoIT dropper, we internally named
#SelfAU3
Dropper at
@sekoia.io
, which executes
#Lumma
Stealer IoCs ⬇️
12 months ago
2
9
6
Our last article exposes the new AiTM phishing kit Sneaky 2FA, sold by the cybercrime service "Sneaky Log"! We provide an in-depth analysis of the phishing pages, the associated service, detection opportunities and multiple IoCs. ⬇️
bsky.app/profile/seko...
add a skeleton here at some point
12 months ago
1
6
1
Recent update in
#Vidar
C2 servers configuration: HTTP Location header set to "hxxps://t.]me", instead of "hxxps://google.]com" Heuristic to track C2 IPs and domains on Censys:
search.censys.io/search?resou...
Dead Drop Resolvers (DDR) of the week: hxxps://t.]me/no111p ⬇️
12 months ago
1
3
0
reposted by
crep1x
Nicolas Caproni
about 1 year ago
🦝 The new episode of
@intel471.bsky.social
"Cybercrime Exposed" podcast produced by
@jkirk.bsky.social
tells the story of
#Raccoon
Stealer and, more broadly, reveals how the
#infostealer
ecosystem operates. Featuring
@crep1x.bsky.social
from
@sekoia.io
!
intel471.com/resources/po...
loading . . .
Cybercrime Exposed Podcast: Raccoon Stealer
Intel 471 empowers cybersecurity teams worldwide to be proactive with its TITAN platform and comprehensive coverage into the criminal underground.
https://intel471.com/resources/podcasts/cybercrime-exposed-podcast-raccoon-stealer
0
4
2
you reached the end!!
feeds!
log in