#Emotet E5 Update - Within the last several hours, we have seen some bots on the Epoch 5 botnet begin to drop SystemBC now as a module and execute it. This is the first drop beyond Cobalt Strike that we have seen since Emotet returned. This is a significant change 1/x

https://nitter.pussthecat.org/Cryptolaemus1/status/1502069552246575105

via Twitter

#emotet
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Privacy and the Future of the Internet

The Internet is at a critical juncture. As it has been for the past decade or so, those who care about privacy and social morality are (practically) barred from participation in interest-based "focus groups", because most of them are still on Facebook, Twitter, YouTube and other anti-social networks. Even websites that have nothing to do with these networks have forgone self-management of user accounts in favor of "social logins," which are only useful until Facebook blocks your account and you realize you're now blocked from everything, and the only customer support available is provided by bots who were programmed to fix nothing and provide no information.

Government-provided services around the world are becoming more and more difficult to receive without installing apps spyware on your smartphone. Search engines grow more and more unusable every day, and our ability to self-govern is being taken away by money-hungry startups and corporations who are looking to "make the world a better place." Finally, the Internet as a whole is now nothing more than a shopping mall, where visitors implicitly consent to being searched.

https://ido50.net/rants/privacy-and-the-future-of-the-internet

#privacy #internet
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Ukraine On Fire

Ukraine. Across its eastern border is Russia and to its west-Europe. For centuries, it has been at the center of a tug-of-war between powers seeking to control its rich lands and access to the Black Sea. 2014's Maidan Massacre triggered a bloody uprising that ousted president Viktor Yanukovych and painted Russia as the perpetrator by Western media. But was it?

💡 One or the other may wonder why this movie was posted here in this Channel. Well, the last few days did show that the war between Russia and Ukraine is also a major threat to security/privacy/democracy in the global - but especially in the Russian Net.

#cyberwar #war #security #privacy #democracy #ukraine #russia #usa
🎥@cRyPtHoN_INFOSEC_FR
🎥@cRyPtHoN_INFOSEC_EN
🎥@cRyPtHoN_INFOSEC_DE
🎥@BlackBox_Archiv

Real names and pseudonyms of leading Conti members

An actor on Exploit and XSS criminal forums just shared a list of real names and aliases that allegedly belong to top Conti members

Andrey Yuryevich Zhuykov -> "Defender"
Maksim Khaliullin -> "Kagas", "maxfax"
Eduard Mizurov -> "modar"
Dimitriy Kornev -> "mustang"
Mikhail Zlydnev -> "sitev"
Andrey Maximov -> "untouch"
Sergey Gorko -> "Salamandra"
Sergey Guryev -> "Stakan"
Maksim Rudenskiy -> "silver", "buza"
Maksim Galochkin -> "Bentley", "volhvb"

https://nitter.pussthecat.org/y_advintel/status/1502348645877833736

via Twitter

#cyberwar #conti #ransomware #leak
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Telegram Trilateration

Telegram Finally listened!

It took them over a YEAR to realize their mistake but they FINALLY lowered the accuracy of the "People Nearby" function. Or it might be that the huge sudden outburst of negativity from Russian and Ukrainian media has finally made them come to senses ¯\_(ツ)_/¯

Either way, when you run the function now, you will only see results of 500m, 1km, 2km, etc. I have little faith left in Telegram when it comes to privacy and taking issues seriously. This repository will stay online, but be adviced that none of the data collection methods in here will work as expected.

https://github.com/jkctech/Telegram-Trilateration

💡 Read as well:
https://nitter.pussthecat.org/JKCTech/status/1489712467248926728

via Twitter

#telegram #peoplenearby
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Exclusive: U.S. spy agency probes sabotage of satellite internet during Russian invasion, sources say

March 11 (Reuters) - Western intelligence agencies are investigating a cyberattack by unidentified hackers that disrupted broadband satellite internet access in Ukraine coinciding with Russia's invasion, according to three people with direct knowledge of the incident.

Analysts for the U.S. National Security Agency, French government cybersecurity organization ANSSI, and Ukrainian intelligence are assessing whether the remote sabotage of a satellite internet provider's service was the work of Russian-state backed hackers preparing the battlefield by attempting to sever communications.

The digital blitz on the satellite service began on Feb. 24 between 5 a.m. and 9 a.m., just as Russian forces started going in and firing missiles, striking major Ukrainian cities including the capital, Kyiv.

The consequences are still being investigated but satellite modems belonging to tens of thousands of customers in Europe were knocked offline, according to an official of U.S. telecommunications firm Viasat, which owns the affected network.

https://www.reuters.com/world/europe/exclusive-us-spy-agency-probes-sabotage-satellite-internet-during-russian-2022-03-11/

#russia #ukraine #sabotage #satellite #internet #cyberwar
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

MongoDB is terminating Russian accounts

Makes you wonder how your IT may look like if other IaaS, PaaS and SaaS providers will decide to shut you down. What if AWS decided to shut down your account? How business critical is your reliance on the cloud?

https://nitter.pussthecat.org/brodtoleg/status/1502587827783098371

via Twitter

#mongodb #russia #usa #sanctions
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

LibRedirect

A web extension that redirects YouTube, Twitter, Instagram... requests to alternative privacy friendly frontends and backends.

Youtube => Piped, Invidious, Piped-Material, FreeTube, Yattee
YoutubeMusic => Beatbump
Twitter => Nitter
Instagram => Bibliogram
TikTok => ProxiTok
Imgur => Rimgo
Reddit => Libreddit, Teddit, Old Reddit
Pixiv => pixiv萌え
Search => SearX, Whoogle
Translate => SimplyTranslate, LingvaTranslate
Maps => OpenStreetMap, FacilMap
Wikipedia => Wikiless
Medium => Scribe
Send Files => Send

💡 Note: It will be using random instances by default. You can also add custom instances.

https://github.com/libredirect/libredirect

#libredirect
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Shenzhen, a major manufacturing and distribution hub in China just announced FULL LOCKDOWN!! RIP US SUPPLY CHAIN…

https://nitter.pussthecat.org/kingkong9888/status/1502990424968814595

via Twitter

#china #shenzhen #lockdown #supplychain
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

We Are In The First Open Source Intelligence War

A thesis I cannot prove but I believe: We are witnessing the world’s first war where open source intelligence is providing more actionable insights than classified sources.

Tiktok provided direct evidence of the nature of troop and equipment movements. Commercial imagery showed field deployment locations, field hospitals, then proof of movement to invade. Dating apps provided indications of which military units are being deployed. Twitter gave a platform for highly skilled deeply experienced open source analysts to provide insights. And cloud connected smartphones with a wide range of capabilities throughout Ukraine gave direct tactical insights into how the war was and is being prosecuted. Open source analysts are listening into and translating military communications. Cybersecurity analysts and cyber threat intelligence companies are sharing indicators of incidents faster than ever and before any tipping and queuing by government sources. Historians with great context on culture and history are more rapidly collaborating and sharing relevant insights. And much of this is supported by new tools and applications and collaborative environments for individuals and non government groups.

All of this means, I believe, that this is the world’s first war where open source intelligence is the dominate source.

https://www.oodaloop.com/archive/2022/03/13/we-are-in-the-first-open-source-intelligence-war/

#opensource #intelligence #war
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

The story of REvil: From origin to beyond

Guest Jon DiMaggio, Chief Security Strategist at Analyst1, joins Dave Bittner to discuss his team's research "A History of REvil" that chronicles the rise and fall of REvil. The REvil gang is an organized criminal enterprise based primarily out of Russia that runs a Ransomware as a Service (RaaS) operation.

The core members of the gang reside and operate out of Russia. REvil leverages hackers for hire, known as affiliates, to conduct the breach, steal victim data, delete backups, and infect victim systems with ransomware for a share of the profits.

https://thecyberwire.com/podcasts/research-saturday/223/notes

#cyberwire #revil #podcast
🎙@cRyPtHoN_INFOSEC_FR
🎙@cRyPtHoN_INFOSEC_EN
🎙@cRyPtHoN_INFOSEC_DE
🎙@BlackBox_Archiv

Discontinuation of the Vanced project

Vanced has been discontinued. In the coming days, the download links will be taken down. The Discord server, telegram chat and subreddit will stay for the time being. We know this is not something you wanted to hear, but it's something we need to do. We want to thank you all for the support over the years.


Edit: On a side note, the existing installation will continue to work.

https://t.iss.one/Vanced/197

#vanced
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

This is a damn trap ..... ^^

#amazon #justforfun
🎥@cRyPtHoN_INFOSEC_FR
🎥@cRyPtHoN_INFOSEC_EN
🎥@cRyPtHoN_INFOSEC_DE
🎥@BlackBox_Archiv

Telegram Nearby Map

Telegram Nearby Map uses OpenStreetMap and the official Telegram library to find the position of nearby users.

Every 25 seconds all nearby users will be received with TDLib from Telegram. This includes the distance of every nearby user to "my" location. With three distances from three different points, it is possible to calculate the position of the nearby user.

This only finds Telegram users which have activated the nearby feature. Per default it is deactivated.

https://github.com/tejado/telegram-nearby-map

💡 Read as well:
Telegram Trilateration

#telegram #peoplenearby #map
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Google collecting vast amounts of personal data via call, text apps, Trinity study finds

Google plans to make changes to its Messages and Dialer apps after Trinity College Dublin researchers pointed to privacy concerns on Android phones.

The US tech giant assured Trinity researchers that it would make the changes after a study led by Professor Doug Leith revealed how the two apps funnel vast amounts of user data to Google.

The apps, which are used for calls and text messages, send information including phone numbers, time stamps and call duration to Google every time two phones communicate.

Dialer and Messages also tell Google when users view an app screen, have a conversation over text message or search their contacts, allowing Google to get a picture of consumers’ app usage over time.

The data is tagged with the handset Android ID, which is linked to the handset’s Google user account.

There is no opt-out from the data collection.

The apps are pre-installed on more than one billion Android phones, according to Google, with three major US networks recently announcing they will use the Google Messages app.

“I was surprised to see such obviously sensitive data being collected by these Google apps. It’s not at all clear what the data is being used for and the lack of an opt-out is extremely concerning,” said Professor Leith.

https://www.independent.ie/business/world/google-collecting-vast-amounts-of-personal-data-via-call-text-apps-trinity-study-finds-41444394.html

#google #DeleteGoogle #privacy #call #text #apps
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

What Data Do The Google Dialer and Messages Apps On Android Send to Google?

https://www.scss.tcd.ie/doug.leith/privacyofdialerandsmsapps.pdf

💡 Read as well:
Google collecting vast amounts of personal data via call, text apps, Trinity study finds

#google #DeleteGoogle #privacy #call #text #apps #pdf
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Elon Musk challenges Vladimir Putin to a duel. The stake is Ukraine !!

https://nitter.pussthecat.org/elonmusk/status/1503327421839417344

via Twitter

#elonmusk #putin #ukraine
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

LeakTheAnalyst gang has announced "UK's Ministry of Defence" on the victim list

https://nitter.pussthecat.org/darktracer_int/status/1503378378555940864

via Twitter

#LeakTheAnalyst #uk
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

The German BSI warns against the use of Kaspersky antivirus products

The Federal Office for Information Security (BSI) warns against the use of antivirus software from the Russian manufacturer Kaspersky in accordance with §7 of the BSI Act. The BSI recommends replacing applications from Kaspersky's portfolio of antivirus software with alternative products.

Anti-virus software, including the associated real-time cloud services, has extensive system permissions and must maintain a permanent, encrypted and unauditable connection to the manufacturer's servers for system-related reasons (at least for updates). Therefore, trust in a manufacturer's reliability and self-protection, as well as its authentic ability to act, is critical to the secure use of such systems. If there are doubts about the manufacturer's reliability, antivirus software poses a particular risk to an IT infrastructure that is to be protected.

The actions of military and/or intelligence forces in Russia, as well as the threats made by the Russian side against the EU, NATO and the Federal Republic of Germany in the course of the current armed conflict, are associated with a considerable risk of a successful IT attack. A Russian IT manufacturer may itself carry out offensive operations, be forced to attack target systems against its will, or itself be spied upon as a victim of a cyber operation without its knowledge, or be misused as a tool for attacks against its own customers.

All users of antivirus software can be affected by such operations. Companies and public authorities with special security interests and operators of critical infrastructures are particularly at risk. They have the option of seeking advice from the BSI or the relevant constitutional protection authorities.

https://www.bsi.bund.de/DE/Service-Navi/Presse/Pressemitteilungen/Presse2022/220315_Kaspersky-Warnung.html

#bsi #germany #kaspersky #warning
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

BIG sabotage: Famous npm package deletes files to protest Ukraine war

This week, the developer of the popular npm package 'node-ipc' released sabotaged versions of the library in protest of the ongoing Russo-Ukrainian War.

This month, the developer behind the popular npm package 'node-ipc' released sabotaged versions of the library in protest of the ongoing Russo-Ukrainian War.

Newer versions of the 'node-ipc' package began deleting all data and overwriting all files on developer's machines, in addition to creating new text files with "peace" messages.

With over a million weekly downloads, 'node-ipc' is a prominent package used by major libraries like Vue.js CLI.

Protestware: Ukraine's ongoing crisis bleeds into open source

Select versions (10.1.1 and 10.1.2) of the massively popular 'node-ipc' package were caught containing malicious code that would overwrite or delete arbitrary files on a system for users based in Russia and Belarus. These versions are tracked under CVE-2022-23812.

On March 8th, developer Brandon Nozaki Miller, aka 'RIAEvangelist' released open source software packages called peacenotwar and oneday-test on both npm and GitHub.

The packages appear to have been originally created by the developer as a means of peaceful protest, as they mainly add a "message of peace" on the Desktop of any user installing the packages.

"This code serves as a non-destructive example of why controlling your node modules is important," explains RIAEvangelist.

"It also serves as a non-violent protest against Russia's aggression that threatens the world right now."

But, chaos unfolded when select npm versions of the famous 'node-ipc' library—also maintained by RIAEvangelist, were seen launching a destructive payload to all data and overwrite all files of users installing the package.

https://www.bleepingcomputer.com/news/security/big-sabotage-famous-npm-package-deletes-files-to-protest-ukraine-war/

#RIAEvangelist #npm #opensource #russia #ukraine #warning
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Release: Transneft (79 GB)

Emails from the world's largest pipeline company, Russia's Transneft or Транснефть, which is included in recent US and EU sanctions' lists.

We are releasing 79 gigabytes of emails from the OMEGA Company, the R&D department of Russia's state-controlled pipeline company, Transneft / Транснефть. Transneft is the world's largest oil pipeline company. The emails cover the account's most recent activity, including after the introduction of American sanctions on February 25, 2022. . Some of the emails reflect some of the effects of those sanctions. On March 15, the European Union also announced new sanctions for Transneft.

https://ddosecrets.substack.com/p/release-transneft-79-gb

💡 Download: (Torrent)
https://ddosecrets.com/wiki/Transneft

#russia #ddosecrets #leak #transneft #omega
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv