The goal of the blog (Soul instead of Shell) is to understand constraints that force payload decisions and how they can help us detect/hunt.
 Every payload has a soul - and understanding it makes us better hunters.

medium.com/@cyb3r-hawk/...

Recent #Xworm infections (esp. during tax season) follow a pattern:
mshta.exe → Scheduled Tasks → IEX execution.

#ThreatHunting #DetectionEngineering #MalwareAnalysis #DefenseEvasion

Lumma Stealer is one of, if not the dominant, infostealer with a diverse distribution ecosystem from GitHub, Telegram, and multiple others. In this blog, we will look at distribution channels, credential sellers, and locations where logs are sold.

medium.com/@cyb3r-hawk/...

My next post is live. In this one, we will build upon our previous theoretical introduction of the LAYER approach and see its practical implementation using BlackBasta chatleaks - specifically related to "bypassing EDR."
#cybersecurity #threathunting #thrunting #THORcollective

I had fun writing this. See how treating "bypass" as a single technique creates blind spots in our hunting. We will continue this with a practical example using Blackbasta leaks
#infosec #threathunting #thrunting #blueteam #threatdetection #THORcollective

A ransomware strain ("SuperBlack") by actor "Mora_001" is currently targeting two recent Fortinet zero-day vulnerabilities (CVE-2024-55591 and CVE-2025-24472). I investigated multiple intrusions between January and March, and most of them have a similar attack chain.
Read it at lnkd.in/g5fefgbq

Glad to have been featured in the Cyber Focus podcast for allowing me to comment on our 2024 Threat Roundup report. we discussed Key findings, Threats to critical infrastructure, OT security risks, and Threat hunting frameworks and cyber resilience
Check it out:
youtu.be/ndOpYFiabbc?...

Amatera Stealer:
Following the trend of infostealers, while a recent campaign of AMOS stealer targeted macOS users (lnkd.in/gD8Da4mv), a new Windows-focused stealer called Amatera was observed during my recent intrusion analysis.
#Amatera #infoStealer #windows #telegram #crypto #cyber #security

Wrote something on Atomic infostealers latest attempt to infect Mac users through cloned brew site and malicious curl command. medium.com/@cyb3r-hawk/...

#macos #Atomic #infostealer #MachO #brew #SEO #google #ads #telegram #google #Chromium #crypto #wallet #cyber #security #site #impersonation

For some folks, Threat hunting research might lack a structured approach, leading to scattered and inefficient processes. This lack of structure hinders building upon previous hunts and scaling the threat hunting process effectively.
#ThreatHunting #Research #Cybersecurity
medium.com/p/90e020ffcf...

Had fun writing on Chaya_003, targeting engineering workstations. It evolved from a process-killing executable analysis to an interesting investigation. The blend of technical, geopolitical, and IT-OT aspects made it even more interesting
lnkd.in/g55hiBcP

#ICS #engineering #workstations #Discord

Not every anomaly is malicious. In the post, I go over how to define success criteria and how you can embrace "false positives" when performing threat-hunting. I used user-agents analysis as an example to try and drive it home. open.substack.com/pub/cyb3rsec...

#threathunting

In my latest blog post, I showed how to use user-agent analysis in threat-hunting to spot suspicious patterns and unauthorized software using environmental knowledge and known-normal
open.substack.com/pub/cyb3rsec...

#ThreatHunting #Detection #Engineering #User #agent #analysis

SonicWall released an advisory on December 4th, SNWLID-2024-0018, that affects several SMA 100 Series devices. These devices include 500v, SMA 200, 210, 400, and 410 models running versions 10.2.1.13-72sv and earlier.

#CVE #SonicWall #SMA100 #ThreatIntel #SSL #VPN #vulnerabilities

📢 Published: Threat Hunting Black Basta QR Phising: Microsoft Teams Edition
It discusses threat-hunting in Microsoft Teams for social engineering techniques used by BlackBasta actors. Will go over hunting queries using Microsoft 365 logs to detect anomalous patterns.
www.linkedin.com/pulse/threat...