Sign in

Corsin

@cocaman.ch
253 followers 241 following 23 posts

it security & cyber guy, research @ ecrime.ch, friendly, swiss | Opinions are my own

PostsRepliesMedia
Reposted by Corsin
galileosignals.com @galileosignals.com · 09/10/2026
Research note: procurement malware lures from one sender IP reused plausible supplier domains and JS/VBS archive children. galileosignals.com/research/2026-10…
011
Corsin @cocaman.ch · 01/09/2026
Sextortion emails dropped from 7,868 → 3,245 in August, but the number of distinct BTC wallets in use nearly doubled (14 → 26). 99.7% still spoof your own address as the sender. Volume down ≠ threat down - operators are just diversifying. 🧵 galileosignals.com/research/202...
galileosignals.com
Sextortion Bitcoin Ransom Campaign: August 2026
August 2026 brought a smaller but wallet-diverse sextortion wave: 3,245 wallet-bearing messages, near-universal visible From/To spoofing, and 26 checksum-valid BTC wallets.
010
Reposted by Corsin
ecrime.ch @ecrime.ch · 20/07/2026
New claim on the shame-site for #ransomware / #datatheft group #Anubis. Organization: fairlife, LLC Location: #UnitedStates Industry: #FoodAndBeverageServices Staff: 1,001-5,000 employees Learn more: ecrime.ch
011
Corsin @cocaman.ch · 02/05/2026
Thanks AI, it converted the area41.io agenda into an importable .ics for your favorite calendar app. Get it here: gist.github.com/cocaman/f85e...
gist.github.com
area41_2026_agenda.ics
GitHub Gist: instantly share code, notes, and snippets.
000
Reposted by Corsin
PIVOTcon @pivotcon.bsky.social · 24/02/2026
Thank you @ecrime.ch for being #PIVOTcon26 Silver Sponsor🥳 Read more about: @ecrime.ch here: ecrime.ch They detect extortion threats, stolen data, and brand exposure before attackers escalate - with verified intelligence. Our sponsors: pivotcon.org/sponsors
076
Reposted by Corsin
Mel, the Herohom ( • `ω´ • ) ➡️ FFXIV Fanfest 🇯🇵 @herohommel.bsky.social · 30/12/2025
I've waited 3 years to make this post
screenshot of tweet saying "who the fuck is playing pokemon in antarctica" with a trade partner in antarcticaphoto of me in antarctica playing my switch. adelie penguins are in the backgroundphoto of me in antarctica playing my switch, with pokemon legends z-a. adelie penguins are in the background.
140220725664
Reposted by Corsin
thesilence @thesilence.bsky.social · 01/12/2025
#PIVOTcon2026 call for papers is open! Remember, it's #PIVOTcon for a reason - your proposal should give insight into techniques and methodology, not just "what my favorite threat group did last summer". 😎 Bring on those proposals! #CFP
074
Reposted by Corsin
Ollie Whitehouse @ollieatnowhere.bsky.social · 14/10/2025
Our annual review is out covering technical highlights such as - Engineering resilience against critical loss - Passkeys - The future of digital identity - Post quantum crypt transition - Our Initiate r&d program with industry - Radical transparency in technology .. and more
067
Reposted by Corsin
Disobey_Fi @disobeyfi.bsky.social · 05/08/2025
You know you want to speak at Disobey 2026. And now is your chance to do that! Our CfP is open at: cfp.disobey.fi/disobey-2026/ Check the guidelines from the link and send your proposal by Sep 30th!
0117
Reposted by Corsin
Greg Lesnewich @greg-l.bsky.social · 21/07/2025
Tap in to the stream this week for some YARA fun, highlighting some crazy rules, how I think about learning yara (or anything) as a mid-career professional, and more!
3146
Corsin @cocaman.ch · 15/07/2025
I don't think it is, but nobody will stop you...
020
Corsin @cocaman.ch · 15/07/2025
Well, where else do you get fresh Yara rules? cc @stvemillertime.bsky.social @greg-l.bsky.social
260
Corsin @cocaman.ch · 14/07/2025
Finally a new template for a phishing email. Sender IP: 45.138.48[.]158 Subject: Your email quarantine summary!!! URLscan: urlscan.io/result/01980... Phishing URL reported and blocked by Google Safe Browsing already.
Screenshot of email showing a fake email quarantine summary. Used as a social engineering lure to trick recipients into clicking links and entering their credentials on a phishing site.
010
Corsin @cocaman.ch · 13/06/2025
five times more
010
Corsin @cocaman.ch · 07/06/2025
Which AI do you use for your messaging?
100
Reposted by Corsin
Saher @saffronsec.bsky.social · 13/05/2025
@greg-l.bsky.social drops knowledge on TA406 (Konni) as North Korea shows new interest in Ukraine, likely to keep tabs on the progress of the war and Russia's ability to keep pace on the battlefield www.proofpoint.com/us/blog/thre...
proofpoint.com
TA406 Pivots to the Front | Proofpoint US
What happened  In February 2025, TA406 began targeting government entities in Ukraine, delivering both credential harvesting and malware in its phishing campaigns. The aim of these
11513
Reposted by Corsin
Ollie Whitehouse @ollieatnowhere.bsky.social · 04/05/2025
Incidents impacting retailers – recommendations from the NCSC www.ncsc.gov.uk/blog-post/in...
ncsc.gov.uk
Incidents impacting retailers – recommendations from the NCSC
A joint blog post by the NCSC’s National Resilience Director, Jonathon Ellison, and Chief Technology Officer, Ollie Whitehouse.
042
Reposted by Corsin
Greg Lesnewich @greg-l.bsky.social · 14/04/2025
amazing work from Palo Alto and Wired today on TraderTraitor (aka SlowPisces, UNK_MachoMan, UNC something or other, Jade Sleet) unit42.paloaltonetworks.com/slow-pisces-... www.wired.com/story/trader... and a minor line item, only one mention of the L word is a major success
unit42.paloaltonetworks.com
Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware
North Korean state-sponsored group Slow Pisces (Jade Sleet) targeted crypto developers with a social engineering campaign that included malicious coding challenges. North Korean state-sponsored group ...
032
Reposted by Corsin
evacide @evacide.bsky.social · 11/04/2025
Infosec must not remain silent while Trump goes after Chris Krebs: www.eff.org/deeplinks/20...
eff.org
Cybersecurity Community Must Not Remain Silent On Executive Order Attacking Former CISA Director
Cybersecurity professionals and the infosec community have essential roles to play in protecting our democracy, securing our elections, and building, testing, and safeguarding government infrastructur...
3340160
Reposted by Corsin
Bartek Jerzman @handle.invalid · 07/03/2025
Aaaaand we have just released the #PIVOTcon25 #agenda Again You will find there crème de la crème of #CTI #ThreatIntel #ThreatReserch Top researchers tracking both APTs and cybercriminals using very clever and effective PIVOTs 😎💪 Link and thank you ⬇️1/2
151
Reposted by Corsin
ecrime.ch @ecrime.ch · 03/03/2025
February 2025 was a high-volume month on data leak and ransomware sites. Our system picked up and enriched 705 events, the highest ever. CL0p has been active posting victims from their December 2024 attack against vulnerable Cleo servers. Get the full picture with our subscription at eCrime.ch
Month by month comparison of observed events on data leak sites.Overview for February 2025 on events, to countries, actors and sector.Top 10 actors and top 10 countries impacted by ransomware and data leaks.
066
Corsin @cocaman.ch · 19/02/2025
And now I need to figure out what is "Zone 1" in London :-D
010
Corsin @cocaman.ch · 16/02/2025
I'll do the call without you and will repeatedly ask what you have to say 🤣 "Greg? Greg? Guess he is not on"
110
Corsin @cocaman.ch · 10/02/2025
Great job by police organisations around the globe to seize domains and arrest #ransomware operators of Phobos/#8BASE. www.khaosodenglish.com/news/2025/02...
Screenshot showing logos of police organisations involved in taking down/seizing the dark web site
0195
Reposted by Corsin
Andy Greenberg @agreenberg.bsky.social · 06/02/2025
A teen DOGE staffer recently given access to government systems worked at a startup known for hiring convicted hackers. Someone using a Telegram handle associated with him also solicited a cyberattack-for-hire service in 2022. All raising questions about his vetting. www.wired.com/story/edward...
wired.com
DOGE Teen Owns ‘Tesla.Sexy LLC’ and Worked at Startup That Has Hired Convicted Hackers
Experts question whether Edward Coristine, a DOGE staffer who has gone by “Big Balls” online, would pass the background check typically required for access to sensitive US government systems.
1210192458291
Reposted by Corsin
Selena Larson @selenalarson.bsky.social · 04/02/2025
Subscribing to WIRED should be mandatory for anyone who is concerned about what's happening and wants in-depth coverage from journalists who have been reporting on privacy, security, feds, and national security for years. Plus my besties @dell.bsky.social and @couts.bsky.social work there.
0194
Corsin @cocaman.ch · 21/01/2025
from the other site x.com/abuse_ch/sta...
x.com
x.com
010
Corsin @cocaman.ch · 21/01/2025
auth is being worked on and new version should come next month
150
Reposted by Corsin
Squiblydoo @squiblydoo.bsky.social · 18/01/2025
Interesting report from Twitter: "Another certificate was acquired by this company and used to sign a malicious kernel driver. The driver injects an IIS module into w3wp.exe, embedding JS into webpages that redirects to a Chinese adult site, tricking users into downloading a spyware-like app."
121
Corsin @cocaman.ch · 14/01/2025
Strange, dann bin ich einfach ein Nachzügler :)
Image generated by Apple "Image Playground" showing a cyclist in front of a mountain scenery.
010
Corsin @cocaman.ch · 14/01/2025
keine Ahnung, hatte heute einfach eine Meldung und konnte es aktivieren. Habe schon immer Englisch eingestellt.
000
Corsin @cocaman.ch · 14/01/2025
@benkoe.com Apple Intelligence seit heute in der Schweiz verfügbar?
010
Reposted by Corsin
Internet Archive @archive.org · 28/12/2024
This year, we worked swiftly to save legacy media sites Vice.com and MTVNews before decades worth of valuable journalism could be erased. These sites are now searchable on the Wayback Machine! Help us in saving these resources:: archive.org/donate/?origin=blsky-eo…
Wayback Machine capture of MTV News.
5381112152
Corsin @cocaman.ch · 25/12/2024
hey, leave us out of that
080
Corsin @cocaman.ch · 03/12/2024
I love cats, but ... www.britannica.com/story/do-we-...
britannica.com
Do We Really Swallow Spiders in Our Sleep? | Britannica
You may have heard that spiders crawl into your mouth while you’re sleeping. Is that true?
000
Reposted by Corsin
Ollie Whitehouse @ollieatnowhere.bsky.social · 03/12/2024
The Annual Report for the National Cyber Security Centre is out www.ncsc.gov.uk/collection/n... Threat assessment: www.ncsc.gov.uk/collection/n...
ncsc.gov.uk
NCSC Annual Review 2024
Looking back at the National Cyber Security Centre's eighth year and its key developments and highlights, between 1 September 2023 and 31 August 2024.
1127
Corsin @cocaman.ch · 28/11/2024
It’s complete! The script migrated 37.7 million archived posts, making them lightning-fast to search.
Graph showing the number of posts over a timeframe.
050
Corsin @cocaman.ch · 27/11/2024
Well, I am doing it a different way now, as the import broke down after two weeks. And now it might actually work and is fast :-D
050
Reposted by Corsin
PIVOTcon @pivotcon.bsky.social · 27/11/2024
#PIVOTcon25 #CfP is open and you can submit your proposals till 7 FEB 2025 Remember - one track,30m - no recording/streaming/tweeting. U should feel comfy to share more - No TLP:WHITE - Original content only Let us guide u through with a little meme-thread #CTI #ThreatIntel 1/10
13118
Reposted by Corsin
ᴉpᴉǝH 🐐💕 @summerheidi.bsky.social · 27/11/2024
I have no words - and if you know me, that's super surprising! Thank you to the Australian Information Security Association (AISA) for the awards to Kids SecuriDay for Best STEM Promoter of the Year and Community Education Program of the Year!
6295
Reposted by Corsin
The Register @theregister.com · 26/11/2024
Another 'major cyber incident' at a UK hospital, outpatients asked to stay away
dlvr.it
Another 'major cyber incident' at a UK hospital, outpatients asked to stay away
Third time this year an NHS unit's IT systems have come under attack A UK hospital is declaring a "major incident," cancelling all outpatient appointments due to "cybersecurity reasons."…
1158
Corsin @cocaman.ch · 24/11/2024
Discovered bsky-follow-finder.theo.io to find more interesting people to follow here
bsky-follow-finder.theo.io
Bluesky Network Analyzer
Find accounts that you don't follow (yet) but are followed by lots of accounts that you do follow.
020
Corsin @cocaman.ch · 23/11/2024
Lokal-Wahlen
020
Reposted by Corsin
Kyle Eaton @0xkyle.bsky.social · 19/11/2024
Yara rule to match concatenated zip files. I like this one (biased) because of how we are able to avoid matching nested zip files. More info: x.com/threatinsigh... #yara github.com/EmergingThre...
github.com
threatresearch/yara/zip_file.yara at master · EmergingThreats/threatresearch
I wanted to call this repo "Nuclear Football Codes". I was outvoted.. - EmergingThreats/threatresearch
2137
Corsin @cocaman.ch · 15/11/2024
I appreciate you sharing with the community.
020
Corsin @cocaman.ch · 13/11/2024
Trying to migrate 34 million SQL rows to an OpenSearch system. Time remaining: 1364 hours. I am sure there must be a better way :-D
020