Lightnews — Scholar-powered news

Simon Kenin @k3yp0d.bsky.social · 3d

4/4
Another example of PDQ + ScreenConnect
bsky.app/profile/k3yp...

Simon Kenin @k3yp0d.bsky.social · 10d

4/8

PDQ downloads ScreenConnect... 🤦‍♂️

microsoft_update000918u388.exe
0e99bfef05215614aafd6b9ea0e9f21b
9b04dadbb0a50d98d26abdccd27fb1696d78058e
77350a45d7d90766c03d690d7fd5178ba72af442e2ada60d9bdbb011c98189be

Simon Kenin @k3yp0d.bsky.social · 3d

3/4
ScreenConnect C2: gripsmonga[.]sbs / 144.172.95.60
Hosted at: RouterHosting / Cloudzy 🤢🤮🤢

1

Simon Kenin @k3yp0d.bsky.social · 3d

2/4
Bonus: abusing GoFile
file-eu-par-1.gofile[.]io/download/direct/a8313939-02fa-40e9-a30d-796045888019/2025_w9_form.msi
b5a834d7775328fda48f31431808d5ae
a442ca13944afd1e7236d72a047e9b0ef989e862
266c86ad07c2d39016004d2530fcd61a118d9b00eb6f3de6b9c55921879c289f
app.any.run/tasks/21053e...

Analysis https://file-eu-par-1.gofile.io/download/direct/a8313939-02fa-40e9-a30d-796045888019/2025_w9_form.msi Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

1

Simon Kenin @k3yp0d.bsky.social · 3d

1/4
PDQ which downloads ScreenConnect, the "one weird" RMM trick combo move threat actors don't want you to find out...

1 1 1

Simon Kenin @k3yp0d.bsky.social · 7d

github.com/KittenBuster...

It's a Kitten, but it doesn't looking charming to me, completely different TTPs

GitHub - KittenBusters/CharmingKitten: Exposing CharmingKitten's malicious activity for IRGC-IO devision Counterintelligence devision (1500)

Exposing CharmingKitten's malicious activity for IRGC-IO devision Counterintelligence devision (1500) - KittenBusters/CharmingKitten

github.com

Simon Kenin @k3yp0d.bsky.social · 7d

www.youtube.com/watch?v=mCCp...

ÆSTRAL - CONCRETE FOREST PT. II 艾斯崔爾 [Wave/Phonk Mix]

YouTube video by ÆSTRAL

www.youtube.com

Simon Kenin @k3yp0d.bsky.social · 8d

2/2
related:
web27[.]info
webInfo.exe
70a9b537b9b7e1b410576d798e6c5043
cb1760c90fb6c399e0125c7aa793efe37c4ce533
a27d53608ab05b5c7cb86bcf4a273435238beeb7e7efd7845375b2aa765f51e2

Simon Kenin @k3yp0d.bsky.social · 8d

1/2
web14[.]info
#OilRig #APT34

1 1

Simon Kenin @k3yp0d.bsky.social · 10d

vanzen[.]store
services.google.com/fh/files/mis...

Simon Kenin @k3yp0d.bsky.social · 10d

3/3
Additional related infra:
vanzen[.]site

Bonus, Holes explained:
www.youtube.com/watch?v=EVyY...

מוכר בורות לכל מטרה!

YouTube video by yogev132

www.youtube.com

1

Simon Kenin @k3yp0d.bsky.social · 10d

2/3
Iranian POV:
60%!!! that's basically free, the Israelis won't resist and will register with their Microsoft account!

Israeli POV:
Vanzen??? Never heard about them...
60% off to register with MS account? I don't even have a MS account WTF is this shit?

vanzen[.]org :

1

Simon Kenin @k3yp0d.bsky.social · 10d

1/3
UNC4444 Watering Hole
vanzen.co[.]il compromised to display an overlay pop-up for 60% discount when registering to the site.

1

Simon Kenin @k3yp0d.bsky.social · 10d

8/8

Samples:
app.any.run/tasks/fd6206...
app.any.run/tasks/8eac4d...

Analysis Sales Contract.pdf (MD5: 9AF100C85C1A58702DFB016C4CB95840) Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

Simon Kenin @k3yp0d.bsky.social · 10d

7/8

Additional PDF files:
715d1222139761671363297245d30cbb
dacaad6c3b595dc94401aaaad3a8e69d
843586678f9ac9b6f43a5dc9d8c0bec2
077dff71d5464dc35ac3bbccc31d6b79
90d25592d29c051583035f0131b20a13

1

Simon Kenin @k3yp0d.bsky.social · 10d

6/8

HTML drop PDQ
d3044a827f522e038df2df83dc20981f
38d86f1394f04114b8db9cf91dc9a08ba0d1b7e3
b9d12ee901a7ac942cc78aab12f862b1d04dc88c0ba97ba0fccbbf21e7fca079

1

Simon Kenin @k3yp0d.bsky.social · 10d

5/8

Additional HTML vector:
a6c618134fc314dbc7f25a542f838467
8fc5e49e7b0e008f2f7513c6a479ce05416a4ce3
1f6e3bfabb8b85bf7442da91179828762f3cb5c85b8e5fea55798d29c5441b0c

1

Simon Kenin @k3yp0d.bsky.social · 10d

4/8

PDQ downloads ScreenConnect... 🤦‍♂️

microsoft_update000918u388.exe
0e99bfef05215614aafd6b9ea0e9f21b
9b04dadbb0a50d98d26abdccd27fb1696d78058e
77350a45d7d90766c03d690d7fd5178ba72af442e2ada60d9bdbb011c98189be

1

Simon Kenin @k3yp0d.bsky.social · 10d

3/8
Additional PDQ to 093z[.]live
Document_00000000152_09_09_2025_Document_00000000152_09_09_2025_xlsx.msi
f570fa7af98567ce3c71e70b61700451
58a3ad47828e23ea2e0cbf9896b6e421dda01f5b
65ca977e09acf28ff156c780bc8a64211954714828e8219dc246c20bdd0daf98

1

Simon Kenin @k3yp0d.bsky.social · 10d

2/8
PDF Redirect:
093z[.]live/shared/Document_00000000152_09_19_2025_Document_00000000152_09_19_2025.pdf
To PDQ RMM
f874043a528f1c9d52eb03166af44372
51c60376d292f037efc5a36456cc66a27329a61d
11ecf82ed264216bb9cbcdd502d25fdbce41cc58f7b3cc7eb8104c365c24c41a

1

Simon Kenin @k3yp0d.bsky.social · 10d

1/8
Sales Contract.pdf
9af100c85c1a58702dfb016c4cb95840
867d16c7150ea010ecbea787bd9939ea4fe93769
688a2ccc09e30bad2d235ce3895afecbbf9b5c5950c8ef2cf3eaba57f6445bb2

1 2

Simon Kenin @k3yp0d.bsky.social · 13d

New year, new mix.
www.youtube.com/watch?v=7CyB...

Skeler - H a r d W a v e 夜勤 PART I + II

YouTube video by skeler.

www.youtube.com

Simon Kenin @k3yp0d.bsky.social · 14d

labs.watchtowr.com/is-this-bad-... 😍glFTPd 😍

Is This Bad? This Feels Bad. (Fortra GoAnywhere CVE-2025-10035)

File transfer used to be simple fun - fire up your favourite FTP client, log in to a glFTPd site, and you were done. Fast forward to 2025, and the same act requires a procurement team, a web interfac...

labs.watchtowr.com

Simon Kenin @k3yp0d.bsky.social · 17d

Baby, your eyes are reflecting the years of many blows
I'm the game they play every day
But you already know
Bruises fade, but scars will form
In this world, there is no shelter from the storm www.youtube.com/watch?v=bAR5...

Saint Mars - Ocean Blues (feat. Tryzdin ) [Juche Remix]

YouTube video by FOMH

www.youtube.com

Simon Kenin @k3yp0d.bsky.social · 20d

Mood

Simon Kenin @k3yp0d.bsky.social · 21d

www.group-ib.com/blog/muddywa...

www.group-ib.com