
Threat Research @ Internet #Research
Loading...
Joined July 2019
- Tweets1.2K
- Following259
- Followers3.7K
- Likes2.4K
More Panels 🤔
- nocheats[.]co 8080
- nocheat[.]lat 8080
- scan[.]lat 8080
IPs:
- 64\.188\.66\.51
- 72.56\.241\.175
HTTP + RAT = ❓→ C2: httprat[.]xyz 🔥
Found some interesting #RAT -like network activity using #websocket:
→ /ws/victim?id=...
→ /ws/screen?id=...
sandbox: tria.ge/261009-ppbh8awvct/
6d031d51ffc5e78171153a4af78ba6d327a9ae332ee432c0243ebc6e23e3188a
Anshu 🕸️ retweeted
Threat intel without context has always annoyed me.
Everybody thinks their feed is high-confidence until you ask them for more context about the infrastructure they're pushing through. They have no idea what infra they're tracking. I see this far too often... 🤦
You get an IP, domain, or hash marked as malicious, maybe with a threat actor tag attached, but very little explaining how anyone reached that conclusion.
A lot of feeds aggregate scanning results, third-party datasets, shared intelligence, and other feeds. After enough aggregation, the original evidence gets lost.
That becomes a problem when you start seeing scanned infra, honeypots, red team systems, or other noise mixed into feeds that are still being marketed as “verified” or “high confidence.”
I wanted to take a different approach with the intel we publish through Threat Hunting Labs.
Every IOC we publish is tied back to the intrusion where we actually observed it and goes through two stages of curation.
If an IP was contacted by malware, we keep the surrounding execution context:
- Which process made the connection
- The command line
- Process lineage
- Context of the malicious process (i.e., process injection, LoTL, etc.)
- Whether it was tied to persistence
and more...
That context is the important bit.
You should be able to see why an IOC was classified as malicious instead of blindly trusting a label.
Because when you have a hit, you can get context on how we have seen it used in the past so you can hunt through your logs.
From there, consuming the feed is still simple. API key, plug it into the platform you already use, and go.
If you want to dig deeper, all of the supporting context is available through the UI and API.
This is pretty much the threat intel feed I always wanted to use myself. Very proud of what we have built here.
We’ve made huge progress on the intelligence platform that sits behind Threat Hunting Labs.
The real intrusions we respond to eventually become investigations inside the platform, but along the way they also generate valuable intelligence around attacker infrastructure, malware, indicators, and TTPs.
We’ve spent the last few months improving how that intelligence is processed and delivered, based heavily on feedback from enterprise customers.
The result is a much stronger threat intel platform with:
• Fresh adversary infrastructure
• Enriched indicators and context
• Intelligence grounded in real intrusion activity
• API access designed to plug into the platform you already use
Threat intelligence feeds should not cost an arm and a leg.
Threat Hunting Labs Enterprise customers get access to our intelligence platform at no additional cost. Hands-on training and threat intelligence under one platform.
Viti: intel.threathuntinglabs.com/
Contact us: threathuntinglabs.com/contac…
Joining the CXO Speaker Lineup at VULNCON 2026 - Dhawal Shrivastava, Senior Security Assurance Engineering Lead @Microsoft
With nearly 16 years of experience across product security, cloud and AI trust, incident response, compliance, and security leadership, Dhawal Shrivastava brings a rare blend of strategic vision and hands-on expertise to the VULNCON 2026 stage.
Join us at VULNCON 2026 to gain insights from a cybersecurity leader who has spent his career turning complex security challenges into impactful business outcomes.
📍 NIMHANS Convention Centre, Bengaluru
📅 12th & 13th June, 2026
Final Chance: Last Minute Sale ends on 9th June
vulncon.in/register
#VULNCON2026 #Vulncon #CyberSecurity #RiskManagement #Governance #InfoSec #CyberResilience
Meet Scoot — the official mascot of VULNCON 2026 🐾
Curious, sharp, and always one step ahead, Scoot represents the spirit of cybersecurity research; questioning systems, exploring vulnerabilities, and pushing innovation forward.
Welcome the face of VULNCON 2026. The journey just got smarter.
And we are just starting!!
Meet him at VULNCON 2026
📍NIMHANS Convention Centre, Bengaluru
📅 12th & 13th June, 2026
Registrations are now open — secure your seat today!
vulncon.in/register
Stay Tuned. Scoot is about to make an entrance. 🐾✨
#Vulncon #VULNCON2026 #Scoot #Cybersecurity #Cybersecuritycommunity #Infosec #SecurityResearch
Anshu 🕸️ retweeted
zohomailapp[.]com
nffjf[.]info
payment-uae[.]com
sftp[.]sagargolf[.]com
job-diva[.]xyz
ceprode-ayllu[.]top
gamarjoba-ushguli[.]top
stein-uk[.]top
wsparcie-kobiet[.]xyz
pieniadze-dla-kobiet[.]xyz
dla-polek[.]xyz
loanprocessing-usa[.]top
nutritionhealthfitness[.]online
facio-uk[.]top
smarttechcomputer[.]online
e-uliker[.]top
stdalfour-us[.]top
plcdigi-al[.]xyz
safecom-us[.]top
fachanwalt-bonn[.]online
seventh-dayremnantchurch[.]xyz
grg-brevard[.]online
losangeles-breastaugmentations[.]online
ghana-carnivalclub-berlin[.]online
ad-distributorsstore[.]top
62[.]60[.]226[.]73
AS214351 Femo It Solutions Limited 🇩🇪
smb[.]sagargolf[.]com
google[.]herionhelpline[.]com
ultrafastcore[.]pro
sync[.]sagargolf[.]com
85[.]209[.]156[.]5
AS41111 Fast Geo Hosting S.r.l. 🇳🇱
sftp[.]sagargolf[.]com
info365-postova[.]com
monsuivi-mrelay[.]com
obnovitinetfilx[.]com
obnovinalog[.]com
azuriranjenetfilx[.]com
netfilxmx-renewal[.]com
netfilxobnoviti[.]com
ananeono-netfilx[.]com
neak-megujitani[.]com
netfilxrs-renewai[.]com
zse-platba[.]com
vubanka-idp[.]com
netfilxcr-renewai[.]com
bancodechile-secure[.]com
mooneyit-info[.]com
renewnetfilx[.]com
bancochile-info[.]com
netfiixpt-renewai[.]com
postova365-info[.]com
intesasp-info[.]com
suivicolis-2025[.]com
aissaleptit[.]com
renewaipi[.]com
usernet-fiokot[.]info
maltapostrack[.]com
365bank-obnovy[.]com
renew365postova[.]com
moncolis-relai[.]com
365renew[.]com
forny-sundhedskort[.]com
upsinfo-paquete[.]com
renewpostova365[.]com
zse-obnovit[.]com
idalpha-bnk[.]com
umprogrammierung-paket[.]com
mbh-renewal[.]com
usernet-renovar[.]com
obnovypostova365[.]com
myhermes-packet[.]com
obnovy365banka[.]com
usrntsg[.]com
usernet-fornya[.]com
renewai-sub[.]com
accessfiix-pak[.]com
zse-obnovy[.]com
userpost-kaz[.]com
pakfines-gov[.]com
renewflix-pak[.]com
paktracking[.]com
usernet-pak[.]com
idhblpak[.]com
payment-pkfines[.]com
bank365postova[.]com
postova365info[.]com
pakpostrack[.]info
365postovaobnovit[.]info
deliverypk-info[.]com
pkpost-fast[.]com
isporuka-info[.]com
megujitani-szamla[.]com
szallitas-informacio[.]com
rendorsegportai-fizetes[.]com
usernet-frissites[.]com
obnovypoistenca[.]com
netfilx-megujitani[.]com
213-209-150-229[.]plesk[.]page
clever-brahmagupta[.]213-209-150-229[.]plesk[.]page
213[.]209[.]150[.]229
AS2856 British Telecommunications PLC 🇩🇪
#CastleBot #GuLoader @abuse_ch
Anshu 🕸️ retweeted
#APT36 #SideCopy #Phishing #APT
[1/3]
20250731-Deferment-of-implementation-of-Rule-9-of-LPS-Rule_434_785.zip
99b2235101a9a1eb922527b1a31e9b51
737cbe4cef2f2a178b9f91d2104f7dd3
be263bee537ab60901fa1436c91ce32e
ZipModifyDate 2025:09:25
#CurlBackRAT #C2
microsoft.windowsdns[.]com
#APT36 #SideCopy #TransparentTribe
ZIP > LNK > MSI > #CurlBackRAT (Most likely)
hxxps://vetpharmaconsultant.in/js/doccs/20250731-Deferment-of-implementation-of-Rule-9-of-LPS-Rule_434_785/wins
#Phishing #APT
Anshu 🕸️ retweeted
Some threat actors are still using VBA macros:
Recent attack chain of MuddyWater
Blog link: cloudsek.com/blog/reborn-in-…
#APT #muddywater #threatintel
Recent attack chain of MuddyWater
Blog link: cloudsek.com/blog/reborn-in-…
#APT #muddywater #threatintel
Anshu 🕸️ retweeted
Super Excited to announce the release of 𝗦𝗵𝗶𝗽𝗦𝗲𝗰 𝗦𝘁𝘂𝗱𝗶𝗼 🚀
🚀 Go ahead and try at : studio.shipsec.ai
👩💻 Opensource : github.com/shipsecai/studio
Enjoyed the project? Drop a ⭐ on the repo!
𝗪𝗵𝗮𝘁 𝗶𝘀 𝗦𝗵𝗶𝗽𝗦𝗲𝗰 𝗦𝘁𝘂𝗱𝗶𝗼 ?
An OpenSource, No Code Security Automation Platform.
𝗪𝗵𝘆 𝗦𝗵𝗶𝗽𝗦𝗲𝗰 𝗦𝘁𝘂𝗱𝗶𝗼?
🎨 Visual Workflow Builder :
Design security automations with drag-and-drop, no coding required
⚡ Real-Time Execution :
Watch & debug workflows run live with streaming logs and progress indicators
🧩 Pre-Built Security Components :
Subfinder, DNSX, HTTPx, Nuclei, and more ready to use
🔒 Enterprise Reliability:
Built on Temporal for durable, resumable workflow executions
🛡️ Secure by Default :
Encrypted secrets, role-based access, and audit trails
💻 Run Anywhere :
Cloud hosted or self-hosted on your own infrastructure
📅 Scheduled Workflows :
Schedule your scans to run at specific times or intervals
🔗 Codify Your Workflows :
Trigger workflows via a simple POST request, through cURL, python etc.
Another example: activecarnpaigns[.]com
IP: 193.143.1[.]220 (AS: Proton66)
Targeting @ActiveCampaign
Registered w/ @tucows
@malwrhunterteam
Some Newly Registered Domains
activecarnpaignes[.]com
activecarnpaigns[.]com
serdgrid[.]com
salesforce-logs[.]com
converts-kits[.]com
mailerlite-logs[.]com
1 IP: 193.143.1.220
#phishing
The context : huskyscripts.blog/budget-thr…
Anshu 🕸️ retweeted
Fake Malware TOAD via Malvertizing
"SYSTEM THINK, INC" was serving ads that redirect to a Fake Malware TOAD URL.
carinteriors[.]site
cozyworkspace[.]site
fitnessgadgets[.]site
fitnessgearhub[.]site
gymora[.]site
handmadecandles[.]site
handmadejewels[.]site
naturalskincare[.]site
safetravelgear[.]site
skincarekits[.]site
smartkitchenware[.]site
womenshandbags[.]site
gjkabnguienbgjkw.blob.core[.]windows[.]net
hxxps://gjkabnguienbgjkw.blob.core.windows[.]net/$web/Wi0nHelpDigiErr0t030/index.html
Anshu 🕸️ retweeted
Vibe Hunting
nebulock.io/blog/vibe-huntin…
Anshu 🕸️ retweeted
👹 Social Engineering: threat actors post fake job offers (now impersonating the company ChainFlip) on websites such as Indeed and Glassdoor (it could be any company and any job portal, as we can see in this example: nitter.cf/1ZRR4H/status/18154622…).
🚩 "We are using Microsoft Teams Enterprise with AI Detect Bot. If you are currently using the basic Teams app, Teams Enterprise will be downloaded automatically when you join the meeting" 😏
After receiving a new application, they contact the person from the fraudulent domain chainflip[.]works, arrange an interview, and send a meeting request via Calendly, which, in addition to reaching the inbox, also allows them to include a malicious link in the body of the email.
⚠️ The malicious site requires a temporary access code, a technique used to filter victims and evade automated analysis.
* These people are not from North Korea.
Replying to @1ZRR4H @malwrhunterteam
🚩 Fake job offers used in this campaign 🇰🇵 and published on multiple web portals:
1⃣.- [LinkedIn]: "Senior blockchain developer needed" → https://www.linkedin[.]com/jobs/view/senior-blockchain-developer-needed-at-hirog-3974975235/.
2⃣.- [WellFound]: "Ecommerce Developer with Web3 Integration (3+ years exp)" → https://wellfound[.]com/jobs/3055218-ecommerce-developer-with-web3-integration.
3⃣.- [PeoplePerHour]: "I need senior blockchain developer for our online store" → https://www.peopleperhour[.]com/freelance-jobs/technology-programming/e-commerce-cms-development/i-need-senior-blockchain-developer-for-our-online-store-4235812.
4⃣.- [ZipRecruiter]: "Blockchain developer needed" → https://www.ziprecruiter[.]com/c/HiroG/Job/Blockchain-developer-needed/-in-Califon,NJ?jid=6bf13a7b9c0139d4.
5⃣.- [WayUp]: "Blockchain developer needed" → https://www.wayup[.]com/i-j-HiroG-313478541129579/.
6⃣.- [Recruiter]: Link is no longer avaible.
#DPRK














































