MK
Just finished the full walkthrough of my TraderTraitor infrastructure research today. From one reported ROOFDECK C2 to 13 linked endpoints using certificates, TLS fingerprints and historical records. Full walkthrough. Hope you enjoy it, and happy hunting!
1 replies·37 reposts·134 likes·7,295 views
MK
Hunting TraderTraitor Infrastructure 🇰🇵 I started with report from S1. sentinelone.com/labs/dont-call… I found additional servers linked through certificate metadata, TLS fingerprints and HTTP responses. Here is what stood out 🧵 sentinelone.com Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto... North Korean operators built a foothold on a DevOps engineer's Mac in a campaign whose job interview lures deliver malware via Terraform lock files.
1 replies·18 reposts·123 likes·6,407 views
MK
I had a look this evening and found some infrastructure linked to TraderTraitor 🇰🇵 If any researchers tracking this actor are interested, DM me and I will share the details and correlations.
7 replies·6 reposts·59 likes·5,062 views
MK
Fake recruiters, fake interviews, malicious coding tasks. DPRK has been doing this for years. What exactly was “highly sophisticated” about that? You say you blocked 57 suspected DPRK-linked attempts. You clearly knew the threat very well, yet a developer still ran a malicious Binance @binance Nov 3 Article 29 October Binance Security Incident: Initial Findings and Response Update On 29 October 2026, Binance experienced a serious and highly sophisticated security incident. This should not have happened, and we apologise for the concern, disruption and uncertainty it caused our
MK
Had a look through the ARTEX source code to see what we could use for hunting on Shodan 🔎 A few useful things stood out: default ports, the page title, and a pretty distinctive HTML description. 🧵 connect24h @connect24h Oct 9 CSIRT関係者各位。AI自律ペンテストの ARTEX（Autumn-27/ARTEX）が本家ごと削除されましたが、AGPL-3.0なので実質復元可能な状態が残ってました。取り損ねた人はちゃんと取得しておきましょう。敵の手段知るの超重要。 ・Hinln/ARTEX が