Ben

🚨Recent MuddyWater APT campaign, linked to Iranian intelligence, exposed by Ctrl-Alt-Intel 😬 - 10+ CVEs used - Custom-developed C2s - EtherHiding malware - Sensitive data stolen ctrlaltintel.com/threat%20resea… Super fun collab-ing with @ice_wzl_cyber to get this published 🔥

Full analysis & writeup here: ctrlaltintel.com/research/VoidB…

9 McNuggets & a McChicken burger helped us link a Russian hacker to 🇷🇺 government😅 Denis Obrezko was put on the international wanted listed by Russia, following an FBI arrest in Phuket last November. Our independent investigation shows Obrezko has closes ties to the Moscow👇

kb.cert.org/vuls/id/213560 I can confirm this also exists in an another Tenda router. This one is more of an enterprise offering, the G300. Firmware download: tendacn.com/us/material/sh… Thanks Tenda for not stripping your binaries :) @ctrlaltintel @rootsecdev

Attribution Matters. Impose Cost: Angelo Martino, 41, of Land O’Lakes, Florida, formerly employed as a ransomware negotiator, was sentenced today to 70 months for his role in conspiring with Blackcat/ALPHV (BlackCat) actors to extort multiple victims, as well as conspiring with other former cybersecurity professionals to attack additional victims in 2023. justice.gov/opa/pr/florida…

Hunting for C2 #OPSEC failures w. @Huntio: VShell edition 🧵 Context: - VShell is a Chinese-developed CS alternative - VShell is developed on the NPS codebase - Often used by Chinese APT groups, but also seen in the wider cybercrime ecosystem (1/8)

If you have spare change, I mean literal spare change, money you can genuinely afford to part with, I'd appreciate a donation. If not, like and follow and boost my work. That helps just as much. This post is very much a last resort and I appreciate any support given. Thank you for reading this far. Genuinely. linkedin.com/in/foilman gofundme.com/f/jason-needs-…

Squats, Backdoors, ClickFix and Blockchain. As part of a Have I Been Squatted & @ctrlaltintel researcher traced a typosquatted domain through a ClickFix lure, persistent macOS backdoor, and blockchain-based command-and-control infrastructure. haveibeensquatted.com/blog/from-typo…

One of our researchers has published a blog for @beensquatted exposing an ongoing macOS stealer & backdoor campaign 🔥 Originating from typosquatted domains, a threat actor is using ClickFix lures to deliver a persistent macOS loader hat hosts C2 using Polygon smart contracts👇

There are so many people who deserve their roses but rarely get them. It would literally be impossible to name them all. But here are just some of the many, many people who stood by me. If your name isn't here, don't think I don't appreciate you. Here's just one of each of their many attributes: @khanjicyber: a guide and a beacon of hope @notbrvnd0n: always there with steady support @loop0420: never fails to check in on me @rickcsong: a big business guy who still makes time to call and check in @NetAskari: always sending me cool cyber stuff @nattyfried: like an older brother to me @Crimeonadime: selfless to the core @AidanOsint: someone I owe a genuine thank you @abdo_mhanni: genuine through and through @IntCyberDigest: forgiving and empathetic Now rapid fire: @Alph4betSoup, @IntelOpsV3, @0x686967, @polygonben, @urharmless, @kimmydotzip, @dutch_osintguy, @BashBunny, @NotNordgaren, @Harrris0n, @maybeitsjayy And to Kirwin, thank you. And to the rest, I simply don't have enough chars to type. And last but certainly not least, the most important of all, my Mum. Who has handled all the messy paperwork. Who has sleepless nights from the trauma of the crash. Who came in even when I was stinky, smelly, and vomiting. Who spent as much as she could afford trying to make me eat when my stomach wasn't working. Who fights for me when I am too weak to fight for myself. And to the rest of my friends and family, thank you.

@foilmanhacks Thank you man ❤️ Never forget the words from the Lifesaver: “Don’t bend to the mental strain … against all odds we must strive for essential gain” You don’t realize how much you’ve done to keep me sane 🫶

Thrilled to announce our (@spontiroli & me) from @Acronis TRU Team, new & in-depth research, where we saw Mustang Panda targeting India's Hydropower Sector, government sector and many more, using implants which we call as SHARDLOADER v1.0, v1.1, MINIRECON, ZOHOMURK. We worked with Indian Computer Emergency Response Team, @IndianCERT on data-sharing and multiple other purposes leading to disruption of a live campaign, which had been targeting Philippines as well. While, we had been already tracking the first campaign, we saw a second campaign using @Zoho as a C2(exfil mechanism) widely adopted across Indian Government. Another interesting feature, which we found that the threat actor went slightly offensive causing issues inside the analyst's VMs, while leaving a bunch of OPSEC issues inside the implants and using similar launcher binaries. Read our research here: The implant was also seen and reported by @smica83 🐐& thanks to @IndianCERT on working with us to disrupt the ongoing and live campaigns.

Possible MINIRECON implant used to target India🇮🇳 FileName: Letter to His Excellency the President[.]zip SHA-256: 6c8784885506b0fa3b0543be3c5caec1a4b3c689331d1012847505c61440b2be

This isn't secret, it's not a weapon either... the kid was fucking stupid and used a machine to do crime in config that is insanely stupid (if we consider they probably didn't want to get caught) they used edge in its default config, hey had opted in to telemerty. The takes online and articles like this are fucking ridiclous

I dumped NetNut's frontend source code for their global and Chinese portals. Anyone can now see how it worked internally. They claim to be ethical and to not route through real people's devices, their schema tells a different story. (Source code link at the end)

#Mandarin-speaking threat actor is targeting Vietnam by impersonating the Vietnam Government's Tax Public Service Portal to distribute a malicious Fake eTaxMobile APK vn-dichvucong[.com 398db8ea60f9249bf902bb10e21de621 @malwrhunterteam @skocherhan @smica83 #Vietnam #Malware

The OPSWAT Academy Cyber Challenge 2026 @OPSWATAcademy #cyber #ctf #London

Another banger dammmm open.spotify.com/track/6pvd8OBn… @foilmanhacks <3

I never post about music, but I’ve always been a big hip-hop head @foilmanhacks recommend this banger, first time hearing it. It homes hard n helped me reflect ❤️ open.spotify.com/track/1fotoYON…

𝗛𝘂𝗻𝘁 𝟯.𝟬 𝗶𝘀 𝗹𝗶𝘃𝗲. 𝗣𝘂𝗹𝗹 𝘁𝗵𝗲 𝘁𝗵𝗿𝗲𝗮𝗱. 🚀 Most threat hunting tools stop at the lookup. You get a result, maybe a tag, and then you're on your own figuring out what connects to what. We built v3 to fix that. Every indicator, whether it's an IP, a domain, or a hash, should open into the full picture automatically. 👉 Here's what's new: hunt.io/blog/introduci… → 60+ API endpoints across C2, AttackCapture, Vulnerability Intel, SQL, and more → Remote MCP server, connect Claude or other AI tools straight to Hunt data → Cloudflare Buster turns one domain into a full infrastructure cluster → Passive DNS History gives you a real timeline of DNS changes, not just a point-in-time snapshot → Attack Reports turns exposed attacker directories into structured campaign reports, tied to specific IPs, IOCs, and CVEs → Exploit Capture indexes 54,000+ AI-classified files staged in attacker open directories right now → Provider Radar now includes Registrar intelligence, catching domain provisioning patterns before those domains go live in an attack → Flattened data architecture so HuntSQL joins are finally possible, no workarounds → And much more! And the best part: you get 14 days free, no credit card needed. Open an account and start hunting today 👇 portal.hunt.io/sign-up