#contileaks — Public Fediverse posts

🎁 GenAI x Sec Advent #11

One cool feature of GenAI models is their ability to analyze images. Several months ago, I asked myself how I could leverage this feature for threat intelligence! 🤔

And then I realized it would be a good idea to leverage model vision for time-series analysis.

So I used the Conti Leaks as an example. I generated a graph showing the number of discussions per day and used GPT-4o Vision to correlate the peaks with potential geopolitical events or other interesting events! 🌐

🤓 The results were quite interesting! You can check my blog to learn more about it!

Now imagine what you could do with it, here are some examples and ideas I am currently exploring 👇

➡️ Malware Analysis Assistant: Guiding your current analysis through screenshot of your screen.

➡️ Automated Web Browsing Agent: Analyze phishing pages dynamically using a headless browser and model Vision.

➡️ Forged Image/videos Detection: Identifying tampered or fake images in influence operations.

➡️ Full Threat Report Analysis: Process entire reports, including images and screenshots, to extract and summarize all data including assembly screenshots.

Do you see some other interesting use cases? 👇 #ContiLeaks #Geopolitics #Ransomware #threatintel #gpt #genai

https://blog.securitybreak.io/time-series-analysis-by-leveraging-gpt-4o-vision-for-threat-intel-d0b3225a40c9

In light of the US and UK decision to sanction 7 members of #Trickbot due to their parts in crafting and delivering #ransomware, I want to share a conversation between Bentley and Strix from the #ContiLeaks that happened a year ago this month.

New to #threatintel at the time (I still am!), it was a bit revelatory to see how methodical and thorough threat actors are about their work.

Sanction Information:
https://home.treasury.gov/news/press-releases/jy1256

https://www.gov.uk/government/news/uk-cracks-down-on-ransomware-actors

Zatím asi nejzajímavější přednáška je ke #ContiLeaks. Neslyšeli jste? Conti je v současnosti asi největší skupina kyberzločinců, kteří již na vyděračském malwaru (ransomwaru) vidělali přes 1.5 mld. dolarů. Většina je z Ruska hledaná FBI, dle úniku dat napojená na ruské FSB. 1/2

No final, é tudo um negócio. Isso inclui o "marketing"
#ContiLeaks #Conti

RT @[email protected]

#Conti (Rocket-Chat)
Here is an unusual New Year's greetings message

- Vitality to our bots.
- Persistence to our crypts.

@[email protected]

🐦🔗: https://twitter.com/Artilllerie/status/1498978462215942147

Conti Ransomware Group Diaries, Part I: Evasion https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/ #Ne'er-Do-WellNews #Contiransomware #REvilransomware #TheComingStorm #HoldSecurity #Contibreach #Ransomware #alexholden #Contileaks #AllaWitte #Emercoin #trickbot #EmerDNS #Ukraine #Conti #Stern #Hof

É apenas uma questão de tempo até se conhecer o nome #ContiLeaks
Temos de lembrar que estes grupos trabalham como "marketing", e notícias passam por marketing - pagar a jornalistas é um "investimento" para eles.

RT @[email protected]

An unnamed journalist offered to help Conti extort companies (most likely by threatening to cover the company's breach), in return for a 5% commission.
https://twitter.com/BrettCallow/status/1498409671564038144

🐦🔗: https://twitter.com/MalwareTechBlog/status/1498617401679642627