Demon

681 posts

Demon banner
Demon

Demon

@volrant136

Threat Researcher at @Huntio | APT Infra Hunter | CTIA | CRTO | eCTHP |

Katılım Kasım 2024
50 Takip Edilen992 Takipçiler
Demon retweetledi
Threat Insight
Threat Insight@threatinsight·
Proofpoint @threatinsight identified a targeted campaign against operations personnel at energy firms linked to projects in Pakistan. The messages were sent on 18 March 2026, and mimicked invitations to the upcoming Pakistan Energy Exhibition & Conference (PEEC). We track the activity as UNK_VaporVibes. 1/8
Threat Insight tweet media
English
1
10
19
1.6K
Demon
Demon@volrant136·
3️⃣ Stage 2 (HTML #2) loadMeetingConfig() reads URL params • Fake Download Flow: → downloadPlugin() simulates progress via setInterval() • Payload Execution Trigger: → triggerDownload() creates <a> element → Forces download via a[.click()
Demon tweet mediaDemon tweet mediaDemon tweet media
English
0
0
1
84
Demon
Demon@volrant136·
2️⃣ Stage 1 (HTML #1) – Script Analysis No real CAPTCHA validation • Fake State Transitions: → "verifying" → "success" → "redirecting" → Passes hostName + meetingType as parameters • Config Abuse: → companyName, meetingType, redirectUrl easily customizable
Demon tweet mediaDemon tweet media
English
1
0
1
114
Demon
Demon@volrant136·
🚨 Phishing Alert: Fake Zoom Meeting Campaign 🚨 🧵Tracked by @Huntio 🔗 https://zoom-meeting-video-beignet-e41432[.]netlify[.]app ⚠️Drops: 🔗https://vhbgruop[.]com/ScreenConnect.ClientSetup%20(1).exe f7cbbd02bdd87e955ea87af352656dbf cc: @500mk500
Demon tweet mediaDemon tweet media
English
2
3
18
1.5K
Demon
Demon@volrant136·
#APT #Sidewinder targeting #Pakistan NTC 🇵🇰 +1 Tracked by @Huntio https://bold-bonus-1d3b[.]malik-jaani786[.]workers[.]dev/?shfgkjdhgjkfhdgjkfhdgjkhfdjghfdghfjkd=1 Ref: x.com/volrant136/sta… x.com/volrant136/sta… cc: @500mk500 @MichalKoczwara @malwrhunterteam
Demon tweet mediaDemon tweet media
Demon@volrant136

#APT #Sidewinder targets #Pakistan National Telecom Corporation (NTC) Tracked by @Huntio https://royal-field-9144[.]girlfriendparty42[.]workers[.]dev/login.html?gfjdliotrgojnghgherbegrehureert0e0ee= Ref: x.com/volrant136/sta… cc: @500mk500 @MichalKoczwara @malwrhunterteam

English
0
5
11
1.2K
FatzQatz
FatzQatz@FatzQatz·
#SideWinder APT recently targeted a Malaysian org with a tax‑themed phishing email. The infection chain leveraged WinPTY to execute malicious PowerShell commands, delivering payloads such as TSM (RMM) and MANC.exe (non‑exhaustive list). FYI @salmanvsf
FatzQatz tweet media
English
4
21
49
3.5K
Demon
Demon@volrant136·
#APT #Sidewinder targets #Pakistan National Telecom Corporation (NTC) Tracked by @Huntio https://royal-field-9144[.]girlfriendparty42[.]workers[.]dev/login.html?gfjdliotrgojnghgherbegrehureert0e0ee= Ref: x.com/volrant136/sta… cc: @500mk500 @MichalKoczwara @malwrhunterteam
Demon tweet mediaDemon tweet mediaDemon tweet media
Demon@volrant136

#APT #Sidewinder targets #Pakistan MOFA and NTC + more https://webmail-mofa-gov-pk[.]zeabur[.]app/?Notificationsinpakmofa=1 https://mail-ntc-net-pk[.]zeabur[.]app/load/?lfdkjgiroetuiroyhgfhnbjkfsdfiowerierehjre=1 Currently down @500mk500 @MichalKoczwara @malwrhunterteam

English
0
7
19
3K
MalwareHunterTeam
MalwareHunterTeam@malwrhunterteam·
There are these totally legit sites: https://tralert[.]online/ https://tralert7[.]com/ You can be sure that the "AgilusTech LLC" (SSL Corp given cert) signed files that are coming from these sites are also very legit, totally not malicious, but especially no North Korean malware can be found in them... 😂 🤷‍♂️
MalwareHunterTeam tweet mediaMalwareHunterTeam tweet mediaMalwareHunterTeam tweet mediaMalwareHunterTeam tweet media
English
4
9
29
4.7K
Demon
Demon@volrant136·
Similar, but target #Pakistan +1 https://mail-hit-gov[.]leapcell[.]app/?uiysdjfhkwersdkjfksdajksfdewrwersdf=cGdjb29yZC1sYWhhYkBoaXQuZ292LnBr #APT #Sidewinder
English
0
3
5
463
Demon
Demon@volrant136·
Similar | #APT #Sidewinder targeting #Srilanka #Army and #Defence #sector + 1 https://dekl-dgprocur2028200-ljakefli[.]leapcell[.]dev/login/?dhsfiourewjdfjgkfdgkldfjiorejfdjgfdgjkdfjgreioo=1 Ref: x.com/volrant136/sta… cc: @500mk500 @MichalKoczwara @malwrhunterteam
Demon tweet media
Demon@volrant136

Ongoing #APT #Sidewinder Campaign targeting #Srilanka #Army and #Defence #sector 1/ Using @Huntio, I have found new exfiltration server found last 4 attacks: slservices-lk[.]com cc: @500mk500 @MichalKoczwara @malwrhunterteam

English
2
6
23
3.2K
Demon retweetledi
Sudeep_Singh
Sudeep_Singh@SinghSoodeep·
New undetected C2 server of Dropping Elephant / #Patchwork targeting defense vertical in Turkey MD5 hash of ZIP archive: f5888ae2995c5cb7142a97912f876607 MD5 hash of python312.dll: 6fe9bd8e13009349c277bc44392af386 C2 domain: muddtech[.]org pythonw.exe sideloads python312.dll which loads libvlc.log, RC4 decrypts it and executes the payload. Lure is related to Asisguard - a defence equipment manufacturer in Turkey. #threatintel #apt @ginkgo_g @malwrhunterteam @smica83
Sudeep_Singh tweet mediaSudeep_Singh tweet mediaSudeep_Singh tweet media
English
1
8
39
4.1K
Demon retweetledi
RedDrip Team
RedDrip Team@RedDrip7·
Related #APT malware (DLL written in Rust) 9a95078a7a5f1045c61fe95ab308ec3f a70e0e057bb9cc33913ca035fb3a1138 hxxps://support.cc-cvbs-sco.workers[.dev:443/api/analytics/collect hxxps://cms.bahria-edu.workers[.dev:443/api/analytics/collect
RedDrip Team tweet mediaRedDrip Team tweet media
RedDrip Team@RedDrip7

Suspected #APT #Sidewinder VBA macros in .xls downloads EXE + malicous DLL (Rust trojan). Cloudflare workers domain is abused for C2 infra. 753bb1b5d8b879f478babb21ed4d9696 (xls) f310ee836f88cc43d3939f8a88b20495 (dll) *.goldibrowhoami.workers[.dev *.desco-gov-bd.workers[.dev

English
0
11
75
5.8K
Demon
Demon@volrant136·
#APT #Sidewinder targeting #Pakistan 🇵🇰 Tracked by @Huntio https://zimbramail-nayatel[.]leapcell[.]app/login.html?gfjdliotrgojnghgherbegrehureert0e0ee=1 Ref: x.com/volrant136/sta… cc: @500mk500 @MichalKoczwara @malwrhunterteam
Demon tweet mediaDemon tweet mediaDemon tweet media
Demon@volrant136

#APT #Sidewinder Targets #Bangladesh #Navy 🇧🇩 +1 Tracked by @Huntio 🔗https://mail-ntc-net-pk-zimbra-dils-maint213-2q1ntcqz[.]leapcell[.]dev/login.html?gfjdliotrgojnghgherbegrehureert0e0ee=cGdjb29yZC1sYWhhYkBoaXQuZ292LnBr cc: @500mk500 @MichalKoczwara @malwrhunterteam

English
0
5
19
2.6K
Demon retweetledi
RedDrip Team
RedDrip Team@RedDrip7·
#APT #Bitter 3ee66f56461fc046f600230d11ebe731 (MSI) f57975b8bc1169b35ae17b975327195e (EXE) hxxps://99media.com[.]pk/scvz zoemagicbook[.]com
RedDrip Team tweet mediaRedDrip Team tweet media
HT
2
8
30
2.7K

Keşfet

@threatinsight @Huntio @500mk500 @MichalKoczwara @malwrhunterteam @FatzQatz @salmanvsf @ginkgo_g