Vitali Kremez

🎁Gift for the community: Post-#Conti #ransomware operation mindmap world. Enjoy!

The Week in Ransomware - October 21st 2022 - Stop the Presses - @LawrenceAbrams bleepingcomputer.com/news/security/…

#Royal ransomware operation in action.

New Royal Ransomware emerges in multi-million dollar attacks - @LawrenceAbrams bleepingcomputer.com/news/security/…

Offsecurity: First time flying as a private pilot single engine land from east -> west coast of Florida. Aircraft: Cessna 172N IFR training and rotorcraft add-on next!

The Week in Ransomware - September 16th 2022 - Iranian Sanctions - @LawrenceAbrams bleepingcomputer.com/news/security/…

@peterbaurichter @campuscodi Exactly that. Less need for "restorative" IR work in exfil cases

@campuscodi @MaD_c4t Well it is

🔥Breaking Blog: AdvIntel's State of #Emotet aka "#SpmTools" Displays Over Million 🌎Compromised Machines Through 2⃣0⃣2⃣2⃣ Insight: *⃣Emotet infection chain is currently attributed to #Quantum & #BlackCat ransomware chains. advintel.io/post/advintel-…

The Week in Ransomware - September 9th 2022 - Schools under fire - @LawrenceAbrams bleepingcomputer.com/news/security/…

@AlyssaM_InfoSec Amazing. Congratulations! I have gotten my private pilot license lately well. Finished with 60hrs on Cessna 172N. Again, congratulations! I want to get a low-wing Cherokee too as I am not a fan of Cessna. Probably, will get after I finish IFR and helicopter PPL endorsement

@Ionut_Ilascu Someone is hitting Cobalt Strike servers used by former members of the Conti ransomware gang with messages urging to stop Russia's war: “Stop the war!” “15000+ dead Russian soldiers!” “Be a Russian patriot!” "Stop Putin!"

@SwitHak @AdvIntel @y_advintel Emotet first then Brute Ratel C4 Anatomy of Attack :)

@VK_Intel Any blogpost from @AdvIntel planed? Cc @y_advintel

📌We have observed the "Anti-Putin" messages from Cobalt Strike flooding activities mapped to ex-Conti cybercrime enterprise members.

Insight:⚡️#Emotet loader-as-a-service infection metrics globally for 2022 of ~1,300,000 unique bot_ids / top targeted infected by loader (including honeypot activity). Still alive but on a general decline. The public report is incoming.

@james_vinocur @campuscodi Thank you, James :) Great to see you here!

Callback phishing was the tactic that enabled a widespread shift in the approach to ransomware deployment. This is what made the approach so unique and effective 👇

⚡️2022 Trend: Call-back phishing campaigns aka "BazarCall" are the de-facto top method of getting a backdoor on the protected corporate networks. 1⃣Ransomware and extortionists want to talk to the corporate employees over ☎️. 2⃣Targets are just larger & phishing is more complex

@LawrenceAbrams @MsftSecIntel @demonslay335 @malwrhunterteam There are quite a few current "noname" ransomware payloads used by the related group. The graph is missing quite a few including Diavol & BlackByte and others.

Anyone heard of this Agenda ransomware from Microsoft's new report? @VK_Intel @MsftSecIntel @demonslay335 @malwrhunterteam

⚡️Timely report on the latest Cobalt Strike domain fronting technique leveraging tyk[.]io. Many ex-Conti groups leverage this domain fronting technique for Cobalt Strike beacon resolver/traffic. Watch out for tyk[.]io traffic. shells.systems/oh-my-api-abus…