Picture

Florian Roth @cyb3rops

Head of Research @nextronsystems #DFIR #YARA #Sigma | detection engineer | creator of @thor_scanner, Aurora, Sigma, LOKI, YARA-Forge | always busy ⌚️🐇 linktr.ee/cyb3rops Frankfurt, Germany Joined June 2013
  • Tweets
    32K
  • Followers
    179K
  • Following
    2K
  • Likes
    168K
Florian Roth retweeted
therealshodan Profile Picture

丂卄ㄖᗪ卂几 - 👋 crack fingers @therealshodan

a day ago

code[.]microsoft[.]com became pretty interesting to the community over the weekend. Blog post about what we use it for and what we’ve been seeing. Crucially why it had to say goodbye. techcommunity.microsoft.com/t5/microsoft-s…

Florian Roth retweeted
4A4133 Profile Picture

John Althouse @4A4133

3 days ago

Here's a full IP list to check against your ASA/Flow logs for the ArcaneDoor Cisco ASA Compromises (361 IPs): drive.google.com/file/d/1wlKPuM… This list was put together from information in the Talos Intelligence blog which stated that the actor came from ASA devices but with cert…

Florian Roth retweeted
JumpsecLabs Profile Picture

Jumpsec Labs @JumpsecLabs

2 days ago

🚨 Tool Release 🚨 We've just open-sourced our #automation scripts for setting up #vulnerable #Azure environments to practice #cloud red teaming. It's basically free to run and has hints to help you along your journey if needed 💪 #AHHHZURE github.com/gladstomych/AH…

Florian Roth retweeted
frack113 Profile Picture

frack113 @frack113

2 days ago

Hi, pySigma 0.11.5 is out 🥳 Release is github.com/SigmaHQ/pySigm…, lot of new features. Now you can use regex the casesensitive like the very old sigmac👻, here my pipeline github.com/frack113/pySig… It's going to be hard to stay and find arguments to stay with sigmac in production.☺️

Florian Roth retweeted
UK_Daniel_Card Profile Picture

mRr3b00t @UK_Daniel_Card

2 days ago

How vulnerable is the UK to cyber attack? A really easy question to write... A much harder question to answer....

Florian Roth retweeted
SecurityAura Profile Picture

Aura @SecurityAura

2 days ago

*looking at my latest IR notes AdFind.exe Netscan.exe Rclone.exe Get creds from veeam.ps1 Exposed RDP with weak domain Administrator account AnyDesk, ScreenConnect, PDQ, etc. Yup. We're still not quite there yet. Maybe in another 6 months or so.

SecurityAura Profile Picture

Aura @SecurityAura

6 months ago

*looking at my latest IR notes AdFind.exe Netscan.exe Rclone.exe Get creds from veeam.ps1 Exposed RDP with weak domain Administrator account AnyDesk, ScreenConnect, PDQ, etc. Yup. We're still not quite there yet. Maybe in another 6 months or so.

Florian Roth retweeted
birchb0y Profile Picture

alden @birchb0y

3 days ago

my first blog post since starting at @HuntressLabs just dropped! 🔥 @stuartjash and I take a look at the recently discovered macOS #LightSpy variant and highlight some of the major differences between it and the iOS version!🍎 huntress.com/blog/lightspy-…

Florian Roth retweeted
WhichbufferArda Profile Picture

Arda Büyükkaya @WhichbufferArda

3 days ago

Pivoting possible Volt Typhoon 🇨🇳 infrastructure Each of the infrastructure is using: SSL Certifacte C=en, ST=rg, L=df, O=vb, OU=ty, CN=jdyfj nginx 1.20.1 and redirect to google 2[.]58[.]15[.]30 66[.]85[.]27[.]190 45[.]32[.]174[.]131 cc @DrunkBinary @TomHegel @BushidoToken

Florian Roth retweeted
Gi7w0rm Profile Picture

Gi7w0rm @Gi7w0rm

3 days ago

Seems @sekoia_io sinkholed a #PlugX C2 and observed around 100.000 devices from 127 countries connecting. Good job on this investigation 👍 blog.sekoia.io/unplugging-plu…

Florian Roth retweeted
MDSecLabs Profile Picture

MDSec @MDSecLabs

3 days ago

New post on the blog… Exploiting CVE-2024-21111 : Local Privilege Escalation in Oracle VirtualBox by @filip_dragovic mdsec.co.uk/2024/04/cve-20…

Florian Roth retweeted
HackingLZ Profile Picture

Justin Elze @HackingLZ

3 days ago

Well that is fun x.com/h4x0r_dz/statu…

h4x0r_dz Profile Picture

H4x0r.DZ🇩🇿 @h4x0r_dz

3 days ago

Well that is fun x.com/h4x0r_dz/statu… https://t.co/5Iw1dIExwT

Florian Roth retweeted
rpargman Profile Picture

[email protected] - Stand with 🇺🇦 @rpargman

3 days ago

“Have you ever started reverse engineering a malware sample written in Nim and thought that life might not be worth living?” github.com/eset/nimfilt Take this.

cyb3rops Profile Picture

Florian Roth @cyb3rops

3 days ago

Check out the reports on the ArcaneDoor campaign & the implants found in Cisco ASA devices This is definitely the biggest story of the month for me! Talos blog.talosintelligence.com/arcanedoor-new… NCSC ncsc.gov.uk/static-assets/… ncsc.gov.uk/static-assets/… Canadian Centre for Cyber Security…

Florian Roth retweeted
wdormann Profile Picture

Will Dormann @wdormann

4 days ago

I get the impression that VPN endpoints are kind of important. Attackers are exploiting Cisco ASA devices in the wild. Cisco has fixed CVE-2024-20353 and CVE-2024-20359, but they have yet to discover the initial entry point vulnerability. 😬 blog.talosintelligence.com/arcanedoor-new…

Florian Roth retweeted
domchell Profile Picture

Dominic Chell 👻 @domchell

3 days ago

The Talos and @NCSC write-ups on arcane door are very good and worth a read, the troubling bit is the lack of details around the initial execution vector... Not sure enough noise is being made about this... ncsc.gov.uk/static-assets/… blog.talosintelligence.com/arcanedoor-new…

cyb3rops Profile Picture

Florian Roth @cyb3rops

3 days ago

When I look at this table, the first thing I see is that size matters more I reckon users prefer being told: „use a password with at least 10 letters“ instead of „use at least 8 characters, lower and upper case letters, numbers and symbols“ hivesystems.com/blog/are-your-…

cyb3rops Profile Picture

Florian Roth @cyb3rops

4 days ago

Still the best IT security conference in Germany. There was FIRSTCTI in April and OffensiveCon is in May, but both are in Berlin and I avoid Berlin like the plague. TROOPERS takes place in the beautiful Heidelberg.

WEareTROOPERS Profile Picture

TROOPERS Conference @WEareTROOPERS

6 days ago

Still the best IT security conference in Germany. There was FIRSTCTI in April and OffensiveCon is in May, but both are in Berlin and I avoid Berlin like the plague. TROOPERS takes place in the beautiful Heidelberg.

Florian Roth retweeted
BushidoToken Profile Picture

Will @BushidoToken

4 days ago

🇷🇺 A Moscow resident was arrested for developing and selling malware via Telegram. The FSB reportedly tracked down the suspect through a website they used to advertise the malware. web.archive.org/web/2024041913… h/t @campuscodi & Risky Biz News

Florian Roth retweeted
kienbigmummy Profile Picture

m4n0w4r @kienbigmummy

4 days ago

✍️🇻🇳 My quick note how to decrypt strings and configuration of #Qakbot #Qbot version 5.0 kienmanowar.wordpress.com/2024/04/24/qui…

Trends for United States

Good Sunday
1.199 posts
#SundayMorning
6.726 posts
#TexasHockey
5.459 posts
#SundayVibes
6.326 posts
#Wordle1044
WYATT JOHNSTON
3.096 posts
Colin Jost
25,9 B posts
No. Twitter
1,32 Mn posts
Mike Perry
3.189 posts
$DEYE
1.920 posts
#VegasBorn
3.099 posts
Oklahoma
65 B posts
Sick New World
5.284 posts
Lakers in 7
23,6 B posts
BKFC
7.036 posts
Darby
4.484 posts
FaZe
41,1 B posts
GO STARS
6.613 posts
Mustard
5.959 posts
Stolas
27,8 B posts

You might like

The largest collection of malware source code, samples, and papers on the internet. Password: infected
vx-underground
@vxunderground
291K Followers
LetsDefend is a hands-on Blue Team training platform that enables people to gain practical experience by investigating real cyber attacks inside a simulated SOC
LetsDefend
@LetsDefendIO
89K Followers
Head of Threat & Vulnerability Mgmt @ Henkel AG & Co. KGaA https://t.co/NC1orlKrW3
Nicolas Krassas
@Dinosn
122K Followers
House of Pentesters Follow us: https://t.co/Y6XOlSOA92
Hacking Articles
@hackinarticles
224K Followers
Official MHT Twitter account. Check out ID Ransomware (created by @demonslay335). More photos & gifs, less malware.
MalwareHunterTeam
@malwrhunterteam
219K Followers
Breaking cybersecurity and technology news, guides, and tutorials that help you get the most from your computer. DMs are open, so send us those tips!
BleepingComputer
@BleepinComputer
212K Followers
Part of @CISAgov, we respond to major incidents, analyze threats, and exchange critical cybersecurity information with partners around the world.
CISA Cyber
@CISACyber
258K Followers
Pentester, Forensic investigator, and former college professor. Trained hackers at every branch of US military and intelligence. Visit me at https://t.co/G478wufszw
OccupytheWeb
@three_cube
219K Followers
MITRE ATT&CK® - A knowledge base for describing the behavior of adversaries. Replying/Following/Re-tweeting ≠ endorsement.
ATT&CK
@MITREattack
103K Followers
hacker, researcher & founder @xintraorg ⚔️
✞ inversecos🩸
@inversecos
66K Followers
Hacker. Cybersecurity Researcher @HuntressLabs || https://t.co/qUeDM3lSCl
John Hammond
@_JohnHammond
239K Followers
Real Intrusions by Real Attackers, the Truth Behind the Intrusion. Services: https://t.co/XW613EKt2w
The DFIR Report
@TheDFIRReport
53K Followers
We make learning web hacking and security easier. Online systems, code review, videos & courses that can be used to understand, test and exploit bugs!
PentesterLab
@PentesterLab
153K Followers
Empowering IT Security Professionals through Hands-On Online Courses.
Ptrace Security GmbH
@ptracesecurity
53K Followers
Alone we survive, together we prosper. Are you with me? https://t.co/AfnDsVhqqA
The XSS Rat - Uncle R..
@theXSSrat
128K Followers