Isif @Isifmobile

Mandiant #AdvancedPractices analyst. Ontario, Canada Joined September 2012

Tweets

1K
Followers

430
Following

172
Likes

3K

⚛️ Marcin Siedlarz @siedlmar

3 years ago

🚨 New conference alert 🚨 Join us for RooCon, a free one-day conference on cyber threat intelligence and attribution. The conference will be held at Google's offices in Sydney, Australia on Tuesday, 21st of November 2023.

3 30 78 18K 10

View Details

Isif @Isifmobile

4 years ago

@TayaraRomero Dropping a pull on a clear, calm day.

0 0 0 0 0

View Details

Christopher Glyer @cglyer

4 years ago

Alternate hypothesis: independent developer who specializes in security impairment tools sells them to multiple actors like ELBRUS/FIN7 & DEV-0506 (Black Basta deployer) Overlap in custom packer could be explained by ELBRUS “crypting” their malware/tools sentinelone.com/labs/black-bas…

1 5 18 0 3

View Details

Isif @Isifmobile

4 years ago

@stonepwn3000

0 0 0 0 0

View Details

Isif @Isifmobile

4 years ago

Sigh.

Kieran Drew @ItsKieranDrew

4 years ago

Do you sit at a computer for longer than 6 hours a day? You’re destroying your body if so. Here’s the setup you need to protect yourself from posture problems and crippling long-term injuries: 🧵

1K 31K 134K 0 74K

0 0 3 0 0

View Details

Mandiant (part of Google Cloud) @Mandiant

4 years ago

Don't miss the next installment of the Mandiant FLARE team's webinar series, The Sample. This week, Principal Reverse Engineer Blaine Stancill will explain the inner workings of a dropper from the #WHITEDAGGER malware family. Register now! mndt.info/3UJAUGj

0 17 43 0 5

View Details

Isif @Isifmobile

4 years ago

@literallymecats

0 0 0 0 0

View Details

Isif @Isifmobile

4 years ago

@sam_micheals74 That’s where the initial access teams live.

0 0 0 0 0

View Details

Isif @Isifmobile

4 years ago

Found the source of all ransomware. Deploy the SWAT teams.

16 146 967 0 11

View Details

Isif @Isifmobile

4 years ago

@klrgrz Yes, super duper ultra high confidence as well.

1 0 2 0 0

View Details

Isif @Isifmobile

4 years ago

@BeerN_Loathing Sorry fren. Fair warning.

0 0 0 0 0

View Details

Isif @Isifmobile

4 years ago

@ImposeCost I’m Canadian so I try to be polite, but this is what I meant.

1 0 0 0 0

View Details

Isif @Isifmobile

4 years ago

And turn on logging, then look at the logs. All of them.

Steve Elovitz @SElovitz

4 years ago

When you don't yet have initial intrusion vector, avoid the temptation to assume insider/0day. Follow the evidence and prove it. "It is a capital mistake to theorize before one has data. Insensibly one begins to twist facts to suit theories, instead of theories to suit facts"

1 5 36 0 1

0 0 2 0 0

View Details

Isif @Isifmobile

4 years ago

@thinkpoison @AndrewCyberKop @nicastronaut @captainGeech42

0 0 1 0 0

View Details

Isif @Isifmobile

4 years ago

@thinkpoison Speak for yourself.

0 0 2 0 0

View Details

Isif @Isifmobile

4 years ago

@toobadulti Rhys Toogood? Nice try, you can’t just make up players.

0 0 0 0 0

View Details

Isif @Isifmobile

4 years ago

I wonder if the problem is DNS. 🤔

1 0 3 0 0

View Details

Isif @Isifmobile

4 years ago

@ChicagoCyber 😒

0 0 0 0 0

View Details

bk (Ben Koehl) @bkMSFT

4 years ago

Additional Command and Control IP's: 80.66.88[.]155 5.39.222[.]150 141.105.64[.]121 31.192.105[.]28 91.245.253[.]112 23.106.123[.]119 Timely blog @proofpoint team

Digital_Monet @aRtAGGI

4 years ago

#Phishing #Ukraine #EuropeanGovernment @Proofpoint identified compromised private military email account delivering #SunSeed Lua malware to NATO govs. XLS Macros, #Yara Sigs, & @ET_Labs sigs will be made public for the community to defend themselves! 1/3 proofpoint.com/us/blog/threat…