Drew

malware detection, hunting and gathering / threat research

Drew boosted:
Jan Wildeboer 😷:krulorange:jwildeboer@social.wildeboer.net
2024-08-06

#Oops. The #Crowdstrike crash was caused by having a function with 21 input parameters but the integration code only checked 20. This worked for a while until the fatal update used the 21st parameter for the first time and all went wrong.

"Therefore, the attempt to access the 21st value produced an out-of-bounds memory read beyond the end of the input data array and resulted in a system crash." Page 2 of crowdstrike.com/wp-content/upl

@thekileen best of luck! Should be good but agree the grammar is unsettling

@thekileen sure it’s legit?

Drew boosted:
Selena Larsonselenalarson
2024-07-03

The latest episode of Only Malware in the Building from @thecyberwire is live! In it we discuss Operation Endgame and the law enforcement strategy of trolling the criminals. Tune in wherever you get your podcasts!

thecyberwire.com/podcasts/only

Drew boosted:
Selena Larsonselenalarson
2024-06-27

New episode of DISCARDED featuring @Myrtus! We dive into Operation Endgame, the malware impacted, and what it means for the cybercrime landscape. Tune in wherever you get your podcasts!
Apple: podcasts.apple.com/us/podcast/
Spotify: open.spotify.com/episode/3AuQ0
Spreaker: spreaker.com/episode/checkmate

Drew boosted:
2024-06-22

Published my first blog post today detailing a LummaStealer infection chain - take a look at 0x1c.zip/0001-lummastealer/

Drew boosted:
2024-06-10

New video: Why antivirus software detects cracks as malware or PUP 🦔📹

#MalwareAnalysisForHedgehogs #cracks #antivirus
youtube.com/watch?v=KA7R9rt5r4

@GossiTheDog thanks for the visual

Drew boosted:
2024-06-08

A company paid a ransomware group.. then had their info leaked by the same ransomware group anyway. Not isolated at all, eg UnitedHealthcare paid $20m and then got extorted again by the same person.

Stop paying ransomware groups. You are directly funding serious organised crime. bleepingcomputer.com/news/secu

Drew boosted:
Selena Larsonselenalarson
2024-06-04

For the late crowd: check out my new podcast with my friends at @thecyberwire

Only Malware in the Building!

thecyberwire.com/podcasts/only

@bittner @selenalarson Loved the new ‘Only Malware in the Building’ podcast I listened to today! Great concept and a nice way to learn more about these threats. Can’t wait for the next one!

podcasts.apple.com/us/podcast/

Drew boosted:
Selena Larsonselenalarson
2024-05-30
Drew boosted:
abuse.ch :verified:abuse_ch@ioc.exchange
2024-05-30

We are proud to announce that we assisted the joint international law enforcement operation #OperationEndgame, targeting the notorious botnets #IcedID, #Smokeloader, #SystemBC and #Pikabot 🔥

abuse.ch has provided key infrastructure to LEA and internal partners to disrupt these botnet operations 🛑

More information on the operation is available here:
👉 operation-endgame.com/

Drew boosted:
2024-05-30

Huge cybercrime news here. Authorities say "Operation Endgame" has disrupted six types of botnets/loaders/cybercrime infrastructure: IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot. To put this into context, these malware programs are some of the most common ones that end up infecting machines at businesses, schools, governments and health care organisations. They can steal login credentials from infected machines, and then they're often used to install other malware, such as ransomware. They're distributed on an industrial scale by long-known crime gangs in spam and via other means, causing economic loss, data breaches and much more. Four people were arrested, 100 servers were taken down and 2,000 domains were seized. Additionally, Troy Hunt writes that some 16.5M email addresses and 13.5M unique passwords that were stolen by these malware applications have now been loaded into Have I Been Pwned. This is a really important facet, as it means users who are registered with HIPB will get notified if their email is in the malware data. Intel 471 will be monitoring. #infosec
europol.europa.eu/media-press/

Drew boosted:
The Spamhaus Projectspamhaus@infosec.exchange
2024-05-30

🚨#IcedID, #Smokeloader, #SystemBC, #Pikabot and #Bumblebee botnets have been disrupted by Operation Endgame!! This is the largest operation EVER against botnets involved with ransomware, with gargantuan thanks to a coordinated effort led by international agencies 👏👏

As with the #Qakbot and #Emotet takedowns, Spamhaus are again providing remediation support - those affected will be contacted from today with steps to take.

👉 For more information, read our write-up here: spamhaus.org/resource-hub/malw

#OperationENDGAME

Drew boosted:
2024-05-24

Sweet new category in the NahamCon2024 CTF: challenges on Machine Learning! Call it AI or ML or whatever, but call upon the oracle for @kkevsterrr 's "Feeling Tense" challenge at #NahamCon2024 CTF: jh.live/nahamcon-ctf (5/23-5/25)

Drew boosted:
2024-05-23

NAHAMCON 2024 CTF STARTING IN THREE HOURS
GET IN HERE
jh.live/nahamcon-ctf

@wdormann what a disaster…

Client Info

Server: https://mastodon.social
Version: 2025.04
Repository: https://github.com/cyevgeniy/lmst