Paul Melson

Keynote | SLEUTHCON 2025 June 6th, SLEUTHCON 2025 in Arlington, VA Presented by Paul Melson

Check out his full talk here:
www.google.com/url?sa=t&sou...

Paul Melson joined us this year as our keynote speaker to talk about the history of crimeware and its evolution through the years.

In his keynote he also gives some good advice to those who are in the field and creating their professional network. Check out what he had to say!

If you’re not already alerting on

CONHOST.EXE spawning CMD.EXE spawning WGET.EXE

or

CONHOST.EXE spawning CONHOST.EXE spawning CONHOST.EXE

you’re gonna want to close that gap today.

Are weekly dental cleanings a thing?

YouTube video by SLEUTHCON Keynote | SLEUTHCON 2025

ICYMI: Paul Melson, VP of Cyber Intelligence Engineering at Capital One, delivered the SLEUTHCON 2025 keynote!

Watch here >> www.youtube.com/watch?v=9FvB...

That’s great

Happy International Dog Day, hope you spent it with your best friends

Disrupting active exploitation of on-premises SharePoint vulnerabilities | Microsoft Security Blog Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon, exploiting vulnerabilities targeting internet-facing SharePoint servers. In addition, we have observed a...

Don’t miss the use of ngrok for tunneling here. Continue to see malicious actors use this service to hide C2. Ngrok uses AWS IPs across multiple zones for egress NAT. I recommend sinkholing their domains across your network.
ngrok[.]com
ngrok[.]io
ngrok-free[.]app

www.microsoft.com/en-us/securi...

It’s that time again, apparently.

Paul Melson's Brief History of Crime[ware] was a lovely (?!) trip down memory lane. I'm old too, @pmelson.bsky.social
#SLEUTHCON #traumamemories

It is my position that Chatham House rules and TLP should extend to any trolling that takes place in those channels and venues.

New keynote drop: Paul Melson is taking the SLEUTHCON stage to dissect the rise of crime[ware]—how it started, how it scaled, and how we shut it down.
23+ yrs defending networks. ScumBots founder. Now VP @ Capital One.
🎤 June 6
📍IRL + virtual
🎟️ Tix moving fast - sleuthcon.com
🗓️ CFP closes April 18

So simple, but what a can of worms. It emphasizes why detection pipelines with multiple, conditional rounds are needed. Ideally you’d catch this with a simple string match for the reg key after it’s been through a generic deobfuscation round that drops non-alphanumeric characters.

Took this at sunset in Fall in Minnesota:

Undulating Clouds This blog provides updated forecasts and comments on current weather or other topics

They’re called Asperitas clouds:

cliffmass.blogspot.com/2024/04/undu...

Today I am thankful for all of the folks working a shift and watching the wires to keep us safe. I see you and I appreciate you.

The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access In early February 2022, notably just ahead of the Russian invasion of Ukraine, Volexity made a discovery that led to one of the most fascinating and complex incident investigations Volexity had ever w...

@volexity.com’s latest blog post describes in detail how a Russian APT used a new attack technique, the “Nearest Neighbor Attack”, to leverage Wi-Fi networks in close proximity to the intended target while the attacker was halfway around the world. 
 
Read more here: www.volexity.com/blog/2024/11...

Screenshot of malicious spam (malspam) with malware file attachment.

Traffic from the XLoader (Formbook) infection filtered in Wireshark.

2024-11-22 (Friday) #XLoader / #Formbook: I've been fired by my non-existent HR department. At least I got a "salary-receipt.exe" bazaar.abuse.ch/sample/003b5...

Tria.ge and Any.Run don't identify the malware, but Joe Sandbox does: www.joesandbox.com/analysis/156...

Also runs in my lab just fine

ScumBots (@ScumBots@infosec.exchange) 21 Posts, 0 Following, 83 Followers · I drop dox on scumbag bots and RATs

I’m in the process of migrating ScumBots from Twitter to Mastodon / infosec.exchange. You can follow the bot here now: infosec.exchange/@ScumBots

Paul Melson (@pmelson@infosec.exchange) Attached: 1 image I found a PDF file that appears to be an exploit for a PHP web app. It contains a valid PDF file header but is not a valid PDF document. It also contains an HTML/PHP document that i...

I posted a writeup analyzing a malicious PDF file containing a heavily obfuscated PHP payload over on infosec[.]exchange:

infosec.exchange/@pmelson/113...