Discover and read the best of Twitter Threads about #AdversaryPursuit
Most recents (2)
Although #FIN10 achieved some success targeting the 🇨🇦 casino and mining industry, @FireEye hasn't discussed the actor much since the June, 2017 blog article fireeye.com/blog/threat-re…, because, well… the techniques are a bit abecedarian. (h/t thesaurus.com).
FIN10 has gone from targeting those industries, stealing PII and extorting victims for BTC, to posting particularly lame, decimal encoded phishing lures to Canadian stock market forums, directing victims to EMPIRE downloads. Decimal encoded URLs are a consistent FIN10 TTP. 
To lend some legitimacy to the phishing lures, FIN10 registers masquerade domains and establishes websites using scrapped source code from legitimate domains. #trashtics
OVERRULED: Here's our take on outmaneuvering a potentially destructive adversary fireeye.com/blog/threat-re…
We talk compromise, RULER, and links to APT33.
Infosec Twitter suggests they dropped #SHAMOON 💥
Shout-out to co-authors: @QW5kcmV3 @_gackerman_ @a_tweeter_user @WylieNewmark
We talk compromise, RULER, and links to APT33.
Infosec Twitter suggests they dropped #SHAMOON 💥
Shout-out to co-authors: @QW5kcmV3 @_gackerman_ @a_tweeter_user @WylieNewmark
If you liked this part about our threat similarity engine; I have a confession: that is CYBER #machinelearning!
Designed by @BarryV & Nalani F.
Studied & prototyped by our data scientist @secbern.
Learn more here 📺: (it's not officially called APTinder)
Designed by @BarryV & Nalani F.
Studied & prototyped by our data scientist @secbern.
Learn more here 📺: (it's not officially called APTinder)
If you like Operational Timelines, #AdversaryPursuit has you covered. We're including them in blogs because it's how we operate & it improves #threatintel sharing. Thx @QW5kcmV3
🖼️ #1: Suspected #APT33 ⏲️ fireeye.com/blog/threat-re…
🖼️ #2: Suspected #APT29 ⏲️ fireeye.com/blog/threat-re…
🖼️ #1: Suspected #APT33 ⏲️ fireeye.com/blog/threat-re…
🖼️ #2: Suspected #APT29 ⏲️ fireeye.com/blog/threat-re…
