Black Lotus Labs

@BlackLotusLabs

The official Threat Research and Operations arm of . Providing to both help protect our customers and keep the internet clean.

Global
centurylink.com/business/secur…
Vrijeme pridruživanja: prosinac 2018.
14 fotografija ili videozapisa Fotografije i videozapisi

Tweetovi

Blokirali ste korisnika/cu @BlackLotusLabs

Jeste li sigurni da želite vidjeti te tweetove? Time nećete deblokirati korisnika/cu @BlackLotusLabs

  1. Prikvačeni tweet
    28. velj 2019.

    Welcome to the feed of the official threat research and operations arm of , . Here we will share on , as well as observations on the tools, techniques and procedures of bad actors.

    1 reply 11 proslijeđenih tweetova 22 korisnika označavaju da im se sviđa
    Poništi
  2. 8. stu 2019.

    We’ve identified a new downloader that large numbers of bots are connecting to: 212.8.242[.]104. shows malware downloads since 9/7. This confirms our analysis of the transition from the old downloader, 138.128.150[.]133 in early Sept.

    7 proslijeđenih tweetova 18 korisnika označava da im se sviđa
    Poništi
  3. 8. stu 2019.

    We’re investigating a large increase in bots connecting to the C2s starting on 11/1. This could represent a new campaign by the malware authors.

    7 proslijeđenih tweetova 11 korisnika označava da im se sviđa
    Poništi
  4. 8. lis 2019.

    After news of the takedown of KV Solutions BV, we saw a significant decrease in the number of active & C2s. Less than a day later, we identified several new C2s potentially signifying actors moving to new infrastructure across many different hosting providers.

    5 proslijeđenih tweetova 11 korisnika označava da im se sviđa
    Poništi
  5. 4. lis 2019.

    If you didn’t know, your SSL VPN may be leaking credentials, and advanced actors are hunting for them. Check out our mitigation recommendations for CVE-2018-13379 here: .

    10 proslijeđenih tweetova 15 korisnika označava da im se sviđa
    Poništi
  6. 16. ruj 2019.

    21/25 winners have been able to say to a limited edition prize back in our . Only 4 Remain!

    2 proslijeđena tweeta 2 korisnika označavaju da im se sviđa
    Poništi
  7. 13. ruj 2019.

    Keep crackin' for limited edition swag! 15/25 winners down the right answer in our . Only 10 Remain!

    1 reply 4 proslijeđena tweeta 8 korisnika označava da im se sviđa
    Poništi
  8. 13. ruj 2019.

    Have you the 2019 Threat Report for reading yet? Do it right now to understand how we identify 130K+ DGAs daily.

    2 proslijeđena tweeta 6 korisnika označava da im se sviđa
    Poništi
  9. 12. ruj 2019.

    Do you notice anything interesting about our threat report cover? The first 25 to crack a cipher win limited edition swag. DM decrypted answers (the key doesn’t count 😊).

    1 reply 12 proslijeđenih tweetova 22 korisnika označavaju da im se sviđa
    Poništi
  10. 12. ruj 2019.

    We know you’ve for the 2019 Threat Report. So here you go: . Let the games begin.

    11 proslijeđenih tweetova 13 korisnika označava da im se sviđa
    Poništi
  11. 11. ruj 2019.

    BOLO for our 2019 Threat Report...

    2 proslijeđena tweeta 8 korisnika označava da im se sviđa
    Poništi
  12. 9. ruj 2019.

    Muhstik may have added Webmin to its list of exploits. We identified several IPs trying to exploit on our honeypots communicating w/ 159.89.156[.]190. This IP hosts 3 domains related to . We flagged 25 IPs communicating w/ this IP & scanning port 10000

    4 proslijeđena tweeta 12 korisnika označava da im se sviđa
    Poništi
  13. 5. ruj 2019.

    We’ve been tracking malware that makes use of DNS tunneling for communications between infected devices and C2s, including . Read more:

    6 proslijeđenih tweetova 12 korisnika označava da im se sviđa
    Poništi
  14. 22. kol 2019.

    is back online and here is the active C2 list we have validated and are tracking as of now

    63 proslijeđena tweeta 92 korisnika označavaju da im se sviđa
    Poništi
  15. 20. kol 2019.

    Researching activity into RCE (CVE-2019-15107) we are seeing anomalous traffic on port 10000 beginning 5 days ago. With over 14K of the IPs scanning being reported via we are still investigating the impact. If you want to collaborate with us please DM.

    6 proslijeđenih tweetova 10 korisnika označava da im se sviđa
    Poništi
  16. 19. kol 2019.

    Continued monitoring for scanners targeting on TCP port 8728 reveals a roughly a 45% decrease in scanning activity from its peak in mid-July. Maybe patching is effective! Thanks research team for sharing your work!

    6 proslijeđenih tweetova 11 korisnika označava da im se sviđa
    Poništi
  17. 31. srp 2019.

    Starting on July 2nd, we began seeing a large increase in scanning on TCP port 8728. This could be related to the following CVE:

    4 proslijeđena tweeta 9 korisnika označava da im se sviđa
    Poništi
  18. 18. lip 2019.

    Today we shared new details around the shifts in C2 structure we've seen in both networks. They are using infected endpoints as another layer of hierarchy. These Bot C2s have accounted for 80% of C2s in 2019. You can read more here -

    1 reply 16 proslijeđenih tweetova 33 korisnika označavaju da im se sviđa
    Poništi
  19. 22. svi 2019.

    Scanning activity from an IoT DDoS C2 typically signifies the actor is beginning to build a new botnet. variants using the name “Miori” date as far back as the end of 2017 and have been known to add exploits for propagation purposes.

    10 proslijeđenih tweetova 9 korisnika označava da im se sviđa
    Poništi
  20. 22. svi 2019.

    We recently identified an updated version of ( variant) using several different XOR encodings with important identifiers removed. The C2 IP, 185.244.25[.]83, was identified by our algorithms as a scanner of port 443 and 23 starting several weeks prior.

    5 proslijeđenih tweetova 6 korisnika označava da im se sviđa
    Poništi
  21. proslijedio/la je Tweet
    23. tra 2019.

    Rockin my swag on the way to the gym. The threat of the treadmill is real.

    1 proslijeđeni tweet 16 korisnika označava da im se sviđa
    Poništi

@BlackLotusLabs još nije objavio nijedan Tweet.

Čini se da učitavanje traje već neko vrijeme.

Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.

    Možda bi vam se svidjelo i ovo:

    ·