Exposing a Sample Portfolio of Scareware Themed Screenshots - An Analysis

Dear blog readers,

I've decided to share with everyone a portfolio of known scareware themed photos with the idea to raise awareness on what used to be the primary monetization vector within the cybercrime ecosystem circa 2010.

An image is worth a thousand words.

Sample screenshots include:

Stay tuned!

Continue reading →

My Old Twitter Account - Sample Twitter Background Collages Circa 2010 - An Analysis

Dear blog readers,

I wanted to take the time and effort and elaborate more on my old Twitter account circa 2010 in terms of what really happened and how I managed to accumulate approximately 11,000 followers on Twitter in less than three months prior to announcing that I'm joining Twitter on my personal blog.

Also for the record - users interested in obtaining access to my old Twitter account for research and reference purposes including to actually go through it can grab a copy of it from here.

Sample collages which I produced back then for my Twitter background in a typical cybercrime research fashion which I hope that you'll enjoy include:

I wanted to say big thanks to everyone who used to follow me on Twitter back then including everyone who's following me on Twitter up to present day.

Stay tuned!

Continue reading →

Yanluowang's Ransomware Group's Internal Communications Leaked by Russian Threat Actors - An Analysis

Yanluowang's ransomware group has recently had their internal communications leak online prompting various researcher into looking into them and analyzing them. The breach of the gang's internal communications happened courtesy of Russian threat actors who also defaced and left a message on their front page.

The leak's initiative has also released various source code in terms of the decryption tool for the ransomware including the source code of the builder.

Sample screenshots include:

The recent communication leaks are similar to the Conti leaks which I extensively data mined and profiled here.

Related actionable intelligence on the C&C server infrastructure:

hxxp://mtololo.com - 81.19.72.59

hxxp://matrix.mtololo.com - 62.113.100.124

Related domains known to have been involved in the campaign:

hxxp://api.views-24.ru

hxxp://lohicageeg.beget.app

hxxp://fr124.aha.ru

hxxp://aktiver-id.fun

hxxp://aktiver-bankid.website

hxxp://matrix.mtololo.com

Stay tuned!

Continue reading →