ActivityPub Viewer

A small tool to view real-world ActivityPub objects as JSON! Enter a URL or username from Mastodon or a similar service below, and we'll send a request with the right Accept header to the server to view the underlying object.

Open in browser →
{ "@context": [ "https://www.w3.org/ns/activitystreams", { "ostatus": "http://ostatus.org#", "atomUri": "ostatus:atomUri", "inReplyToAtomUri": "ostatus:inReplyToAtomUri", "conversation": "ostatus:conversation", "sensitive": "as:sensitive", "toot": "http://joinmastodon.org/ns#", "votersCount": "toot:votersCount", "litepub": "http://litepub.social/ns#", "directMessage": "litepub:directMessage", "blurhash": "toot:blurhash", "focalPoint": { "@container": "@list", "@id": "toot:focalPoint" }, "Hashtag": "as:Hashtag" } ], "id": "https://infosec.exchange/users/volexity/outbox?min_id=0&page=true", "type": "OrderedCollectionPage", "next": "https://infosec.exchange/users/volexity/outbox?max_id=109440378400303083&page=true", "prev": "https://infosec.exchange/users/volexity/outbox?min_id=110112982923143215&page=true", "partOf": "https://infosec.exchange/users/volexity/outbox", "orderedItems": [ { "id": "https://infosec.exchange/users/volexity/statuses/110112982923143215/activity", "type": "Create", "actor": "https://infosec.exchange/users/volexity", "published": "2023-03-30T15:39:39Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/volexity" ], "object": { "id": "https://infosec.exchange/users/volexity/statuses/110112982923143215", "type": "Note", "summary": null, "inReplyTo": null, "published": "2023-03-30T15:39:39Z", "url": "https://infosec.exchange/@volexity/110112982923143215", "attributedTo": "https://infosec.exchange/users/volexity", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/volexity" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/volexity/statuses/110112982923143215", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2023-03-30:objectId=54668059:objectType=Conversation", "content": "<p>The <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@volexity\" class=\"u-url mention\">@<span>volexity</span></a></span> <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a> team takes a look at the <a href=\"https://infosec.exchange/tags/3CX\" class=\"mention hashtag\" rel=\"tag\">#<span>3CX</span></a> supply chain compromise: the malware delivered, the infrastructure used &amp; the initial set up of the attack. Here&#39;s what we know so far: <a href=\"https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">volexity.com/blog/2023/03/30/3</span><span class=\"invisible\">cx-supply-chain-compromise-leads-to-iconic-incident/</span></a><br /><a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a></p>", "contentMap": { "en": "<p>The <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@volexity\" class=\"u-url mention\">@<span>volexity</span></a></span> <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a> team takes a look at the <a href=\"https://infosec.exchange/tags/3CX\" class=\"mention hashtag\" rel=\"tag\">#<span>3CX</span></a> supply chain compromise: the malware delivered, the infrastructure used &amp; the initial set up of the attack. Here&#39;s what we know so far: <a href=\"https://www.volexity.com/blog/2023/03/30/3cx-supply-chain-compromise-leads-to-iconic-incident/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">volexity.com/blog/2023/03/30/3</span><span class=\"invisible\">cx-supply-chain-compromise-leads-to-iconic-incident/</span></a><br /><a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a></p>" }, "attachment": [ { "type": "Document", "mediaType": "image/png", "url": "https://media.infosec.exchange/infosec.exchange/media_attachments/files/110/112/982/521/350/074/original/b0862071d9d94ad5.png", "name": null, "blurhash": "U5B3.]%M9FRj-;M_M{D%IUM{~qoLIUt7-;D%", "width": 1992, "height": 1041 } ], "tag": [ { "type": "Mention", "href": "https://infosec.exchange/users/volexity", "name": "@volexity" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/threatintel", "name": "#threatintel" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/3cx", "name": "#3cx" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/dfir", "name": "#dfir" } ], "replies": { "id": "https://infosec.exchange/users/volexity/statuses/110112982923143215/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/volexity/statuses/110112982923143215/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/volexity/statuses/110112982923143215/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/volexity/statuses/110112982923143215/likes", "type": "Collection", "totalItems": 12 }, "shares": { "id": "https://infosec.exchange/users/volexity/statuses/110112982923143215/shares", "type": "Collection", "totalItems": 12 } } }, { "id": "https://infosec.exchange/users/volexity/statuses/110101670545320971/activity", "type": "Announce", "actor": "https://infosec.exchange/users/volexity", "published": "2023-03-28T15:42:46Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity", "https://infosec.exchange/users/volexity/followers" ], "object": "https://infosec.exchange/users/volexity/statuses/109943203291764766" }, { "id": "https://infosec.exchange/users/volexity/statuses/110068370295660770/activity", "type": "Announce", "actor": "https://infosec.exchange/users/volexity", "published": "2023-03-22T18:34:04Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volatility", "https://infosec.exchange/users/volexity/followers" ], "object": "https://infosec.exchange/users/volatility/statuses/110068292964521971" }, { "id": "https://infosec.exchange/users/volexity/statuses/110033938273598144/activity", "type": "Create", "actor": "https://infosec.exchange/users/volexity", "published": "2023-03-16T16:37:33Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/volexity" ], "object": { "id": "https://infosec.exchange/users/volexity/statuses/110033938273598144", "type": "Note", "summary": null, "inReplyTo": null, "published": "2023-03-16T16:37:33Z", "url": "https://infosec.exchange/@volexity/110033938273598144", "attributedTo": "https://infosec.exchange/users/volexity", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/volexity" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/volexity/statuses/110033938273598144", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2023-03-16:objectId=51650713:objectType=Conversation", "content": "<p>Exploitation of unpatched Telerik UI continues to provide unauthorized access to <a href=\"https://infosec.exchange/tags/APT\" class=\"mention hashtag\" rel=\"tag\">#<span>APT</span></a> and criminal groups alike. <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@volexity\" class=\"u-url mention\">@<span>volexity</span></a></span>&#39;s <a href=\"https://infosec.exchange/tags/XEGroup\" class=\"mention hashtag\" rel=\"tag\">#<span>XEGroup</span></a> research is mentioned in this joint cybersecurity advisory from the FBI and Center for Internet Security: <a href=\"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">cisa.gov/news-events/cybersecu</span><span class=\"invisible\">rity-advisories/aa23-074a</span></a></p>", "contentMap": { "en": "<p>Exploitation of unpatched Telerik UI continues to provide unauthorized access to <a href=\"https://infosec.exchange/tags/APT\" class=\"mention hashtag\" rel=\"tag\">#<span>APT</span></a> and criminal groups alike. <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@volexity\" class=\"u-url mention\">@<span>volexity</span></a></span>&#39;s <a href=\"https://infosec.exchange/tags/XEGroup\" class=\"mention hashtag\" rel=\"tag\">#<span>XEGroup</span></a> research is mentioned in this joint cybersecurity advisory from the FBI and Center for Internet Security: <a href=\"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">cisa.gov/news-events/cybersecu</span><span class=\"invisible\">rity-advisories/aa23-074a</span></a></p>" }, "attachment": [], "tag": [ { "type": "Mention", "href": "https://infosec.exchange/users/volexity", "name": "@volexity" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/apt", "name": "#apt" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/xegroup", "name": "#xegroup" } ], "replies": { "id": "https://infosec.exchange/users/volexity/statuses/110033938273598144/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/volexity/statuses/110033938273598144/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/volexity/statuses/110033938273598144/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/volexity/statuses/110033938273598144/likes", "type": "Collection", "totalItems": 2 }, "shares": { "id": "https://infosec.exchange/users/volexity/statuses/110033938273598144/shares", "type": "Collection", "totalItems": 1 } } }, { "id": "https://infosec.exchange/users/volexity/statuses/109994671710280720/activity", "type": "Announce", "actor": "https://infosec.exchange/users/volexity", "published": "2023-03-09T18:11:33Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity", "https://infosec.exchange/users/volexity/followers" ], "object": "https://infosec.exchange/users/volexity/statuses/109859032665452933" }, { "id": "https://infosec.exchange/users/volexity/statuses/109983318644397176/activity", "type": "Announce", "actor": "https://infosec.exchange/users/volexity", "published": "2023-03-07T18:04:19Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/r00tbsd", "https://infosec.exchange/users/volexity/followers" ], "object": "https://infosec.exchange/users/r00tbsd/statuses/109982917504797140" }, { "id": "https://infosec.exchange/users/volexity/statuses/109982844926611530/activity", "type": "Create", "actor": "https://infosec.exchange/users/volexity", "published": "2023-03-07T16:03:51Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/volexity", "https://infosec.exchange/users/TrendMicro" ], "object": { "id": "https://infosec.exchange/users/volexity/statuses/109982844926611530", "type": "Note", "summary": null, "inReplyTo": null, "published": "2023-03-07T16:03:51Z", "url": "https://infosec.exchange/@volexity/109982844926611530", "attributedTo": "https://infosec.exchange/users/volexity", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/volexity", "https://infosec.exchange/users/TrendMicro" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/volexity/statuses/109982844926611530", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2023-03-07:objectId=49556555:objectType=Conversation", "content": "<p><span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@volexity\" class=\"u-url mention\">@<span>volexity</span></a></span> details how to use <a href=\"https://infosec.exchange/tags/memoryanalysis\" class=\"mention hashtag\" rel=\"tag\">#<span>memoryanalysis</span></a> to detect EDR-nullifying malware. This latest blog post uses the <a href=\"https://infosec.exchange/tags/AVBurner\" class=\"mention hashtag\" rel=\"tag\">#<span>AVBurner</span></a> malware, first documented by <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@TrendMicro\" class=\"u-url mention\">@<span>TrendMicro</span></a></span>, as an example. Read more here: <a href=\"https://www.volexity.com/blog/2023/03/07/using-memory-analysis-to-detect-edr-nullifying-malware/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">volexity.com/blog/2023/03/07/u</span><span class=\"invisible\">sing-memory-analysis-to-detect-edr-nullifying-malware/</span></a> </p><p><a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a> <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a> </p>", "contentMap": { "en": "<p><span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@volexity\" class=\"u-url mention\">@<span>volexity</span></a></span> details how to use <a href=\"https://infosec.exchange/tags/memoryanalysis\" class=\"mention hashtag\" rel=\"tag\">#<span>memoryanalysis</span></a> to detect EDR-nullifying malware. This latest blog post uses the <a href=\"https://infosec.exchange/tags/AVBurner\" class=\"mention hashtag\" rel=\"tag\">#<span>AVBurner</span></a> malware, first documented by <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@TrendMicro\" class=\"u-url mention\">@<span>TrendMicro</span></a></span>, as an example. Read more here: <a href=\"https://www.volexity.com/blog/2023/03/07/using-memory-analysis-to-detect-edr-nullifying-malware/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">volexity.com/blog/2023/03/07/u</span><span class=\"invisible\">sing-memory-analysis-to-detect-edr-nullifying-malware/</span></a> </p><p><a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a> <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a> </p>" }, "attachment": [], "tag": [ { "type": "Mention", "href": "https://infosec.exchange/users/volexity", "name": "@volexity" }, { "type": "Mention", "href": "https://infosec.exchange/users/TrendMicro", "name": "@TrendMicro" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/memoryanalysis", "name": "#memoryanalysis" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/avburner", "name": "#avburner" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/dfir", "name": "#dfir" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/threatintel", "name": "#threatintel" } ], "replies": { "id": "https://infosec.exchange/users/volexity/statuses/109982844926611530/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/volexity/statuses/109982844926611530/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/volexity/statuses/109982844926611530/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/volexity/statuses/109982844926611530/likes", "type": "Collection", "totalItems": 6 }, "shares": { "id": "https://infosec.exchange/users/volexity/statuses/109982844926611530/shares", "type": "Collection", "totalItems": 9 } } }, { "id": "https://infosec.exchange/users/volexity/statuses/109960783413012304/activity", "type": "Announce", "actor": "https://infosec.exchange/users/volexity", "published": "2023-03-03T18:33:19Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volatility", "https://infosec.exchange/users/volexity/followers" ], "object": "https://infosec.exchange/users/volatility/statuses/109960777955669732" }, { "id": "https://infosec.exchange/users/volexity/statuses/109943203291764766/activity", "type": "Create", "actor": "https://infosec.exchange/users/volexity", "published": "2023-02-28T16:02:27Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/volexity", "https://infosec.exchange/users/tlansec", "https://infosec.exchange/users/attrc" ], "object": { "id": "https://infosec.exchange/users/volexity/statuses/109943203291764766", "type": "Note", "summary": null, "inReplyTo": null, "published": "2023-02-28T16:02:27Z", "url": "https://infosec.exchange/@volexity/109943203291764766", "attributedTo": "https://infosec.exchange/users/volexity", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/volexity", "https://infosec.exchange/users/tlansec", "https://infosec.exchange/users/attrc" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/volexity/statuses/109943203291764766", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2023-02-28:objectId=47937862:objectType=Conversation", "content": "<p>We are excited to announce the return of <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@volexity\" class=\"u-url mention\">@<span>volexity</span></a></span> Cyber Sessions! Our next <a href=\"https://infosec.exchange/tags/meetup\" class=\"mention hashtag\" rel=\"tag\">#<span>meetup</span></a> will be May 10 @ 6:30PM. Come listen as <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@tlansec\" class=\"u-url mention\">@<span>tlansec</span></a></span> &amp; <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@attrc\" class=\"u-url mention\">@<span>attrc</span></a></span> share their talks on <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a>, <a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a> &amp; <a href=\"https://infosec.exchange/tags/memoryforensics\" class=\"mention hashtag\" rel=\"tag\">#<span>memoryforensics</span></a>. Doors open at 6:30PM. There is limited seating so reserve your spot now! <a href=\"https://www.meetup.com/volexity-cyber-sessions/events/291852488/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">meetup.com/volexity-cyber-sess</span><span class=\"invisible\">ions/events/291852488/</span></a></p>", "contentMap": { "en": "<p>We are excited to announce the return of <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@volexity\" class=\"u-url mention\">@<span>volexity</span></a></span> Cyber Sessions! Our next <a href=\"https://infosec.exchange/tags/meetup\" class=\"mention hashtag\" rel=\"tag\">#<span>meetup</span></a> will be May 10 @ 6:30PM. Come listen as <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@tlansec\" class=\"u-url mention\">@<span>tlansec</span></a></span> &amp; <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@attrc\" class=\"u-url mention\">@<span>attrc</span></a></span> share their talks on <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a>, <a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a> &amp; <a href=\"https://infosec.exchange/tags/memoryforensics\" class=\"mention hashtag\" rel=\"tag\">#<span>memoryforensics</span></a>. Doors open at 6:30PM. There is limited seating so reserve your spot now! <a href=\"https://www.meetup.com/volexity-cyber-sessions/events/291852488/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">meetup.com/volexity-cyber-sess</span><span class=\"invisible\">ions/events/291852488/</span></a></p>" }, "attachment": [ { "type": "Document", "mediaType": "image/png", "url": "https://media.infosec.exchange/infosec.exchange/media_attachments/files/109/943/202/652/719/095/original/33a7bfb0b4681331.png", "name": null, "blurhash": "UI85D[ofIUkCx^j?M{WAq?j[RjWBiZf6axj[", "width": 1920, "height": 1080 } ], "tag": [ { "type": "Mention", "href": "https://infosec.exchange/users/volexity", "name": "@volexity" }, { "type": "Mention", "href": "https://infosec.exchange/users/tlansec", "name": "@tlansec" }, { "type": "Mention", "href": "https://infosec.exchange/users/attrc", "name": "@attrc" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/meetup", "name": "#meetup" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/threatintel", "name": "#threatintel" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/dfir", "name": "#dfir" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/MemoryForensics", "name": "#MemoryForensics" } ], "replies": { "id": "https://infosec.exchange/users/volexity/statuses/109943203291764766/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/volexity/statuses/109943203291764766/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/volexity/statuses/109943203291764766/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/volexity/statuses/109943203291764766/likes", "type": "Collection", "totalItems": 9 }, "shares": { "id": "https://infosec.exchange/users/volexity/statuses/109943203291764766/shares", "type": "Collection", "totalItems": 7 } } }, { "id": "https://infosec.exchange/users/volexity/statuses/109859032665452933/activity", "type": "Create", "actor": "https://infosec.exchange/users/volexity", "published": "2023-02-13T19:16:46Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/volexity", "https://infosec.exchange/users/r00tbsd" ], "object": { "id": "https://infosec.exchange/users/volexity/statuses/109859032665452933", "type": "Note", "summary": null, "inReplyTo": null, "published": "2023-02-13T19:16:46Z", "url": "https://infosec.exchange/@volexity/109859032665452933", "attributedTo": "https://infosec.exchange/users/volexity", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/volexity", "https://infosec.exchange/users/r00tbsd" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/volexity/statuses/109859032665452933", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2023-02-13:objectId=44470697:objectType=Conversation", "content": "<p>Learn about <a href=\"https://infosec.exchange/tags/malware\" class=\"mention hashtag\" rel=\"tag\">#<span>malware</span></a> analysis &amp; reverse engineering with <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@volexity\" class=\"u-url mention\">@<span>volexity</span></a></span>&#39;s <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@r00tbsd\" class=\"u-url mention\">@<span>r00tbsd</span></a></span> at <a href=\"https://infosec.exchange/tags/DFRWSEU2023\" class=\"mention hashtag\" rel=\"tag\">#<span>DFRWSEU2023</span></a>! In this workshop, use <a href=\"https://infosec.exchange/tags/ghidra\" class=\"mention hashtag\" rel=\"tag\">#<span>ghidra</span></a> to disassemble <a href=\"https://infosec.exchange/tags/ransomware\" class=\"mention hashtag\" rel=\"tag\">#<span>ransomware</span></a>, analyze encryption techniques + attempt to restore encrypted files. The full conference schedule can be found here: <a href=\"https://dfrws.org/eu-2023-program/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://</span><span class=\"\">dfrws.org/eu-2023-program/</span><span class=\"invisible\"></span></a> <a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a></p>", "contentMap": { "en": "<p>Learn about <a href=\"https://infosec.exchange/tags/malware\" class=\"mention hashtag\" rel=\"tag\">#<span>malware</span></a> analysis &amp; reverse engineering with <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@volexity\" class=\"u-url mention\">@<span>volexity</span></a></span>&#39;s <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@r00tbsd\" class=\"u-url mention\">@<span>r00tbsd</span></a></span> at <a href=\"https://infosec.exchange/tags/DFRWSEU2023\" class=\"mention hashtag\" rel=\"tag\">#<span>DFRWSEU2023</span></a>! In this workshop, use <a href=\"https://infosec.exchange/tags/ghidra\" class=\"mention hashtag\" rel=\"tag\">#<span>ghidra</span></a> to disassemble <a href=\"https://infosec.exchange/tags/ransomware\" class=\"mention hashtag\" rel=\"tag\">#<span>ransomware</span></a>, analyze encryption techniques + attempt to restore encrypted files. The full conference schedule can be found here: <a href=\"https://dfrws.org/eu-2023-program/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://</span><span class=\"\">dfrws.org/eu-2023-program/</span><span class=\"invisible\"></span></a> <a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a></p>" }, "attachment": [ { "type": "Document", "mediaType": "image/png", "url": "https://media.infosec.exchange/infosec.exchange/media_attachments/files/109/859/032/243/867/290/original/509e2c1986d9822b.png", "name": null, "blurhash": "ULRWC@IVV@WD0gNGt6j[xWaeayof~An~NGt6", "width": 1920, "height": 1080 } ], "tag": [ { "type": "Mention", "href": "https://infosec.exchange/users/volexity", "name": "@volexity" }, { "type": "Mention", "href": "https://infosec.exchange/users/r00tbsd", "name": "@r00tbsd" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/malware", "name": "#malware" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/dfrwseu2023", "name": "#dfrwseu2023" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/ghidra", "name": "#ghidra" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/ransomware", "name": "#ransomware" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/dfir", "name": "#dfir" } ], "replies": { "id": "https://infosec.exchange/users/volexity/statuses/109859032665452933/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/volexity/statuses/109859032665452933/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/volexity/statuses/109859032665452933/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/volexity/statuses/109859032665452933/likes", "type": "Collection", "totalItems": 4 }, "shares": { "id": "https://infosec.exchange/users/volexity/statuses/109859032665452933/shares", "type": "Collection", "totalItems": 8 } } }, { "id": "https://infosec.exchange/users/volexity/statuses/109779885857295168/activity", "type": "Announce", "actor": "https://infosec.exchange/users/volexity", "published": "2023-01-30T19:48:41Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volatility", "https://infosec.exchange/users/volexity/followers" ], "object": "https://infosec.exchange/users/volatility/statuses/109779871696218366" }, { "id": "https://infosec.exchange/users/volexity/statuses/109741197194066743/activity", "type": "Create", "actor": "https://infosec.exchange/users/volexity", "published": "2023-01-23T23:49:39Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/volexity" ], "object": { "id": "https://infosec.exchange/users/volexity/statuses/109741197194066743", "type": "Note", "summary": null, "inReplyTo": null, "published": "2023-01-23T23:49:39Z", "url": "https://infosec.exchange/@volexity/109741197194066743", "attributedTo": "https://infosec.exchange/users/volexity", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/volexity" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/volexity/statuses/109741197194066743", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2023-01-23:objectId=39563930:objectType=Conversation", "content": "<p>In recent weeks, <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@volexity\" class=\"u-url mention\">@<span>volexity</span></a></span> has observed various attackers using malicious Microsoft OneNote (.one) files to distribute malware. To help defenders analyze these files + extract embedded objects, we have published a tool, &quot;one-extract&quot;, available here: <a href=\"https://github.com/volexity/threat-intel/tree/main/tools/one-extract\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://</span><span class=\"ellipsis\">github.com/volexity/threat-int</span><span class=\"invisible\">el/tree/main/tools/one-extract</span></a> <a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a></p>", "contentMap": { "en": "<p>In recent weeks, <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@volexity\" class=\"u-url mention\">@<span>volexity</span></a></span> has observed various attackers using malicious Microsoft OneNote (.one) files to distribute malware. To help defenders analyze these files + extract embedded objects, we have published a tool, &quot;one-extract&quot;, available here: <a href=\"https://github.com/volexity/threat-intel/tree/main/tools/one-extract\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://</span><span class=\"ellipsis\">github.com/volexity/threat-int</span><span class=\"invisible\">el/tree/main/tools/one-extract</span></a> <a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a></p>" }, "attachment": [], "tag": [ { "type": "Mention", "href": "https://infosec.exchange/users/volexity", "name": "@volexity" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/dfir", "name": "#dfir" } ], "replies": { "id": "https://infosec.exchange/users/volexity/statuses/109741197194066743/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/volexity/statuses/109741197194066743/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/volexity/statuses/109741197194066743/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/volexity/statuses/109741197194066743/likes", "type": "Collection", "totalItems": 12 }, "shares": { "id": "https://infosec.exchange/users/volexity/statuses/109741197194066743/shares", "type": "Collection", "totalItems": 9 } } }, { "id": "https://infosec.exchange/users/volexity/statuses/109699728769660399/activity", "type": "Create", "actor": "https://infosec.exchange/users/volexity", "published": "2023-01-16T16:03:41Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/volexity", "https://infosec.exchange/users/tlansec" ], "object": { "id": "https://infosec.exchange/users/volexity/statuses/109699728769660399", "type": "Note", "summary": null, "inReplyTo": null, "published": "2023-01-16T16:03:41Z", "url": "https://infosec.exchange/@volexity/109699728769660399", "attributedTo": "https://infosec.exchange/users/volexity", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/volexity", "https://infosec.exchange/users/tlansec" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/volexity/statuses/109699728769660399", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2023-01-16:objectId=37782016:objectType=Conversation", "content": "<p><span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@volexity\" class=\"u-url mention\">@<span>volexity</span></a></span>&#39;s <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@tlansec\" class=\"u-url mention\">@<span>tlansec</span></a></span> is in London at <a href=\"https://infosec.exchange/tags/CyberThreat22\" class=\"mention hashtag\" rel=\"tag\">#<span>CyberThreat22</span></a>! His talk, &quot;Two for One: Firewall 0-day investigations&quot;, is Tues, Jan 17 @ 16:10 UTC. Learn about 2 real-world examples of Chinese nation-state attackers using <a href=\"https://infosec.exchange/tags/0day\" class=\"mention hashtag\" rel=\"tag\">#<span>0day</span></a> exploits to compromise <a href=\"https://infosec.exchange/tags/firewall\" class=\"mention hashtag\" rel=\"tag\">#<span>firewall</span></a> devices. </p><p><a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a> <a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a></p>", "contentMap": { "en": "<p><span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@volexity\" class=\"u-url mention\">@<span>volexity</span></a></span>&#39;s <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@tlansec\" class=\"u-url mention\">@<span>tlansec</span></a></span> is in London at <a href=\"https://infosec.exchange/tags/CyberThreat22\" class=\"mention hashtag\" rel=\"tag\">#<span>CyberThreat22</span></a>! His talk, &quot;Two for One: Firewall 0-day investigations&quot;, is Tues, Jan 17 @ 16:10 UTC. Learn about 2 real-world examples of Chinese nation-state attackers using <a href=\"https://infosec.exchange/tags/0day\" class=\"mention hashtag\" rel=\"tag\">#<span>0day</span></a> exploits to compromise <a href=\"https://infosec.exchange/tags/firewall\" class=\"mention hashtag\" rel=\"tag\">#<span>firewall</span></a> devices. </p><p><a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a> <a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a></p>" }, "attachment": [ { "type": "Document", "mediaType": "image/png", "url": "https://media.infosec.exchange/infosec.exchange/media_attachments/files/109/699/638/151/953/044/original/17557b509cc1fe86.png", "name": null, "blurhash": "ULRMrPIVadWW0gNGs:j[xYaeWCkC~AjYNGt6", "width": 1920, "height": 1080 } ], "tag": [ { "type": "Mention", "href": "https://infosec.exchange/users/volexity", "name": "@volexity" }, { "type": "Mention", "href": "https://infosec.exchange/users/tlansec", "name": "@tlansec" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/cyberthreat22", "name": "#cyberthreat22" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/0day", "name": "#0day" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/firewall", "name": "#firewall" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/threatintel", "name": "#threatintel" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/dfir", "name": "#dfir" } ], "replies": { "id": "https://infosec.exchange/users/volexity/statuses/109699728769660399/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/volexity/statuses/109699728769660399/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/volexity/statuses/109699728769660399/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/volexity/statuses/109699728769660399/likes", "type": "Collection", "totalItems": 9 }, "shares": { "id": "https://infosec.exchange/users/volexity/statuses/109699728769660399/shares", "type": "Collection", "totalItems": 8 } } }, { "id": "https://infosec.exchange/users/volexity/statuses/109637720607185435/activity", "type": "Create", "actor": "https://infosec.exchange/users/volexity", "published": "2023-01-05T17:14:12Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/r00tbsd" ], "object": { "id": "https://infosec.exchange/users/volexity/statuses/109637720607185435", "type": "Note", "summary": null, "inReplyTo": null, "published": "2023-01-05T17:14:12Z", "url": "https://infosec.exchange/@volexity/109637720607185435", "attributedTo": "https://infosec.exchange/users/volexity", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers", "https://infosec.exchange/users/r00tbsd" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/volexity/statuses/109637720607185435", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2023-01-05:objectId=35072513:objectType=Conversation", "content": "<p>If you missed it the first time, LABScon has a <a href=\"https://infosec.exchange/tags/replay\" class=\"mention hashtag\" rel=\"tag\">#<span>replay</span></a> of <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@r00tbsd\" class=\"u-url mention\">@<span>r00tbsd</span></a></span>&#39;s talk, <a href=\"https://infosec.exchange/tags/InkySquid\" class=\"mention hashtag\" rel=\"tag\">#<span>InkySquid</span></a>, The Missing Arsenal: <a href=\"https://www.sentinelone.com/labs/labscon-replay-inkysquid-the-missing-arsenal/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">sentinelone.com/labs/labscon-r</span><span class=\"invisible\">eplay-inkysquid-the-missing-arsenal/</span></a></p><p>Volexity published two blog posts in August 2021 about this North Korean <a href=\"https://infosec.exchange/tags/apt\" class=\"mention hashtag\" rel=\"tag\">#<span>apt</span></a>:<br />Part 1: <a href=\"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">volexity.com/blog/2021/08/17/n</span><span class=\"invisible\">orth-korean-apt-inkysquid-infects-victims-using-browser-exploits/</span></a><br />Part 2: <a href=\"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">volexity.com/blog/2021/08/24/n</span><span class=\"invisible\">orth-korean-bluelight-special-inkysquid-deploys-rokrat/</span></a>). </p><p><a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a> <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a></p>", "contentMap": { "en": "<p>If you missed it the first time, LABScon has a <a href=\"https://infosec.exchange/tags/replay\" class=\"mention hashtag\" rel=\"tag\">#<span>replay</span></a> of <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@r00tbsd\" class=\"u-url mention\">@<span>r00tbsd</span></a></span>&#39;s talk, <a href=\"https://infosec.exchange/tags/InkySquid\" class=\"mention hashtag\" rel=\"tag\">#<span>InkySquid</span></a>, The Missing Arsenal: <a href=\"https://www.sentinelone.com/labs/labscon-replay-inkysquid-the-missing-arsenal/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">sentinelone.com/labs/labscon-r</span><span class=\"invisible\">eplay-inkysquid-the-missing-arsenal/</span></a></p><p>Volexity published two blog posts in August 2021 about this North Korean <a href=\"https://infosec.exchange/tags/apt\" class=\"mention hashtag\" rel=\"tag\">#<span>apt</span></a>:<br />Part 1: <a href=\"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">volexity.com/blog/2021/08/17/n</span><span class=\"invisible\">orth-korean-apt-inkysquid-infects-victims-using-browser-exploits/</span></a><br />Part 2: <a href=\"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">volexity.com/blog/2021/08/24/n</span><span class=\"invisible\">orth-korean-bluelight-special-inkysquid-deploys-rokrat/</span></a>). </p><p><a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a> <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a></p>" }, "attachment": [], "tag": [ { "type": "Mention", "href": "https://infosec.exchange/users/r00tbsd", "name": "@r00tbsd" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/replay", "name": "#replay" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/inkysquid", "name": "#inkysquid" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/apt", "name": "#apt" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/dfir", "name": "#dfir" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/threatintel", "name": "#threatintel" } ], "replies": { "id": "https://infosec.exchange/users/volexity/statuses/109637720607185435/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/volexity/statuses/109637720607185435/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/volexity/statuses/109637720607185435/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/volexity/statuses/109637720607185435/likes", "type": "Collection", "totalItems": 7 }, "shares": { "id": "https://infosec.exchange/users/volexity/statuses/109637720607185435/shares", "type": "Collection", "totalItems": 4 } } }, { "id": "https://infosec.exchange/users/volexity/statuses/109637273596792793/activity", "type": "Create", "actor": "https://infosec.exchange/users/volexity", "published": "2023-01-05T15:20:31Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers" ], "object": { "id": "https://infosec.exchange/users/volexity/statuses/109637273596792793", "type": "Note", "summary": null, "inReplyTo": null, "published": "2023-01-05T15:20:31Z", "url": "https://infosec.exchange/@volexity/109637273596792793", "attributedTo": "https://infosec.exchange/users/volexity", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/volexity/statuses/109637273596792793", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2023-01-05:objectId=35043780:objectType=Conversation", "content": "<p>This is a great synopsis from Objective-See of The Mac Malware of 2022. It was certainly a productive year for <a href=\"https://infosec.exchange/tags/macOS\" class=\"mention hashtag\" rel=\"tag\">#<span>macOS</span></a> <a href=\"https://infosec.exchange/tags/malware\" class=\"mention hashtag\" rel=\"tag\">#<span>malware</span></a> analysts &amp; researchers. Thank you for including our <a href=\"https://infosec.exchange/tags/GIMMICK\" class=\"mention hashtag\" rel=\"tag\">#<span>GIMMICK</span></a> malware analysis + IOCs! <a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a> <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a></p><p><a href=\"https://objective-see.org/blog/blog_0x71.html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://</span><span class=\"ellipsis\">objective-see.org/blog/blog_0x</span><span class=\"invisible\">71.html</span></a></p>", "contentMap": { "en": "<p>This is a great synopsis from Objective-See of The Mac Malware of 2022. It was certainly a productive year for <a href=\"https://infosec.exchange/tags/macOS\" class=\"mention hashtag\" rel=\"tag\">#<span>macOS</span></a> <a href=\"https://infosec.exchange/tags/malware\" class=\"mention hashtag\" rel=\"tag\">#<span>malware</span></a> analysts &amp; researchers. Thank you for including our <a href=\"https://infosec.exchange/tags/GIMMICK\" class=\"mention hashtag\" rel=\"tag\">#<span>GIMMICK</span></a> malware analysis + IOCs! <a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a> <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a></p><p><a href=\"https://objective-see.org/blog/blog_0x71.html\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://</span><span class=\"ellipsis\">objective-see.org/blog/blog_0x</span><span class=\"invisible\">71.html</span></a></p>" }, "attachment": [], "tag": [ { "type": "Hashtag", "href": "https://infosec.exchange/tags/macos", "name": "#macos" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/malware", "name": "#malware" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/gimmick", "name": "#gimmick" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/dfir", "name": "#dfir" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/threatintel", "name": "#threatintel" } ], "replies": { "id": "https://infosec.exchange/users/volexity/statuses/109637273596792793/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/volexity/statuses/109637273596792793/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/volexity/statuses/109637273596792793/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/volexity/statuses/109637273596792793/likes", "type": "Collection", "totalItems": 5 }, "shares": { "id": "https://infosec.exchange/users/volexity/statuses/109637273596792793/shares", "type": "Collection", "totalItems": 3 } } }, { "id": "https://infosec.exchange/users/volexity/statuses/109558216893020910/activity", "type": "Create", "actor": "https://infosec.exchange/users/volexity", "published": "2022-12-22T16:15:21Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers" ], "object": { "id": "https://infosec.exchange/users/volexity/statuses/109558216893020910", "type": "Note", "summary": null, "inReplyTo": null, "published": "2022-12-22T16:15:21Z", "url": "https://infosec.exchange/@volexity/109558216893020910", "attributedTo": "https://infosec.exchange/users/volexity", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/volexity/statuses/109558216893020910", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2022-12-22:objectId=31500483:objectType=Conversation", "content": "<p>Thanks SentinelOne for including our research in your Top 10 list, <a href=\"https://www.sentinelone.com/blog/top-10-macos-malware-discoveries-in-2022/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">sentinelone.com/blog/top-10-ma</span><span class=\"invisible\">cos-malware-discoveries-in-2022/</span></a>. As macOS malware campaigns continue, so does our <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a> team&#39;s research! Volexity is still tracking use of <a href=\"https://infosec.exchange/tags/GIMMICK\" class=\"mention hashtag\" rel=\"tag\">#<span>GIMMICK</span></a> malware and other activity by the <a href=\"https://infosec.exchange/tags/StormCloud\" class=\"mention hashtag\" rel=\"tag\">#<span>StormCloud</span></a> APT. <a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a></p>", "contentMap": { "en": "<p>Thanks SentinelOne for including our research in your Top 10 list, <a href=\"https://www.sentinelone.com/blog/top-10-macos-malware-discoveries-in-2022/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">sentinelone.com/blog/top-10-ma</span><span class=\"invisible\">cos-malware-discoveries-in-2022/</span></a>. As macOS malware campaigns continue, so does our <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a> team&#39;s research! Volexity is still tracking use of <a href=\"https://infosec.exchange/tags/GIMMICK\" class=\"mention hashtag\" rel=\"tag\">#<span>GIMMICK</span></a> malware and other activity by the <a href=\"https://infosec.exchange/tags/StormCloud\" class=\"mention hashtag\" rel=\"tag\">#<span>StormCloud</span></a> APT. <a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a></p>" }, "attachment": [], "tag": [ { "type": "Hashtag", "href": "https://infosec.exchange/tags/threatintel", "name": "#threatintel" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/gimmick", "name": "#gimmick" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/stormcloud", "name": "#stormcloud" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/dfir", "name": "#dfir" } ], "replies": { "id": "https://infosec.exchange/users/volexity/statuses/109558216893020910/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/volexity/statuses/109558216893020910/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/volexity/statuses/109558216893020910/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/volexity/statuses/109558216893020910/likes", "type": "Collection", "totalItems": 2 }, "shares": { "id": "https://infosec.exchange/users/volexity/statuses/109558216893020910/shares", "type": "Collection", "totalItems": 1 } } }, { "id": "https://infosec.exchange/users/volexity/statuses/109547242936469105/activity", "type": "Create", "actor": "https://infosec.exchange/users/volexity", "published": "2022-12-20T17:44:32Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers" ], "object": { "id": "https://infosec.exchange/users/volexity/statuses/109547242936469105", "type": "Note", "summary": null, "inReplyTo": null, "published": "2022-12-20T17:44:32Z", "url": "https://infosec.exchange/@volexity/109547242936469105", "attributedTo": "https://infosec.exchange/users/volexity", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/volexity/statuses/109547242936469105", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2022-12-20:objectId=30852755:objectType=Conversation", "content": "<p>Google’s TAG recently disclosed an Internet Explorer 0-day vulnerability that was being used by a North Korean threat group. Thanks to TAG for sharing their research and referencing our previous reports on <a href=\"https://infosec.exchange/tags/InkySquid\" class=\"mention hashtag\" rel=\"tag\">#<span>InkySquid</span></a>!<br /><a href=\"https://blog.google/threat-analysis-group/internet-explorer-0-day-exploited-by-north-korean-actor-apt37\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://</span><span class=\"ellipsis\">blog.google/threat-analysis-gr</span><span class=\"invisible\">oup/internet-explorer-0-day-exploited-by-north-korean-actor-apt37</span></a></p>", "contentMap": { "en": "<p>Google’s TAG recently disclosed an Internet Explorer 0-day vulnerability that was being used by a North Korean threat group. Thanks to TAG for sharing their research and referencing our previous reports on <a href=\"https://infosec.exchange/tags/InkySquid\" class=\"mention hashtag\" rel=\"tag\">#<span>InkySquid</span></a>!<br /><a href=\"https://blog.google/threat-analysis-group/internet-explorer-0-day-exploited-by-north-korean-actor-apt37\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://</span><span class=\"ellipsis\">blog.google/threat-analysis-gr</span><span class=\"invisible\">oup/internet-explorer-0-day-exploited-by-north-korean-actor-apt37</span></a></p>" }, "attachment": [], "tag": [ { "type": "Hashtag", "href": "https://infosec.exchange/tags/inkysquid", "name": "#inkysquid" } ], "replies": { "id": "https://infosec.exchange/users/volexity/statuses/109547242936469105/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/volexity/statuses/109547242936469105/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/volexity/statuses/109547242936469105/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/volexity/statuses/109547242936469105/likes", "type": "Collection", "totalItems": 4 }, "shares": { "id": "https://infosec.exchange/users/volexity/statuses/109547242936469105/shares", "type": "Collection", "totalItems": 2 } } }, { "id": "https://infosec.exchange/users/volexity/statuses/109546531246615950/activity", "type": "Create", "actor": "https://infosec.exchange/users/volexity", "published": "2022-12-20T14:43:32Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers" ], "object": { "id": "https://infosec.exchange/users/volexity/statuses/109546531246615950", "type": "Note", "summary": null, "inReplyTo": null, "published": "2022-12-20T14:43:32Z", "url": "https://infosec.exchange/@volexity/109546531246615950", "attributedTo": "https://infosec.exchange/users/volexity", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/volexity/statuses/109546531246615950", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2022-12-20:objectId=30798005:objectType=Conversation", "content": "<p>Microsoft’s Security Threat Intel team described an attack where a threat actor was targeting cryptocurrency investment companies. Thanks to Microsoft for sharing their analysis and referencing our research about a recent <a href=\"https://infosec.exchange/tags/AppleJeus\" class=\"mention hashtag\" rel=\"tag\">#<span>AppleJeus</span></a> campaign!</p><p><a href=\"https://www.microsoft.com/en-us/security/blog/2022/12/06/dev-0139-launches-targeted-attacks-against-the-cryptocurrency-industry/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">microsoft.com/en-us/security/b</span><span class=\"invisible\">log/2022/12/06/dev-0139-launches-targeted-attacks-against-the-cryptocurrency-industry/</span></a></p>", "contentMap": { "en": "<p>Microsoft’s Security Threat Intel team described an attack where a threat actor was targeting cryptocurrency investment companies. Thanks to Microsoft for sharing their analysis and referencing our research about a recent <a href=\"https://infosec.exchange/tags/AppleJeus\" class=\"mention hashtag\" rel=\"tag\">#<span>AppleJeus</span></a> campaign!</p><p><a href=\"https://www.microsoft.com/en-us/security/blog/2022/12/06/dev-0139-launches-targeted-attacks-against-the-cryptocurrency-industry/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">microsoft.com/en-us/security/b</span><span class=\"invisible\">log/2022/12/06/dev-0139-launches-targeted-attacks-against-the-cryptocurrency-industry/</span></a></p>" }, "attachment": [], "tag": [ { "type": "Hashtag", "href": "https://infosec.exchange/tags/applejeus", "name": "#applejeus" } ], "replies": { "id": "https://infosec.exchange/users/volexity/statuses/109546531246615950/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/volexity/statuses/109546531246615950/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/volexity/statuses/109546531246615950/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/volexity/statuses/109546531246615950/likes", "type": "Collection", "totalItems": 0 }, "shares": { "id": "https://infosec.exchange/users/volexity/statuses/109546531246615950/shares", "type": "Collection", "totalItems": 0 } } }, { "id": "https://infosec.exchange/users/volexity/statuses/109541299608948385/activity", "type": "Create", "actor": "https://infosec.exchange/users/volexity", "published": "2022-12-19T16:33:04Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers" ], "object": { "id": "https://infosec.exchange/users/volexity/statuses/109541299608948385", "type": "Note", "summary": null, "inReplyTo": null, "published": "2022-12-19T16:33:04Z", "url": "https://infosec.exchange/@volexity/109541299608948385", "attributedTo": "https://infosec.exchange/users/volexity", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/volexity/statuses/109541299608948385", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2022-12-19:objectId=30479228:objectType=Conversation", "content": "<p>Volexity’s Robert Jan Mora was quoted in this article about the Bhima Koregaon case: <a href=\"https://www.washingtonpost.com/world/2022/12/13/stan-swamy-hacked-bhima-koregaon/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">washingtonpost.com/world/2022/</span><span class=\"invisible\">12/13/stan-swamy-hacked-bhima-koregaon/</span></a>. Perhaps one of the most interesting examples of a “trojan did it” scenario, the investigation shows why <a href=\"https://infosec.exchange/tags/memoryanalysis\" class=\"mention hashtag\" rel=\"tag\">#<span>memoryanalysis</span></a> is critical for reconstructing the state of a compromised system.</p>", "contentMap": { "en": "<p>Volexity’s Robert Jan Mora was quoted in this article about the Bhima Koregaon case: <a href=\"https://www.washingtonpost.com/world/2022/12/13/stan-swamy-hacked-bhima-koregaon/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">washingtonpost.com/world/2022/</span><span class=\"invisible\">12/13/stan-swamy-hacked-bhima-koregaon/</span></a>. Perhaps one of the most interesting examples of a “trojan did it” scenario, the investigation shows why <a href=\"https://infosec.exchange/tags/memoryanalysis\" class=\"mention hashtag\" rel=\"tag\">#<span>memoryanalysis</span></a> is critical for reconstructing the state of a compromised system.</p>" }, "attachment": [], "tag": [ { "type": "Hashtag", "href": "https://infosec.exchange/tags/memoryanalysis", "name": "#memoryanalysis" } ], "replies": { "id": "https://infosec.exchange/users/volexity/statuses/109541299608948385/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/volexity/statuses/109541299608948385/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/volexity/statuses/109541299608948385/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/volexity/statuses/109541299608948385/likes", "type": "Collection", "totalItems": 4 }, "shares": { "id": "https://infosec.exchange/users/volexity/statuses/109541299608948385/shares", "type": "Collection", "totalItems": 1 } } }, { "id": "https://infosec.exchange/users/volexity/statuses/109440378400303083/activity", "type": "Create", "actor": "https://infosec.exchange/users/volexity", "published": "2022-12-01T20:47:28Z", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers" ], "object": { "id": "https://infosec.exchange/users/volexity/statuses/109440378400303083", "type": "Note", "summary": null, "inReplyTo": null, "published": "2022-12-01T20:47:28Z", "url": "https://infosec.exchange/@volexity/109440378400303083", "attributedTo": "https://infosec.exchange/users/volexity", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/volexity/followers" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/volexity/statuses/109440378400303083", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2022-12-01:objectId=25929940:objectType=Conversation", "content": "<p>[<a href=\"https://infosec.exchange/tags/Blog\" class=\"mention hashtag\" rel=\"tag\">#<span>Blog</span></a>] Volexity details novel tradecraft employed by <a href=\"https://infosec.exchange/tags/Lazarus\" class=\"mention hashtag\" rel=\"tag\">#<span>Lazarus</span></a> to deploy <a href=\"https://infosec.exchange/tags/AppleJeus\" class=\"mention hashtag\" rel=\"tag\">#<span>AppleJeus</span></a> malware using Microsoft Office documents, cryptocurrency applications, and chained DLL side-loading. More details here: <a href=\"https://www.volexity.com/blog/2022/12/01/buyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">volexity.com/blog/2022/12/01/b</span><span class=\"invisible\">uyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/</span></a></p><p><a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a> <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a></p>", "contentMap": { "en": "<p>[<a href=\"https://infosec.exchange/tags/Blog\" class=\"mention hashtag\" rel=\"tag\">#<span>Blog</span></a>] Volexity details novel tradecraft employed by <a href=\"https://infosec.exchange/tags/Lazarus\" class=\"mention hashtag\" rel=\"tag\">#<span>Lazarus</span></a> to deploy <a href=\"https://infosec.exchange/tags/AppleJeus\" class=\"mention hashtag\" rel=\"tag\">#<span>AppleJeus</span></a> malware using Microsoft Office documents, cryptocurrency applications, and chained DLL side-loading. More details here: <a href=\"https://www.volexity.com/blog/2022/12/01/buyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\" translate=\"no\"><span class=\"invisible\">https://www.</span><span class=\"ellipsis\">volexity.com/blog/2022/12/01/b</span><span class=\"invisible\">uyer-beware-fake-cryptocurrency-applications-serving-as-front-for-applejeus-malware/</span></a></p><p><a href=\"https://infosec.exchange/tags/dfir\" class=\"mention hashtag\" rel=\"tag\">#<span>dfir</span></a> <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a></p>" }, "attachment": [ { "type": "Document", "mediaType": "image/png", "url": "https://media.infosec.exchange/infosec.exchange/media_attachments/files/109/440/376/802/266/423/original/aa7b8e8c8f1af4e8.png", "name": null, "blurhash": "U8CsdS0L-B.SIV-;of4nI?$ggOwc%2IAxuRP", "width": 1992, "height": 1041 } ], "tag": [ { "type": "Hashtag", "href": "https://infosec.exchange/tags/blog", "name": "#blog" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/lazarus", "name": "#lazarus" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/applejeus", "name": "#applejeus" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/dfir", "name": "#dfir" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/threatintel", "name": "#threatintel" } ], "replies": { "id": "https://infosec.exchange/users/volexity/statuses/109440378400303083/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/volexity/statuses/109440378400303083/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/volexity/statuses/109440378400303083/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/volexity/statuses/109440378400303083/likes", "type": "Collection", "totalItems": 11 }, "shares": { "id": "https://infosec.exchange/users/volexity/statuses/109440378400303083/shares", "type": "Collection", "totalItems": 11 } } } ] }