CIRCLE WITH A DOT

@cR0w @krypt3ia Here's a refresher on #Havex
https://netresec.com/?b=14ABDA4

@cR0w @krypt3ia The Havex backdoors by Energetic Bear / Dragonfly / Crouching Yeti from 2013 were also quite significant, and very under-reported on.

@krypt3ia Great writeup! The visual chart with attacks grouped based on generation/method is also very interesting. Do the colors in the chart (red/orange/grey) represent something? Also, are the arrows in the chart to indicate the chronological order of various attacks -- or do they have some other meaning?

@sans_isc Yay, proxifier to the rescue!

Got a cool use for a tool like this? Give it a try and share your experiences [...]

Proxifier is also useful when trying to intercept and decrypt TLS traffic from a Windows Sandbox.

@bagder LOL!

The report concluded it found five “Confirmed security vulnerabilities”. I think using the term confirmed is a little amusing when the AI says it confidently by itself. Yes, the AI thinks they are confirmed, but the curl security team has a slightly different take.

Viewing #remcos alerts from FlowCarp in @ish's #EveBox
https://netresec.com/?b=2659fc0

New tool released: FlowCarp
Identifies protocols without port numbers
Build protocol detection from example traffic
️ Input: PCAP or PcapNG
️ Output: Flows and/or Alerts
https://netresec.com/?b=265d268

#FlowCarp