Fmr DoD CND, Adversary Threat Hunter, Cyber Threat Intel Analyst, Gamer, Geek, Weeb, F1 & Geopolitics opinions are my own. #WeAreNAFO #FUZZYSNUGGLYDUCK 🦆
All Around U
Joined July 2010
- Tweets18.7K
- Following885
- Followers2.6K
- Likes46.8K
JP Castellanos retweeted
Just to put things right:
1/ Many read my #ARTEX signature release as "an IOC list". It isn't. The #IOCs expire within a year by design. The real release is the workflow: how to turn the next ARTEX-style attack into detections as fast as the attacker moves.
2/ ARTEX is an #LLM harness. Swap the model, prompts or infra and every IOC changes. What changes much less is how an agent behaves: machine-speed recon chains, ~1/s #PasswordSprays with rotating UAs, self-correcting API retries, systematic record enumeration.
3/ So the pack is behavior-first. Those patterns live in Sigma correlations, Sentinel KQL and Zeek SumStats on the upper network layers, not in packet filters. IPs are clearly labelled T3/T4 context for retro-hunting what already happened.
4/ The #playbook is the core: verify the source, classify how specific an indicator really is, assign a tier, route it to the right format, expire it. We applied it to four campaigns with an LLM assisting and humans gating every verification step. Next trail, same loop.
5/ That's the big picture: attackers use LLMs to compress weeks into hours. Defenders can use LLMs to compress "new report → tested detection" into hours too, as long as humans keep the verification gates. We must defend atacker's powered LLM/#AI with AI.
6/ The Zeek section shows how to carry the same behavioral logic into network sensors you already run. Playbook, rules and tests: [link]. Break them, send FP/TP reports. That's how this grows.
#BLOG: #MMD-072-2026 - #ARTEX detection signature pack - from #IOC w/#playbook : blog.malwaremustdie.org/2026…
Artex detection signature pack's repo: github.com/unixfreaxjp/malwa…
Read the playbook carefully, asses & test before apply, you can use my python scripts in /tools dir and see /tests result in github repo beforehand. Posted to inspire #block-ing this threat for defenders in FIRST(dot)oeg or xCERTs and xSIRTs. Hope helps. - @unixfreaxjp Nov,2026
JP Castellanos retweeted
Today (1) we saw another wave of SCKit compromises against ScreenConnect servers and downstream connected clients, including on-premise instances via the weak RMM+ plugin.
Also, (2) I chased "cryptobait" fake guest connections that appeared in multiple ScreenConnect servers. 🔗👇
1. huntress.com/blog/sckit-worm…
2. huntress.com/blog/fake-crypt…
JP Castellanos retweeted
ARTEX and Friends: Enter Agentic Offensive Frameworks - Google Threat Intelligence Group / @Mandiant
cloud.google.com/blog/topics…
JP Castellanos retweeted
Starshield being throttled again.
Received briefings from Minister of Defense of Ukraine Yevhenii Khmara and Commander-in-Chief of the Armed Forces of Ukraine Mykhailo Drapatyi. Unfortunately, our units have been recording significant disruptions to Starshield’s operations over the territory of Ukraine for several days now – along the entire front line and in the temporarily occupied territories of Ukraine. Specifically, systematic speed restrictions are being imposed on Starshield, limiting it to 161 kilometers per hour (100 miles per hour). The Ukrainian military have already investigated the circumstances, and these are not random errors but systematic speed restrictions. For us, this primarily means a significant complication in intercepting Russian jet-powered drones. Unfortunately, there have already been strikes that got through because our interception systems cannot reach sufficient speeds and are unable to intercept in time. Unfortunately, this is helping the Russians kill more Ukrainians and carry out more accurate strikes against Ukraine. We are trying to establish all the circumstances with the American side.
JP Castellanos retweeted
#ESETresearch has uncovered Cereal, a previously undocumented modular .NET toolset used by the Russia-aligned #Turla #APTgroup to turn victims’ Microsoft Exchange servers into stealthy long-term collection points. welivesecurity.com/en/eset-r… 1/6
JP Castellanos retweeted
Censys scan history captured ARTEX-related infrastructure 7 weeks before public reporting.
Our new blog shows why first-party Internet data, threat fingerprints, and historical scans matter for investigations, and includes queries to put them to work. bit.ly/4jeA8ze
JP Castellanos retweeted
Atrioc explains why it's idiotic to be going off on Democrats after the failed Pete Hegseth impeachment
"Everyone's saying holy F these f'n traitors..we should shame them. I'm gonna tell you you are an idiot for saying that..I promise you I don't like any of these people..even if these people showed up..it would only go from the House to the Republican controlled Senate..if by some miracle it passed the Senate..Donald Trump could appoint a new Secretary of War with the Republican controlled Congress"
"The Democratic Party is trying to not let Thomas Massie, a republican, draw them in to a guaranteed losing impeachment that goes nowhere..they're trying downplay this and wait till January..if we get to Jan..and they don't do anything, that's a bigger story"
JP Castellanos retweeted
Antifox, an ARTEX fork, ships mitmproxy on port 8788 with no auth by default. Shodan finds 42 exposed right now. The operators running these offensive AI frameworks are leaving their own intercept proxy open to anyone who looks.
JP Castellanos retweeted
Wow, this is some pretty annoying goop.
I'm certain this is APT43 a/k/a Kimsuky a/k/a Democratic People's Republic of Korea General Reconnaissance Bureau
This is an updated version of their March, 2026 GrimSource campaign. This version is heavily improved upon, improved obfuscation, and the final payload is way, way, way better.
It's got custom string hashing (actually, it's a modified Fletcher32 checksum function, but whatever), it implements the Heaven's Gate technique, and it is specifically tailored to avoid:
- csfalconservice.exe
- repmgr64.exe
- cyserver.exe
- sfc.exe (?)
- bdredline.exe
- sedservice.exe
- fshoster64.exe
- mssense.exe
Based on the presence of specific anti-malware and/or cybersecurity products, it takes different evasive actions.
I'm curious though why Breakglass Intelligence didn't discuss the final payload in their March, 2026 report, they've documented the initial stager, it's subsequent stagers, and the C2 resolutions, but it doesn't discuss the actual shellcode payload inside of the initial access file.
> be me
> get dm from friend @malwrhunterteam
> "smelly i found goop"
> wtf i love goop (malware)
> @smica83, funny sounding name man shares
> flagged as goop from north korea (maybe)
> wtf i love north korea (they dont steal monies)
> download
> look inside
> .msc file
> Microsoft Management Console file
> file thingie for sysadmins to open
> big ass fuck off obfuscated code
> wtf
> javascript encoded as html decimal thingies
> decode
> obfuscated javascript
> weird comments inside the javascript code
> comment about BangBus (porno?)
> ??? bros like BangBus ???
> does a bunch of dumb obfuscation
> eventually pulls out giant blob of data from .msc file
> look inside
> base64 encoded OLE stream
> what year is it?
> look inside OLE stream
> ocx_streamorstorage
> look inside
> 21,486 lines of obfuscated javascript
> simple bullshit tho, just embedded a bunch of goop
> base64 encoded and split up a bunch
> put back together
> fails
> oh its also compressed
> decompress
> works
> XLST with microsoft jscript executor
> ok
> XLST jscript uses a bunch of .net stuff
> .net makes another XML
> what the fuck is this fucking piece of shit
> .net reads XML it made
> eventually find 32bit position independent shellcode
> the shellcode is stored in the balls
> jk was stored in "Resource Directory:b:Array:QrJVY"
> shellcode never seen before on VirusTotal
> open shellcode in IDA PRO (thank u hexrays ily omg)
> look inside
> lots of stuff, have lots of work to do
JP Castellanos retweeted
Seinfeld AI: George also enjoys the "chinese" models 😜🇨🇳🕵️
like, repost and subscribe for more comedy seinfeld AI
JP Castellanos retweeted
We're cooked.
terminal2shell.com
JP Castellanos retweeted
Just finished the full walkthrough of my TraderTraitor infrastructure research today.
From one reported ROOFDECK C2 to 13 linked endpoints using certificates, TLS fingerprints and historical records.
Full walkthrough.
Hope you enjoy it, and happy hunting!
michalkoczwara.substack.com/…
JP Castellanos retweeted
The gift that keeps giving
Microsoft Threat Intelligence has observed threat actors using agentic AI tools to search public GitHub repositories for exposed secrets and then using stolen secrets for further malicious activity against the compromised organization. msft.it/6017aA1bS
Searching open code repositories for exposed credentials, secrets, keys, and other authentication material is a well-documented technique, but agentic tooling like ARTEX allows threat actors to scale and accelerate scanning for secrets, analyzing the output, and conducting follow-on attacks.
Microsoft has also investigated follow-on activity related to successful service principal sign-ins involving multiple application IDs, including cases where a single multitenant application credential was used across multiple tenants. The threat actor used the compromised credentials for cloud resource discovery, and credential and data exfiltration.
Microsoft encourages organizations to scan their code for secrets. In addition to removing the secrets from the code base, affected organizations should immediately rotate any exposed keys or credentials. Read our blog for more details, detections, and guidance for public monitoring and reducing exposure.
JP Castellanos retweeted
Hunting TraderTraitor Infrastructure 🇰🇵
I started with report from S1.
sentinelone.com/labs/dont-ca…
I found additional servers linked through certificate metadata, TLS fingerprints and HTTP responses.
Here is what stood out 🧵
JP Castellanos retweeted
A #ClickFix campaign pushing #RomulusLoader spans multiple sites and uses these techniques during delivery: C2 IP address as a plain integer, MSI Binary table steganography, AMSI patched in a suspended process & 10 injection techniques. More info at bit.ly/4ipR0mh
ALT The image is a flowchart illustrating the "ClickFix Campaign" by RomulusLoader. It outlines various stages of the campaign, including "Platform Lure," "ClickFix – Win+R," "Decimal IP Stager," "MSI Dropper," "AMSI Bypass," "Fileless PE Load," "VBScript PS → Delete," "Binary Table Staging," "C2 Beacon," "Persistence," "Process Injection," and "Credential Access." Each stage includes brief descriptions of the actions taken during that phase.
ALT Login page for "Romulus" with username and password fields, and a "Log in" button.
JP Castellanos retweeted
I've used @Huntio to find over 3K IPs hosting ARTEX, then I've used @GreyNoiseIO ANALYSIS:
This is how we CYBER!
#ThreatHunting #CTI #Honeypots #Discovery #Hunt
JP Castellanos retweeted
Agentic hacking frameworks are on the rise.
We tracked 2,000+ #ARTEX servers and obtained databases with full conversation logs that show exactly how the agents hacked.
It proves: Fully autonomous cybercrime is already here.
Read more 👇:
research.checkpoint.com/2026…
JP Castellanos retweeted
🛡️𝗗𝗲𝗳𝗲𝗻𝗱𝗶𝗻𝗴 𝗮𝗴𝗮𝗶𝗻𝘀𝘁 𝗔𝗥𝗧𝗘𝗫 𝗮𝗻𝗱 𝗖𝘆𝗯𝗲𝗿𝗦𝘁𝗿𝗶𝗸𝗲𝗔𝗜 🧙♂️
This query checks 𝙳𝚎𝚟𝚒𝚌𝚎𝙽𝚎𝚝𝚠𝚘𝚛𝚔𝙴𝚟𝚎𝚗𝚝𝚜 for successful inbound connections from IPs found in the 𝗔𝗥𝗧𝗘𝗫 and 𝗖𝘆𝗯𝗲𝗿𝗦𝘁𝗿𝗶𝗸𝗲𝗔𝗜 threat feeds.
A simple way to bring external threat intelligence into Advanced Hunting and look for potential hits.
KQL Detection:
detections.ai/share/rule/4aY…
Credit to Feng Xue for the ThreatBook feeds. 🙌
#ThreatHunting #KQL #MicrosoftDefender #ThreatIntelligence
