When Lily from Human Resources develops BIOS code in her spare time.
Pinned Tweet
23
471
1,676
Follow
Click to Follow craiu
Costin Raiu
@craiu
Romanian antihacker from another planet; chief paleontologist; director of Global Research and Analysis Team at . Tweets are my own. #chess #taekwondo
Costin Raiu’s Tweets
#100DaysofYARA in checking out some Mac malwares, a few reference keys with brackets around them - lets check for a few for potential keyloggers!
github.com/100DaysofYARA/
2
14
Thinking of a career in Reverse Engineering? Don't miss this RE101 Training Walkthrough with on Feb 16:
1
13
26
A threat intel firm hacking a .ru drug market to divert cash to Ukrainian efforts.
holdsecurity.com/news/2023/01/s
Motive aside, this is still a very dodgy approach to take.
5
24
45
Show this thread
🚨 New research alert!
Mandiant has observed a new espionage operation targeting #Ukraine. We suspect this activity is being conducted by the Russian #cyberespionage group, Turla Team. Read the blog to learn more. ⬇️
47
80
NYT's opinion page gets in under the wire in the competition for Worst Take of 2022: Signal is bad because the people who build it are morally committed to preserving the privacy of its users.
57
360
1,436
LABScon Replay: A Look at Chinese Vulnerability Discovery and Disclosure <-- by
This talk covers the discovery of a CNVD that is not listed on the US NVD, and the larger picture behind the discovery and disclosure of vulns in China.
1
10
22
Show this thread
As the number of new #Azov #Ransomware-related samples is still growing and has already exceeded several thousands, we took a deep dive into its internal workings and technical features, revealing it not being a Skidsware but an advanced Polymorphic Wiper.
4
51
94
Show this thread
Takeaways of the war in Ukraine for the cybersecurity community: securelist.com/reassessing-cy
I contributed to this article along with and . As with any analysis piece, there's some deal of personal opinion in there, so I'm very interested in other assessments.
25
52
Patch patch patch!
Quote Tweet
CVE-2022-42475 0-day RCE affecting Fortinet appliances, exploited in the wild: bleepingcomputer.com/news/security/
Show this thread
2
5
"Fortinet quietly fixed the bug on November 28th in FortiOS 7.2.3 (other versions released earlier) without releasing any information about it being exploited as a zero-day."
2
2
Show this thread
Some network IOCs from the official advisory: 188.34.130[.]40:444
103.131.189[.]143:30080,30081,30443,20443
192.36.119[.]61:8443,444
172.247.168[.]153:8033
1
4
4
Show this thread
CVE-2022-42475 0-day RCE affecting Fortinet appliances, exploited in the wild:
3
23
49
Show this thread
Some PLAY ransomware C2s:
- onemusicllc[.]com
- ateliernow[.]com
- realmacnow[.]com
3
10
31
Worried about the Xnspy stalkerware? Check your network logs for connections to xiz4me[.]com. Full set of indicators added to the mobiletrackers list on Github.
2
10
18
Show this thread
APT Cloud Atlas: Unbroken Threat
20
40
Join , Mauro Vignati and Vladimir Radunović for our latest webinar. They'll discuss:
✔️ Did the cyberwar take place - why or why not?
What key events in 2022 shall we as the international community study?
✔️ What can we expect in 2023?
More: kas.pr/m83f
8
13
On Dec 14, we organize a webinar to study the cybersecurity aspects of the war in Ukraine: kas.pr/56gv
In particular, , and will discuss the nature of cyberwar.
Also watch out for the upcoming paper, which I helped write!
2
7
27
STORY OF THE YEAR? Concluding #2022 with great experts #GReAT to discuss key cyber events & reflect on what the international community needs to focus on in 2023 for #cyberstability.
Join us at kas.pr/56gv
8
8
If you're into reverse engineering, this will rock your world:
Quote Tweet
I wrote an IDA plugin that queries #ChatGPT and explains decompiled functions. It's still very bleeding edge, but you can find the code here and try it out:
github.com/JusticeRage/Ge
(Yes, the video was performed on a very basic case for simplicity's sake.)
Show this thread
0:10
50.7K views
2
12
67
Heh regarding point 2.
4
5
12
Show this thread
Step 1: open a binary in IDA and press F5
Step 2: paste the decompiled code into OpenAI's chatbot
Someone's job just got way easier.
70
1,068
4,803
Show this thread
Back in my day...
453
1,602
24.5K
Don't miss this #Ghidra hands-on reverse engineering bootcamp with master : xtraining.kaspersky.com/bootcamps/reve
7
17
This is an important development for the security of cyberspace, kudos to the ICRC team for putting it together:
Quote Tweet
Cyber operations are a reality of armed conflict and can cause real harm.
We are proposing a digital emblem that would signal protection for digital infrastructure of medical facilities and identify the Red Cross/Crescent Movement in cyberspace.
How would it work?
Show this thread
1:53
8.4K views
2
14
25
Check out our quick follow-up on research on UNC4034 apt cluster who distribute their malware in a form of job offers from a big tech companies.
blog.virustotal.com/2022/11/not-dr
16
44
Istanbul, October 2022
1
35
“hacked messages are also believed to have included highly sensitive discussions with senior international foreign ministers about the war in Ukraine.” Obvious question is why was she using personal phone for top-secret conversations?
56
655
1,496
Show this thread
If 41 lines of code can bypass the authentication process on the administrative interface of FortiGate firewalls, FortiProxy web proxies, and FortiSwitch Manager (FSWM) on-premise management instances, then something is very wrong.
This is not acceptable
read image description
ALT
51
453
1,725
Show this thread
Technical analysis of CVE-2022-40684 a critical authentication bypass vulnerability in Fortinet FortiOS (firewall) FortiProxy (web proxy), and FortiSwitch Manager products now available on attackerkb.com/topics/QWOxGIK H/T #cybersecurity #infsoec
19
14
Rumour is spreading that #Lufthansa has #banned #airtags from checked baggage
= is this rumour correct?
= are AirTags banned from your flights?
= thank you 😊
12
26
111
What's in your top 10?😉
11
1
15
Show this thread
9. AcidBox from PaloAlto (Kaspersky name: MagicScroll) -
1
2
14
Show this thread
