Clandestine
@akaclandestine • 62,429 subscribers
| Security | Osint | Threat Research | Opsec | Threat Intelligence | Infosec | Threat Hunting | Humint |
Videos
Security Alert: OSINT Investigation – Fraud on Caixa Tem OSINT analysis has identified the commercialization of SIP infrastructure (“SIP CAIXA TEM”) for large-scale attacks against the Caixa Tem mobile banking app from Caixa Econômica Federal. 1. Acquisition of Calling Infrastructure • “SIP CAIXA TEM” = Brazilian VoIP SIP trunks optimized for mass calling. • Scalable packages: 5 channels for R$ 1,500 up to 100 channels for R$ 11,000, with prepaid minutes at R$ 0.10 per minute. • “Auto-dialer up to 50 threads + real-time transcription” for R$ 2,000 = automatic dialing software capable of running up to 50 simultaneous calls per operator (or per machine). Real-time speech-to-text allows the “agent” to read the victim’s responses without listening live, speeding up the scam and easing training/quality control. • Example number 558007260207 (= +55 800 726 0207) is the official Caixa 0800 hotline. The service enables spoofing (origin forgery) so the call appears to come directly from Caixa. 2. Execution of Vishing (the “scam call”) • The auto-dialer calls thousands of numbers (typically from leaked beneficiary databases). • Typical script: “Your Caixa Tem account has a problem/block/suspicion of fraud. To unblock it, confirm your details or make a test PIX to a secure account.” • The fraudster instructs the victim to open the Caixa Tem app live, share the screen, provide OTP codes, change registered email/phone/password, or install a fake app. • Once access is obtained, the scammer changes contact details, transfers the balance from the Digital Social Savings Account via PIX to “mule” accounts (money mules), and erases traces. Recommendation: Never provide passwords, codes, or authorize financial transactions over the phone. Contact Caixa exclusively through official channels. Report immediately: Caixa app or 0800 726 0207. #CyberSecurity #DigitalSecurity #DigitalFraud #CaixaTem #VishingBrazil #FraudAlert #OSINTBrazil #DigitalProtection @Caixa
Clandestine146,293 Aufrufe • vor 5 Monaten
A Threat Actor has announced, through text and video in a Telegram group, the launch of BLACKNET-00 — the world’s most advanced and accessible ransomware builder platform. Featuring a professional dark-themed graphical interface, intuitive tabs, and real-time configuration preview, anyone — even with ZERO programming knowledge — can generate fully functional ransomware with just one click. High-risk features of the BLACKNET-00 tool include: • AES-256, RSA, and ChaCha20 encryption • Complete disablement of Windows Defender, Task Manager, and critical system controls • Advanced persistence + network/USB self-propagation • C2 server with Tor + DGA support • Anti-detection (VM, sandbox, delayed execution) • Exfiltration of passwords, crypto wallets, screenshots, and webcam footage Announced price: US$ 500. This platform democratizes ransomware, completely eliminating the technical barrier and dramatically increasing the risk of mass attacks by low-level actors. Cybersecurity professionals and organizations: immediately raise your alert level and reinforce defenses. Share to spread awareness. #CyberSecurity #Ransomware #BLACKNET00 #ThreatIntelligence #InfoSec #Malware #RansomwareAsAService #CyberThreat #ThreatActor
Clandestine88,491 Aufrufe • vor 5 Monaten
🚨 THREAT INTELLIGENCE ALERT – APT IRAN | DESTRUCTIVE WIPER ATTACK Actor: APT IRAN (also tracked as APT IRAN مرکز تحقیقاتی) Operation type: Full-disk wiper (irreversible destruction) Confirmed target: pfSense Community Edition firewall hosted on Yesilbeyaz Hosting (Turkey) Hostname: date: August 2026 Executive Summary A successful wiper attack against a pfSense firewall (FreeBSD 14 + ZFS) running on Turkish hosting infrastructure has been documented with complete video evidence. The actor obtained root access and deliberately zeroed the first ~1 GB of the disk, destroying the GPT partition table, bootloader, and ZFS structures. The system is now permanently unbootable. All data and firewall configuration have been lost. Technical Analysis of the Attack (based on visual evidence) 1Initial access and reconnaissance ◦pfSense 2.7.0-RELEASE (amd64) web interface accessed with account [email protected]. ◦Virtualized system (QEMU Guest), uptime of approximately 69 days. ◦Multiple virtual interfaces with Turkish/Islamic naming conventions (ABIDIN, BASRI, GANOS, SHM, GROZ, KUMOVA, RAMMOS, ORTAKLAR, INKUTSAN, GLENN, ORKA, etc.), indicating a multi-tenant VPN or tunneling service environment. 2Destruction phase ◦Root shell access via console. ◦Commands executed: ▪sysctl kern.geom.debugflags=16 (enables GEOM destruction) ▪Attempts at gpart destroy ▪dd if=/dev/zero of=/dev/da0 bs=1M count=1000 oflag=direct conv=fsync (and variations) ◦Successful zeroing of the first 1 GB of the disk (da0), overwriting the GPT partition table, bootloader, and ZFS metadata. ◦Confirmation of transfer: ~1,048,576,000 bytes in approximately 1.45 seconds. 3Finalization ◦reboot -q ◦Host stops responding (“Host is not communicating for more than 15 seconds”). ◦System completely dead. Context and Threat Assessment •APT IRAN has already been monitored for data leak claims (Argentina, Thailand, France, Indonesia, Brazil – PII, medical records, and government data). The current operation demonstrates real destructive capability, not just exfiltration. •The target is Turkish hosting infrastructure (NATO member country) with strong indications of VPN service usage. This elevates the risk of collateral impact on end users and potential targets of Iranian interest in the region. •Classic Iranian / pro-Iranian hacktivist wiper tactic: privileged access → irreversible destruction of boot and filesystem structures → rapid exit. Unlike ransomware, the objective is permanent denial of service and evidence destruction. Second- and Third-Order Implications •Hosting and VPS providers in Turkey and the surrounding region become priority targets for Iran-aligned groups during periods of geopolitical tension. #ThreatIntel #APTIran #Wiper #pfSense #CyberAttack #Yesilbeyaz #Turkey #IranianAPT
Clandestine20,071 Aufrufe • vor 1 Monat
🚨 THREAT INTELLIGENCE ALERT 🚨 The tool 🇨🇳 KernelGhost820 is being actively sold on the underground market for US$ 2,500, complete with full source code. This is a professional-grade suite with an intuitive graphical interface and six advanced modules, specifically designed for EDR evasion and sophisticated ransomware operations with efficient lateral movement: • EDR Removal Engine: Automatically detects and terminates more than 40 security products (including CrowdStrike, SentinelOne, Microsoft Defender, Kaspersky, and others). Supports Kernel, UserMode, and NTDLL termination modes, kernel driver loading for protected processes, disabling Windows Defender, and blocking telemetry connections. • Ransomware Module: Dual encryption using AES256CBC + RSA2048, supporting over 70 file types (documents, images, databases, backups, etc.). Automatically deletes Volume Shadow Copies to prevent recovery, generates custom ransom notes with Bitcoin addresses and contact emails, and changes the desktop wallpaper. • Remote Operations & Mass Deployment: Connects to remote devices on the local network via WMI (requires username and password). Scans installed software on target hosts, performs process termination, and enables one-click full tool deployment. Includes full-network scanning for open SMB port 445 with real-time progress tracking. • Detailed Process Manager and full Operation Logger (exportable to TXT). This tool significantly lowers the technical barrier for advanced ransomware actors targeting corporate environments. Immediate monitoring recommendations: • Evaluate the resilience of your EDR/XDR controls against kernel-mode bypass techniques • Intensify monitoring of anomalous SMB (port 445) traffic and WMI connections • Strengthen network segmentation and the principle of least privilege Our team is actively tracking this tool and any emerging variants. #ThreatIntelligence #Ransomware #EDRBypass #CyberSecurity #InfoSec #CyberThreat
Clandestine40,816 Aufrufe • vor 4 Monaten
THREAT INTELLIGENCE ALERT Forensic analysis of a commercial Malware-as-a-Service (MaaS) full package AURA C2 + AURA CRYPTER FUD v4.0 + BINDER PDF. Key findings: • Active C2 panel showing 101 clients (24 online), 39.5 GB of exfiltrated data, 102,915 passwords, and stealer_data uploads from multiple countries (Algeria, Vietnam, Singapore, France, Morocco, and others). • Crypter featuring code obfuscation, anti-debug/VM, delay execution, and UPX compression options. • Malicious PDF generator using “professional invoice” and “document requires Adobe Reader update” lures that redirect victims to the payload download. • Advertised pricing: full package for 500 | Binder + FUD for 200. Indicators of Compromise (IOCs): • C2: 193.181.214.66:5000 (tracked by ViriBack C2 Tracker as the “Aura” family since 06/04/2026) • Payload domain: Infrastructure is already indexed in public threat trackers. This is an active commercial operation distributing stealer/RAT malware via PDF-based social engineering. Immediate blocking of the IOCs and monitoring for credential/token exfiltration behavior is recommended. #CyberSecurity #ThreatIntel #Malware #InfoSec #CyberCrime #MaaS #Phishing #C2 #Stealer #RAT #CyberThreatIntelligence #MalwareAnalysis
Clandestine12,103 Aufrufe • vor 1 Monat
A high-risk illegal tool called Tela Caixa Física + Jurídica Operadora (Mobile & Desktop) is being openly marketed for R$ 2,000 per month. Advertised features include: • Selective data harvesting of individuals (Pessoa Física — PF) and legal entities (Pessoa Jurídica — PJ) • CPF + CNPJ APIs • Operator commands for sending QR Codes and numerous other remote controls • Complete dashboard with real-time metrics, statistics, and separation between physical and legal persons • Ability to enable/disable specific data collection (only PF, only PJ, or both) • Full command control (return to start, switch account types, module updates, and all tokens) This solution is explicitly designed for mass unauthorized collection of personal and corporate data, social engineering, and banking fraud, constituting serious violations of Brazil’s LGPD (General Data Protection Law), the Penal Code (fraud and electronic fraud), and the Internet Civil Rights Framework. The ad highlights “limited spots” and includes a demonstration video. #CyberAlert #BankFraud #TelaCaixa #CyberCrime #LGPD #DataProtection #ReportFraud #CyberSecurity @Caixa
Clandestine28,912 Aufrufe • vor 4 Monaten
Keine weiteren Inhalte verfügbar