CyberRaiju

How do you submit a pull request to a malware author?🤔 Celestial Stealer is checking for my name or online handle and it won't execute if it's found, but my RE machine is using the name Barry so this check will fail. Who do I reach out to about this? 😅 www.trellix.com/blogs/resear...

Give me your best captions! So far I have: "I guess the last driver crashed" and... "10 minutes into nmap and chill, and she gives you this look"

Threat actors are impersonating real recruiters and sending bulk, tailored phishing emails by using ChatGPT, your public LinkedIn profiles, and a tool known as blinq. More details: www.jaiminton.com/internal-blo...

Episode 4 of Breach Log is now out! In this episode I'm joined by Cameron Cottam who tells his story about responding to a critical alert at 2am. Enjoy. Spotify: open.spotify.com/episode/26Lr... Other Providers: creators.spotify.com/pod/profile/...

Episode 3 of Breach Log is now available! Whether you're heading into the weekend or beginning your Friday, I hope you can carve out a mere 20 minutes to enjoy another story from the vault of detecting and responding to hacks around the world. open.spotify.com/episode/7MY3...

If you've worked in Detection Engineering, Threat Hunting, Incident Response, or an adjacent field, or have been impacted by a breach and have a story to tell, get in contact I'd love to hear it and have you on the podcast. Details on the about page. creators.spotify.com/pod/profile/...

Episode 2 of Breach Log is now available! Special thanks to Max Margolis for joining me and telling his story. If you have a story you'd like to share, get in contact and we can have some fun! breachlogpodcast [@] gmail[.]com open.spotify.com/episode/4SDz...

Our new research is now live, and it's full of juicy insights. From a log poisoning vulnerability, to an RMM you've likely never heard of, and a list of victim locations that span the globe! 👀 👇

As of Thurs Aug 14th we're seeing clear indications that a threat actor has now weaponised and is exploiting vulnerabilities in Axis camera software (CVE-2025-30023/4/5/6) which was presented at DEFCON. Indicators on Xitter/LinkedIn www.linkedin.com/posts/activi... x.com/CyberRaiju/s...

I've been thinking a lot about recent layoffs, AI advancements, and what it means for this industry as a whole. Hopefully at least some of this resonates with others and hits the mark. www.jaiminton.com/internal-blo...

New video released 🎉: Once again looking at malware sent over Discord, but this time we can analyse it statically after performing AES decryption. You may also see reference in the video to some stealers which have since shutdown or rebranded 😎 Enjoy! www.youtube.com/watch?v=knu0...

Are you interested in Generative AI and 💉 Prompt Injection techniques? I've just released a short video exploring the Main Gandalf challenge by Lakera AI and how you can convince 🧙‍♂️ to give you his secrets through specifically crafted prompts. Enjoy! www.youtube.com/watch?v=pQ5K...

Just released 🎉 In classic copycat form, now we have real CAPTCHAs protecting fake installers that use the ClickFix 'WIN + R technique'🤦‍♂️. New video released where I fail a legitimate CAPTCHA multiple times while searching for malware 😂 youtu.be/LrOJBiWOHbE

I took a look at a new malware loader which uses steganography within WAV 🌊 files to deliver its payload on an endpoint. Enjoy! www.youtube.com/watch?v=NiNI...

Termite had access to Genea for 2 weeks through their Citrix environment before exfiltrating 900gb+ of patient records to Digital Ocean. This is an org that helps couples have a family. 🤬😡 www.genea.com.au/pages/import... www.genea.com.au/sfsites/c/cm...

I frequently get asked is "what skills do I need need to excel as an analyst", so I figure this is a good opportunity to shed some light on what analysis is, and why certifications alone won't make you a good analyst. www.jaiminton.com/high-impact-...

This is really big at the moment and you should absolutely be looking at your M365 logs to identify this activity. www.speartip.com/fasthttp-use... We're observing a large number of IPs involved after successful authentication, but a common IP is 113.23.43[.]76

I made a windows #DFIR artifacts collection MindMap, it's tough to fit everything into a readable overview (might change later)

This threat actor has started using @github.com to host the PowerShell downloaders making it fairly trivial to find accounts hosting a copy of Vidar Stealer. Some have low, and some have high VT hits. www.virustotal.com/gui/file/f9d... www.virustotal.com/gui/file/847...

This. Multiple criticals on our end also. If you think ransomware actors weren't sitting on access waiting until Christmas Eve to strike then you're mistaken. Holidays are prime time for ransomware gangs who would love to give you a ransom message for Christmas in the hope 2025 lands them some $$$

Sure sex is good, but have you ever stopped an environment from being ransomed on Christmas Eve?

👀 The domain saaadnesss[.]shop registered a month ago used to track infected victims in a Fake Captcha /ClickFix/Clearfake campaign is now already being seen as one of the top 1 million domains as a result of being served from compromised websites. urlscan.io/search/#saaa...

It's Dec 2024 and there's a new Telerik deserialisation vulnerability. www.cve.org/CVERecord?id... Meanwhile we're still seeing people exploit CVE-2019-18935 from 5 years ago...

Had some fun with Alden, @laughingmantis.bsky.social, and Tanner digging into the Java implant that was being deployed by the Cleo 0-day. Our analysis is now live! www.huntress.com/blog/cleo-so... TL;DR: Custom malware specifically targeting Cleo software we called Malichus. Enjoy!

We’ve identified an emerging threat involving Cleo’s LexiCom, VLTransfer, and Harmony software, commonly used to manage file transfers. #dfir #vulnerability www.huntress.com/blog/threat-...