1.
David Ledbetter
@Ledtech3
Newly-observed domain shadowing #FakeUpdates/#SocGholish
resort[.]reliablecommunityservices[.]com
resale[.]adke… twitter.com/i/web/status/1…
resort[.]reliablecommunityservices[.]com
resale[.]adke… twitter.com/i/web/status/1…
Retweet of status by @MBThreatIntel
2.
David Ledbetter
@Ledtech3
New files here
H/T @MichalKoczwara
pe64.ps1 exploits CVE-2021-26411
We have already seen CS, PoschC2, SystemBC… twitter.com/i/web/status/1…
H/T @MichalKoczwara
pe64.ps1 exploits CVE-2021-26411
We have already seen CS, PoschC2, SystemBC… twitter.com/i/web/status/1…
3.
4.
5.
6.
7.
David Ledbetter
@Ledtech3
#VBA declare statement: from libname #obfuscation to remote dll loading
Declare is used to declare a ref to an e… twitter.com/i/web/status/1…
Declare is used to declare a ref to an e… twitter.com/i/web/status/1…
Retweet of status by @DissectMalware
David Ledbetter
@Ledtech3
I'm looking for a manager for the @Mandiant #AdvancedPractices Research team!
If you want to:
manage high-pe… twitter.com/i/web/status/1…
If you want to:
manage high-pe… twitter.com/i/web/status/1…
Retweet of status by @matthewdunwoody
David Ledbetter
@Ledtech3
#Azorult RabbitHole
Malspam
ISO attachment
VBS unzip
PowerShell launch
Binary to ASCII conversion
… twitter.com/i/web/status/1…
Malspam
ISO attachment
VBS unzip
PowerShell launch
Binary to ASCII conversion
… twitter.com/i/web/status/1…
Retweet of status by @ankit_anubhav
David Ledbetter
@Ledtech3
I am preparing for an internal talk on career advice learned from working security crises. My notes
Retweet of status by @JohnLaTwC
David Ledbetter
@Ledtech3
Well, the cat is out of the bag @vxintel. Officially out of stealth, a new website & 600GB of served all in one… twitter.com/i/web/status/1…
8.
9.
10.
11.
David Ledbetter
@Ledtech3
Oh how fun! Happy Wednesday!
: github.com/GigsSecurity/P… twitter.com/sansforensics/…
: github.com/GigsSecurity/P… twitter.com/sansforensics/…
Retweet of status by @Gigs_Security
David Ledbetter
@Ledtech3
CVE-2021-21985 exploit activity detected from 45.79.73.107 () targeting our VMware vCenter honeypots.
Query our… twitter.com/i/web/status/1…
Query our… twitter.com/i/web/status/1…
Retweet of status by @bad_packets
David Ledbetter
@Ledtech3
Mass scanning activity detected from 89.190.156.33 (//) targeting Palo Alto GlobalProtect VPN servers. #threatintel
Retweet of status by @bad_packets
David Ledbetter
@Ledtech3
Who has experience as a bootstrapped startup Business Operations Manager?
We’d love to welcome you to the island!… twitter.com/i/web/status/1…
We’d love to welcome you to the island!… twitter.com/i/web/status/1…
...but wait! There's more!
1.
fakhright
@fakhright
astaghfirullah peng.krim guaaaaaaaa..............a *salto sambil solat*
