#edr — Public Fediverse posts on home.social

OTX Bot @[email protected] · 2026-09-03 · 10:02 UTC

The Gentlemen Ransomware Hackers Disable EDR and Backups Before Encrypting Networks in Under 24 Hours

Indicators extracted from public reporting. Source: https://www.sophos.com/en-gb/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation

Pulse ID: 6a99442e4ccc39298527e2be
Pulse Link: https://otx.alienvault.com/pulse/6a99442e4ccc39298527e2be
Pulse Author: CyberHunter_NL
Created: 2026-09-03 09:55:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #EDR #HTTP #HTTPS #InfoSec #OTX #OpenThreatExchange #RAT #RCE #RansomWare #Sophos #bot #CyberHunter_NL

#cybersecurity #edr #http #https #infosec #otx

OTX Bot @[email protected] · 2026-09-03 · 10:02 UTC

The Gentlemen Ransomware Hackers Disable EDR and Backups Before Encrypting Networks in Under 24 Hours

Indicators extracted from public reporting. Source: https://www.sophos.com/en-gb/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation

Pulse ID: 6a99442e4ccc39298527e2be
Pulse Link: https://otx.alienvault.com/pulse/6a99442e4ccc39298527e2be
Pulse Author: CyberHunter_NL
Created: 2026-09-03 09:55:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #EDR #HTTP #HTTPS #InfoSec #OTX #OpenThreatExchange #RAT #RCE #RansomWare #Sophos #bot #CyberHunter_NL

#cybersecurity #edr #http #https #infosec #otx

OTX Bot @[email protected] · 2026-09-03 · 10:02 UTC

The Gentlemen Ransomware Hackers Disable EDR and Backups Before Encrypting Networks in Under 24 Hours

Indicators extracted from public reporting. Source: https://www.sophos.com/en-gb/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation

Pulse ID: 6a99442e4ccc39298527e2be
Pulse Link: https://otx.alienvault.com/pulse/6a99442e4ccc39298527e2be
Pulse Author: CyberHunter_NL
Created: 2026-09-03 09:55:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #EDR #HTTP #HTTPS #InfoSec #OTX #OpenThreatExchange #RAT #RCE #RansomWare #Sophos #bot #CyberHunter_NL

#cybersecurity #edr #http #https #infosec #otx

OTX Bot @[email protected] · 2026-09-03 · 10:02 UTC

The Gentlemen Ransomware Hackers Disable EDR and Backups Before Encrypting Networks in Under 24 Hours

Indicators extracted from public reporting. Source: https://www.sophos.com/en-gb/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation

Pulse ID: 6a99442e4ccc39298527e2be
Pulse Link: https://otx.alienvault.com/pulse/6a99442e4ccc39298527e2be
Pulse Author: CyberHunter_NL
Created: 2026-09-03 09:55:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #EDR #HTTP #HTTPS #InfoSec #OTX #OpenThreatExchange #RAT #RCE #RansomWare #Sophos #bot #CyberHunter_NL

#cyberhunter_nl #bot #sophos #ransomware #rce #rat

OTX Bot @[email protected] · 2026-09-03 · 10:02 UTC

The Gentlemen Ransomware Hackers Disable EDR and Backups Before Encrypting Networks in Under 24 Hours

Indicators extracted from public reporting. Source: https://www.sophos.com/en-gb/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation

Pulse ID: 6a99442e4ccc39298527e2be
Pulse Link: https://otx.alienvault.com/pulse/6a99442e4ccc39298527e2be
Pulse Author: CyberHunter_NL
Created: 2026-09-03 09:55:58

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#CyberSecurity #EDR #HTTP #HTTPS #InfoSec #OTX #OpenThreatExchange #RAT #RCE #RansomWare #Sophos #bot #CyberHunter_NL

#cybersecurity #edr #http #https #infosec #otx

OTX Bot @[email protected] · 2026-09-03 · 08:04 UTC

Inside The Gentlemen: Undisclosed TukTuk C2 Framework and EDR Neutralization Research

Analysis of server infrastructure revealed a complete TukTuk C2 framework (version 2.0) with cross-platform capabilities, including Windows and Linux agents, backend infrastructure, and management panel. The server contained eb.sys matching GentleKiller, along with comprehensive EDR neutralization training materials organized in four progressive lessons covering BYOVD techniques, vulnerable driver hunting, and kernel-level research. DLL sideloading configurations targeting Greenshot, ProcMon, Slack, and Postman were identified. Exfiltrated data included 224 Jira tickets from a global technology company containing information related to U.S. defense organizations and defense contractors, plus credentials from a global healthcare company's Infrastructure-as-Code platform exposing AWS keys, production databases, Azure AD, and Bitbucket access.

Pulse ID: 6a9869cb21bbf3f757424b7f
Pulse Link: https://otx.alienvault.com/pulse/6a9869cb21bbf3f757424b7f
Pulse Author: AlienVault
Created: 2026-09-02 18:24:11

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AWS #Azure #CyberSecurity #EDR #Healthcare #InfoSec #Linux #OTX #OpenThreatExchange #RAT #SideLoading #UK #Windows #bot #AlienVault

#aws #azure #cybersecurity #edr #healthcare #infosec

Daily CyberSecurity @[email protected] · 2026-09-03 · 04:19 UTC

A researcher claims a CrowdStrike Falcon vulnerability enabling privilege escalation and published a PoC. CrowdStrike has not confirmed it; no CVE exists.

#CrowdStrike #FalconFlank #0day #PrivilegeEscalation #PoC #EDR #InfoSec #Unverified

https://securityonline.info/crowdstrike-falcon-falconflank-claimed-0day/?utm_source=mastodon&utm_medium=jetpack_social

#crowdstrike #falconflank #0day #privilegeescalation #poc #edr

Ichinin :verified: :verified_paw: ✅🎯🙄 @[email protected] · 2026-01-04 · 10:57 UTC

Oh holy hell. This just shows that Microsoft need to clean up its act and get rid of such functionality to FIRMLY stand on the side of defenders. What the fuck were they thinking when they added support for custom registry hives? #registry #evasion #sysmon #edr
https://deceptiq.com/blog/ntuser-man-registry-persistence