Ctrl-Alt-Intel

63 posts

Ctrl-Alt-Intel banner
Ctrl-Alt-Intel

Ctrl-Alt-Intel

@ctrlaltintel

Threat Research

Katılım Mart 2026
19 Takip Edilen592 Takipçiler
Sabitlenmiş Tweet
Ctrl-Alt-Intel
Ctrl-Alt-Intel@ctrlaltintel·
Over 7 a month period, a Qilin affiliate exposed 5 C2 servers -> OPSEC L -> Sliver C2 / SOCKS running on WatchGuard devices -> Initial access primarily via WG/Fortinet exploitation -> 3 real victims found via Qilin blog -> 🇺🇸 & 🇩🇪 targeting -> 7+ CVEs used Link to blog below👇
Ctrl-Alt-Intel tweet mediaCtrl-Alt-Intel tweet media
English
4
17
59
5.5K
Ctrl-Alt-Intel
Ctrl-Alt-Intel@ctrlaltintel·
Panel was previously hosted on 38.]127.8.48 which is now down
Ctrl-Alt-Intel tweet mediaCtrl-Alt-Intel tweet media
English
0
1
5
154
Ctrl-Alt-Intel
Ctrl-Alt-Intel@ctrlaltintel·
In April, our team found a vibe-coded dashboard guessing FedEx tracking numbers. With 4M+ records and 498 proxies, the scale was impressive, though the adversary's goal remains unknown. Any idea what the adversary was trying to accomplish?
Ctrl-Alt-Intel tweet media
English
3
6
15
855
Ctrl-Alt-Intel
Ctrl-Alt-Intel@ctrlaltintel·
Links to our blogs are getting blocked :(
Ctrl-Alt-Intel tweet media
English
1
3
12
700
Ctrl-Alt-Intel
Ctrl-Alt-Intel@ctrlaltintel·
Ctrl-Alt-Intel has exposed a threat actor leveraging CPanel/CVE-2026-41940 to: - Target Government/Military entities in South-East Asia - Target a small set of MSPs / hosting providers Separately, they exploited novel vulnerabilities against a SEA defense sector victim and:
Ctrl-Alt-Intel tweet mediaCtrl-Alt-Intel tweet media
English
4
20
113
12.7K
Ctrl-Alt-Intel
Ctrl-Alt-Intel@ctrlaltintel·
When a Qilin affiliate makes many big #oopsies over 7 months... not knowing they are silently being tracked by us🤩 Ctrl-Alt-Intel blog coming later this week🤪
GIF
English
1
6
42
1.8K
Ctrl-Alt-Intel
Ctrl-Alt-Intel@ctrlaltintel·
The watchTowr PoC is a simple exploitation verifier This threat actor has took it further to: -> Auto-identify cPanel owner -> Creates a cPanel user session -> Deploy webshell to "/public_html/wp-cache.php"
Ctrl-Alt-Intel tweet mediaCtrl-Alt-Intel tweet media
English
0
0
7
476
Ctrl-Alt-Intel
Ctrl-Alt-Intel@ctrlaltintel·
⚠️Targeted cPanel/WHM CVE-2026-41940 exploitation seen in the wild 🇧🇩 Bangladesh education sector targeted 154.18.187[.239 hXXp://windowsupdate[.sh:18888/sub_shell.py This appears to build upon & weaponise the POC provided by watchTowr - github.com/watchtowrlabs/… (1/n)
English
1
5
23
1.7K
Ctrl-Alt-Intel
Ctrl-Alt-Intel@ctrlaltintel·
⚠️The @TGIFridays (tgifridays.com) website is compromised (for at least over a month) 🚨 Attempting to load malicious ClickFix lure -> potential KongTuke campaign (per Abuse.ch) Cloudflare is blocking atm. Anyone have security contacts @TGIFridays?
Ctrl-Alt-Intel tweet mediaCtrl-Alt-Intel tweet mediaCtrl-Alt-Intel tweet media
English
4
12
42
4.2K
Ctrl-Alt-Intel
Ctrl-Alt-Intel@ctrlaltintel·
@TGIFridays "Compromised for at least over a month" -> This incorrect, I don't know what month I'm in From at least 9th April -> today (22nd April)
GIF
English
0
0
4
420
Ctrl-Alt-Intel
Ctrl-Alt-Intel@ctrlaltintel·
Ctrl-Alt-Intel analysis on this whole campaign coming today. We have had access to the TAs C2. 4k+ commands recovered. We will break down: -> How they are deploying malicious Wordpress plugins -> Botnets being deployed by this threat actor -> Other MaaS this TA is attacking
English
0
2
11
755