Andrew Pease

523 posts

Andrew Pease

@andythevariable

Elastic Security Labs Technical Lead. Lawful Neutral. Threat Hunting with the Elastic Stack author. Retired CW4.

Katılım Mayıs 2019

290 Takip Edilen1.1K Takipçiler

Sabitlenmiş Tweet

Andrew Pease@andythevariable·13 Nis

I think the really big takeaway from this is the abuse of a legitimate tool's plugin capability to execute💀scripts. Many hours of work over the weekend by @soolidsnakee @DanielStepanic and @SBousseaden.

Elastic Security Labs@elasticseclabs

We have identified a novel social engineering campaign abusing Obsidian, the popular note taking app, to deliver a previously undocumented RAT #PHANTOMPULSE and it’s loader #PHANTOMPULL targeting individuals in finance and crypto. The attack never exploits a vulnerability. It abuses Obsidian's own plugin ecosystem to execute code the moment a victim opens a shared vault. Full analysis: go.es.io/4cld0dB

English

1.5K

Andrew Pease retweetledi

sin@sinfulrawr·6 Tem

I decided to look into GDID after this, and reading the court document gave some hints. After poking at some stuff I can confidently say I figured out majority of the system end to end. Check it out at github.com/SmtimesIWndr/g… p.s yes Claude helped don't come yell at me AI haters

vx-underground@vxunderground

> Peter Stokes > Scattered Spider guy > Arrested > Microsoft helps FBI > Read court documents > Page 12 > Microsoft tracks Stokes from GDID > Microsoft Global Device Identifier (GDID) > Stokes used Windows > Page 34 > GDID assigned to each OS install > GDID unique to each device > GDID only change if OS wiped > Stokes GDID 6755467234350028 > GDID reported internet activity to Microsoft > GDID showed Stokes using Ngrok > GDID reported Stokes IP address > GDID showed Stokes web activity > GDID showed timestamps of web activity > GDID mapped with video game activity > GDID showed games played > GDID undocumented > GDID only mentioned in one MSDN document > Azure UCDOStatus > Azure Monitor Logging

English

742

120.3K

Andrew Pease retweetledi

Elastic Security Labs@elasticseclabs·8 Tem

We tracked a new activity cluster targeting Mexican banking customers. Elastic Security Labs discovered REF6045, an operator-assisted banking fraud campaign targeting customers of Mexican banks, fintechs, and cryptocurrency platforms through ClickFix fake-CAPTCHA lures. The operation exhibits a reliance on AI-generated code and suffers from significant operational security (OPSEC) failures that exposed their infrastructure and their toolkit. The toolkit gives operators a full fraud workflow from: •Vishing overlay: lock the screen behind a fake bank warning •Browser redirect: paste a phishing URL via automated keystrokes •Clipboard swap: replace CLABE or card numbers mid-transfer •Remote access: install Remote Utilities for hands-on takeover Research by @k33b0i and @soolidsnakee. Full analysis from Elastic Security Labs: go.es.io/4eP6VZF

English

5.9K

Andrew Pease retweetledi

International Cyber Digest@IntCyberDigest·2 Tem

❗️ BREAKING: Over 2 million hijacked consumer devices, including smart TVs and streaming boxes, were quietly acting as residential proxy exit nodes. All of them, per Google, were part of the NetNut residential proxy network. Google, working with the FBI and Lumen, has moved to dismantle the NetNut network. In a single week, Google tracked 316 distinct threat clusters, including espionage groups, routing attacks and password sprays through suspected NetNut exit nodes.

English

637

2.7K

1.3M

Andrew Pease retweetledi

RussianPanda 🐼 🇺🇦@RussianPanda9xx·2 Tem

Imagine the perfect world where you've got 100 things to do and you have to lean on AI for a quick malware triage. It took 12 minutes to identify the obfuscated C2 and the malware capabilities for this sample. Model used: Sonnet 4.6 I'm working on the AI Reverser skill, built on a bunch of malware samples I threw into an LLM meat grinder for analysis. It won't be published publicly, it will be shared only with a trusted circle. Stay tuned 🤖

English

191

12.9K

Andrew Pease retweetledi

Greg Linares (Laughing Mantis)@Laughing_Mantis·27 Haz

@vxunderground Always remember: Everyone only talks about the times the threat actors are caught

English

530

Andrew Pease@andythevariable·18 Haz

@JFrogSecurity Thanks for getting this info out. Can you share how you detected it? Sorry if I overlooked that.

English

306

JFrog Security@JFrogSecurity·17 Haz

🚨 SECURITY ALERT: A widespread supply chain attack dubbed "easy-day-js" has been identified, targeting the mastra npm packages. Attackers have compromised and published malicious versions of these packages. 144 packages are currently confirmed to be affected. Please check your dependencies immediately. We will share the full list of affected packages in this thread and further analysis in: research.jfrog.com/post/easy-day-… (will be live in a few hours)

English

157

556.3K

Andrew Pease@andythevariable·14 Haz

On June 17, I'm going live with @jamesspi and @danielmiessler to cover the Obsidian and Axios supply chain attacks, and how AI agents can speed response. Humans don't leave the loop; they're moved to the top of it. 10am PT / 1pm ET @elasticseclabs elastic.co/lp/agentic-ai-…

English

2.2K

Andrew Pease@andythevariable·9 Haz

This is how researchers should operate. Better offensive security makes better defensive security and vice versa. Iron sharpens iron.

Samir@SBousseaden

EDRUnChoker😀registers a permanent WMI subscription with a 5-second timer runs embedded VBScript (fileless) that deletes malicious MSFT_NetQosPolicySettingData policies targeting known security products or aggressive app-path throttles. github.com/sbousseaden/ED…

English

4.4K

Andrew Pease retweetledi

Samir@SBousseaden·7 Haz

very cool research! it triggers an existing Elastic Defend behavior detection

Two Seven One Three@TwoSevenOneT

New #redteam tool for blocking EDRs: EDRChoker Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events #pentest #cybersecurity Github: TwoSevenOneT/EDRChoker

English

158

22.2K

Andrew Pease@andythevariable·8 May

The attempts at environmental anti-tamper techniques to encrypt the payload were clever…just not enough. #tclbanker #ref3076

Elastic Security Labs@elasticseclabs

We uncovered a new Brazilian banking trojan campaign: TCLBANKER. What makes TCLBANKER notable isn’t just the malware itself, but how it spreads. The campaign uses compromised WhatsApp and Outlook accounts to propagate through trusted user relationships, deploys targeted banking overlays, and incorporates anti-analysis techniques designed to evade detection. For defenders, it’s another example of malware increasingly blending into legitimate user behavior and everyday communication channels, making detection harder and trust easier to exploit. Our latest research breaks down the infection chain, propagation methods, evasion tactics, and detection opportunities observed across the campaign. Read the full analysis: go.es.io/4ewvCKF

English

676

Andrew Pease retweetledi

🄱@lvc1ferrr·15 Nis

Elastic Security Labs warned that attackers are targeting crypto users through Obsidian community plugins that silently install PHANTOMPULSE malware. They lure victims into opening a shared cloud vault in the note-taking app.

English

281

Andrew Pease retweetledi

Seth@bluish_red_·14 Nis

points to the same Phantom panel, so convicted #PHANTOMPULSE ! h/t @soolidsnakee

English

220

Andrew Pease retweetledi

Seth@bluish_red_·14 Nis

LET'S GO! That first query caught another TX today. New domain! Presumably #PHANTOMPULSE. `https://gfsdjjg33jfk[.]com` eth.blockscout.com/tx/0xc27d78ce1…

English

1.2K

Andrew Pease@andythevariable·4 Nis

Tremendous work @soolidsnakee!

Elastic Security Labs@elasticseclabs

"Salary Slips.exe." "Dont Delete.exe." "Important.exe." These are the filenames BRUSHWORM copies itself as when spreading across USB drives in a targeted attack on a South Asian financial institution. Elastic Security Labs uncovered two custom components working together: a modular backdoor and a persistent keylogger masquerading as libcurl.dll. Full analysis: go.es.io/4tg9vw6

English

183

Andrew Pease@andythevariable·4 Nis

Bravo for releasing this. There's a reason these are successful: they spend a lot of resources to make them so. Putting this stuff out in the public is how we raise all ships.

International Cyber Digest@IntCyberDigest

‼️ The axios lead maintainer has gone public on how he was socially engineered into installing the malware behind the npm supply chain attack. We have example images showing exactly how the attack was staged.

English

244

Andrew Pease@andythevariable·4 Nis

Seeing this tool in action is fantastic, but don’t sleep on the fact that it was also released for your environment github.com/elastic/supply…

Elastic Security Labs@elasticseclabs

One of our researchers built an AI powered supply chain monitoring tool on a Friday afternoon. The following Monday night it caught the Axios npm compromise before most people knew it existed. Elastic Security Labs is open sourcing the tool. Full story by @dez_ here: go.es.io/4bOfsuq

English

187

Andrew Pease retweetledi

Samir@SBousseaden·2 Nis

New blog post - prioritizing alerts triage with higher-order detection rules elastic.co/security-labs/…

English