box turtle

Github knew for hours, they delayed telling you and they wont be honest in the future. what an amazing run, its been an honor to play around with the cats over the past few months. #teamPCP #github

@hasanbroked @intelkink @FBI Im not involved in you and caspers beef, not sure why he brought me up anyway... even so, you dont have anything on me because no one i work with has anything on me

@xploitrsturtle2 @intelkink @FBI I think it is better for both of us not to talk about things here - if you want to contact me, go ahead

https://breached[.]st/threads/hello-breachforums.86013/ Site is launched.

@hasanbroked @intelkink @FBI you posted incorrect information on my group bro XD

@xploitrsturtle2 @intelkink @FBI I could be doing alot more

@hasanbroked @intelkink @FBI we've been being hunted for months, what do you think this flash is doing?

@intelkink @xploitrsturtle2 cuckadoo look at this peon over here talking to me still after a @FBI flash on him and his entire group

Tell me your friends ill tell you your future

@nahamike01 no

A new competitor to TeamPCP & PCPJack? An open directory hosted at 38.174.216[.]194 exposed 'Cloud AI Infrastructure Attack Framework' (CAI): a centralized botnet targeting Docker/Kubernetes/Redis/Ray Dashboards, etc. for credential theft and cryptomining. CAI explicitly seeks out and kills TeamPCP and PCPJack processes, to further monopolize on compromised targets. Pivoting on an SSH key comment (41832@CAI) embedded in cai_config.py, uncovered two additional nodes: 95.182.96[.]223 - recently identified by @Yusufcancakiir , and 120.26.46[.]187 first observed by @Huntio AttackCapture on 15 June. This was a single operator across three IPs, using two different Monero wallets, both of which see daily activity. The scripts on 95.182.96[.]223 are heavily inspired by the actors behind the cloud worm, using code comments like "PCPJack-aligned." 38.174.216[.]194 serves as a staging server, while 38.174.218[.]65:666 is the C2 endpoint. This may be worth monitoring as additional threat actors seek to monetize on this type of activity.

@DoomsdayGoth @kernelstub its ok bro, just stick to it and you will learn something that will impress people eventually. everyone starts somewhere

@xploitrsturtle2 @kernelstub You are correct, I’m a beginner and tried to make something for fun and people are treating me like I’m stupid for doing this.

@kernelstub @DoomsdayGoth i just ignored it maybe they are super beginner and trying to make stuff

@DoomsdayGoth @xploitrsturtle2 They taking the piss?

@ret2src @0x64616e no

Escalating from On-prem to Entra through MITM Attacks My colleague @0x64616e just published his latest research on lateral movement between on-premises Active Directory and Entra through DNS hijacking. Check it out: ➡️ securitylog.sva.de/2026/offsec/es…

@computerphile dwayne get the fk out of my comment section

@xploitrsturtle2 couldnt agree more

hacktivism will again be the next revolution if law makers continue stomping on the autonomy of their people with laws that pretend to help their citizens but only exist to surveil.

@scuba356255 @FBICyberDiv nah

@FBICyberDiv R Dese Da Ass Holes What Attacked Da AUR ??

The FBI has issued a FLASH on the cybercriminal group TeamPCP, which has carried out large-scale software supply chain compromises by targeting widely used developers and security tools. The group has infiltrated victim environments and extracted sensitive data, including cloud access tokens, SSH keys, and Kubernetes secrets. TeamPCP has also engaged in extortion and collaboration with cyber actors from other threat actor groups, publishing victim names on a public leak site and threatening to release stolen data. Read the FLASH for more on TeamPCP’s tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and recommendations to protect your organization: ic3.gov/CSA/2026/26070…

@johnboggans17 @FBICyberDiv wtf are you saying

@FBICyberDiv also they do humiliation tactics so girls on onlyfans or do porn again they see everything thats on your device so they put out photos and videos off people

amazing username

And the people wonder why we do what we do in retaliation.

lol

@MosheTov my tail is quite small.

Please give me a heads up :( We're not a big corp, we're drowning with work, and the research team that's been on your tail for the past few months has only two researchers (including me!)

still alive

@MosheTov i hope you guys dont catch the next in dev supply chain X)

@xploitrsturtle2 You keep on trying till you run out of cake ;) youtu.be/Y6ljFaKRTrI?si…

Your call stacks suck. Trollstackspoofing is the new meta