Daniel Stepanic

305 posts

Daniel Stepanic

Daniel Stepanic

@DanielStepanic

Malwarez at @elasticseclabs | Macrodata Refinement

शामिल हुए Mart 2011
648 फ़ॉलोइंग1.2K फ़ॉलोवर्स
Daniel Stepanic रीट्वीट किया
Virus Bulletin
Virus Bulletin@virusbtn·
Elastic Security Labs has been observing malicious campaigns delivering a multi-stage infection involving a previously undocumented loader. The SILENTCONNECT loader delivers ScreenConnect - a RMM tool used to control victim machines - as its final payload. elastic.co/security-labs/…
Virus Bulletin tweet media
English
0
8
33
1.5K
Daniel Stepanic रीट्वीट किया
Joe Desimone
Joe Desimone@dez_·
Patch Diff to SYSTEM - using LLMs to exploit a LPE vuln on Windows. More importantly, some thoughts on model capabilities the implications on our security industry elastic.co/security-labs/…
Joe Desimone tweet media
English
3
73
263
19.4K
Daniel Stepanic रीट्वीट किया
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
@soolidsnakee uncovered a #clickfix campaign using compromised legitimate sites to deliver a five-stage chain ending in #MIMICRAT, a custom native C RAT with malleable C2, token theft, and SOCKS5 tunneling. Read more here: ela.st/mimicrat
English
0
8
39
6K
Daniel Stepanic रीट्वीट किया
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
Elastic Security Labs uncovered a large-scale SEO poisoning campaign deploying #BADIIS malware on 1,800+ IIS servers worldwide. Compromised systems—spanning government, corporate, and education sectors—are monetized to push gambling and illicit content. Learn more here: ela.st/badiis
English
0
22
100
16.1K
Daniel Stepanic रीट्वीट किया
SolidSnake
SolidSnake@soolidsnakee·
We are tracking #clickfix campaign hosted and served by two compromised websites. Lua in-memory script loader and a #RAT that we are naming #MimicRat. A blog post will follow soon on @elasticseclabs. www.ndibstersoft[.]com d15mawx0xveem1.cloudfront[.]net xMRi[.]neTwOrk
English
2
7
25
2K
Daniel Stepanic रीट्वीट किया
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
New from the developer of #FINALDRAFT: Meet #NANOREMOTE, a newly-discovered Windows backdoor that leverages the Google Drive API for data theft and payload staging. Get the full analysis and defense strategies: ela.st/nanoremote
English
0
27
56
14.6K
Daniel Stepanic रीट्वीट किया
Jia Yu Chan
Jia Yu Chan@k33b0i·
Nice post by @sysdig! x.com/virusbtn/statu… We’re seeing this implant as well. Looks like there is a worm module too.
Virus Bulletin@virusbtn

Sysdig TRT details EtherRAT, a sophisticated backdoor dropped through recent React2Shell exploitation. The implant uses Ethereum smart contracts for C2 resolution and multiple Linux persistence mechanisms, going well beyond typical cryptomining payloads. sysdig.com/blog/etherrat-…

English
1
5
14
3K
Daniel Stepanic रीट्वीट किया
Virus Bulletin
Virus Bulletin@virusbtn·
Elastic Security Labs publishes nightMARE, a Python library (v0.16) for malware analysis and for building configuration extractors. elastic.co/security-labs/…
Virus Bulletin tweet media
English
0
39
141
10.6K
Daniel Stepanic रीट्वीट किया
Devon Kerr
Devon Kerr@_devonkerr_·
@elasticseclabs is currently researching a new family of IIS malware impacting a large number of organizations globally. With a US university-based MDR provider, we’ve observed a novel attack chain, RMMs, a Godzilla-forked framework, and a malicious driver. Details coming soon.
English
1
11
59
4.6K
Daniel Stepanic रीट्वीट किया
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
#ElasticSecurityLabs is observing #ValleyRAT infections using the following #LOLBins for execution: - DeviceCredentialDeployment.exe (proxy execution) - Tttracer (proxy execution) - Renames curl[.]exe (masquerade) - Ttdinject (remote injection) - Pester (proxy execution)
Elastic Security Labs tweet media
English
1
16
71
4.7K
Daniel Stepanic रीट्वीट किया
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
#ElasticSecurityLabs continues to observe phishing campaigns leveraging Cloudflare tunnels distributing multiple malware families (#VenomRAT, #DCRat, #XWorm) simultaneously. These threat actors are abusing LLMs to produce simple Python shellcode loaders for injection
Elastic Security Labs tweet media
English
2
26
117
28.3K
Daniel Stepanic रीट्वीट किया
Elastic Security Labs
Elastic Security Labs@elasticseclabs·
New research on NOVABLIGHT, a NodeJS infostealer sold as MaaS! Discover its tactics, from credential theft & cryptowallet compromise to advanced obfuscation & anti-analysis techniques: go.es.io/459JGDA #ElasticSecurityLabs #infostealer
English
2
20
53
3.9K
Daniel Stepanic रीट्वीट किया
Devon Kerr
Devon Kerr@_devonkerr_·
This is a great opportunity to highlight the researcher behind this article (and the most recent member of my operation) @k33b0i! Jia Yu worked on our FINALDRAFT, GOSAR, and STEALC research— you’re gonna want to keep an eye on this young gun.
Elastic Security Labs@elasticseclabs

#ElasticSecurityLabs has uncovered EDDIESTEALER, a novel Rust-based info stealer distributed via fake CAPTCHA campaigns. This malware targets credentials, browser info, & crypto wallets. Read our full analysis here: go.es.io/3St6tnY #Cybersecurity #MalwareAnalysis

English
0
2
13
886
Daniel Stepanic
Daniel Stepanic@DanielStepanic·
@keowu @birdrockrock @elasticseclabs That’s my fault, I have amended the post with a reference. I didn’t come across this research until afterwards. I think the approaches are pretty different but yeh there is overlap as it’s the same protection scheme.
English
1
0
2
187
João Vitor(Keowu)
João Vitor(Keowu)@keowu·
@birdrockrock I don't think it can be the kind of relationship you mentioned. I don't think you're correct... The structure and approach are very similar, yes, but there's no way to be sure. The way @elasticseclabs did it is the same in the sense that it's exactly the protector's structure.
English
1
0
5
142

खोजें

@soolidsnakee @elasticseclabs @sysdig @k33b0i @tamusystem @keowu @birdrockrock @elonmusk