Xavier Mertens 🇧🇪

ISC Logo

Python Bot Delivered Through DLL Side-Loading https://isc.sans.edu/diary/31778

Great talk! 🥳

Good morning from #Insomnihack! I’m here today, ping me if you want to meet!

ISC Logo

Shellcode Encoded in UUID's https://isc.sans.edu/diary/31752

Njrat Campaign Using Microsoft Dev Tunnels isc.sans.edu/diary/31724
#SANSISC

Every once in a while you come across interesting PE Section names

Hello
Guy!

www.virustotal.com/gui/file/051...

XWorm Cocktail:� A Mix of PE data with PowerShell Code - SANS Internet Storm Center

XWorm Cocktail:  A Mix of PE data with PowerShell Code isc.sans.edu/diary/31700 #SANSISC

You've Got Malware: FINALDRAFT Hides in Your Drafts — Elastic Security Labs During a recent investigation (REF7707), Elastic Security Labs discovered new malware targeting a foreign ministry. The malware includes a custom loader and backdoor with many features including using...

Monday morning reading with your 0xC0FFEE:
www.elastic.co/security-lab...

The Danger of IP Volatility - SANS Internet Storm Center The Danger of IP Volatility, Author: Xavier Mertens

The Danger of IP Volatility isc.sans.edu/diary/31688 #SANSISC

ISC Logo

Fake BSOD Delivered by Malicious Python Script https://isc.sans.edu/diary/31686

Following back!

The Unbreakable Multi-Layer Anti-Debugging System isc.sans.edu/diary/31658

Be honest… we all do that… taking screenshots of important information! Be careful and don’t keep them for a long time! #InfoStealer #Malware #OCR

t.co/cjI7gNLkW5

ISC Logo

From PowerShell to a Python Obfuscation Race! https://isc.sans.edu/diary/31634

ISC Logo

Fileless Python InfoStealer Targeting Exodus https://isc.sans.edu/diary/31630

Let’s wrap up the week with the malware analysis tournament! Wanna join the fun? My next class is in March in London #FOR610 #SANSEMEA

Make Malware Happy isc.sans.edu/diary/31560 #SANSISC

SwaetRAT Delivery Through Python - SANS Internet Storm Center SwaetRAT Delivery Through Python, Author: Xavier Mertens

SwaetRAT Delivery Through Python isc.sans.edu/diary/31554

More SSH Fun! - SANS Internet Storm Center More SSH Fun!, Author: Xavier Mertens

More SSH Fun! isc.sans.edu/diary/31542

Modiloader From Obfuscated Batch File - SANS Internet Storm Center Modiloader From Obfuscated Batch File, Author: Xavier Mertens

Modiloader From Obfuscated Batch File isc.sans.edu/diary/31540

Christmas Christmas "Gift" Delivered Through SSH, Author: Xavier Mertens

Christmas "Gift" Delivered Through SSH isc.sans.edu/diary/31538

Interesting read: Windows Server 2022 and MsMpEng.exe www.hexacorn.com/blog/2024/12...

Python Delivering AnyDesk Client as RAT - SANS Internet Storm Center Python Delivering AnyDesk Client as RAT, Author: Xavier Mertens

Python Delivering AnyDesk Client as RAT isc.sans.edu/diary/31524

Is it me or the price of printer cartridges became really insane? @HP has a business more lucrative than #ransomware gangs! Hey Bad Guys, move to the printer business! 👿

“I see coins everywhere!” 😍

Cyber Defense #Netwars running at full speed in Frankfurt! #SANSEMEA

Full set of Belgian speakers at SANS@Night in Frankfurt tonight! 🇧🇪 The room was full! So exciting! #SANSEMEA

My last #FOR610 run for this year! Welcome Frankfurt!

From a Regular Infostealer to its Obfuscated Version - SANS Internet Storm Center From a Regular Infostealer to its Obfuscated Version, Author: Xavier Mertens

From a Regular Infostealer to its Obfuscated Version isc.sans.edu/diary/31484 #SANSISC

Some attackers look like #scriptkiddies and need a GUI 😆 #Ransomware