iiinova — where your digital self keeps evolving

Orange Cyberdefense CERT

@ocd-cert.bsky.social

The CERT Orange Cyberdefense brings together experts on Cyber Threat Intelligence (CTI), Cybercrime Monitoring (MCM), Vulnerability Operation Center (VOC) and digital forensics and incident responders (CSIRT). www.orangecyberdefense.com

Posts Replies Media

Orange Cyberdefense CERT @ocd-cert.bsky.social · 20/11/2025

Our analysis covers updated #BURNBOOK and #MISTPEN variants, that feature slight changes in their main routines and C2 loop. UNC2970 relied on compromised infrastructure on SharePoint and WordPress, aligning with previous findings.

031

Orange Cyberdefense CERT @ocd-cert.bsky.social · 20/11/2025

🔎Our CERT is releasing a new technical report on 🇰🇵Operation #DreamJob, focusing on recent evolution in its tooling. Following an IR engagement at a large manufacturing client based in 🇪🇺, we investigated artefacts we attribute to #UNC2970. ➡️Full blog: ow.ly/V4mr50Xug1l

121

Orange Cyberdefense CERT @ocd-cert.bsky.social · 17/03/2025

During our analysis, we noticed a surprising line, likely written by threat actors to prevent AI-powered file scanning This is actually the first time we observed such an attempt, even though we found it to be unsuccessful with GPT-4o.

110

Orange Cyberdefense CERT @ocd-cert.bsky.social · 17/03/2025

🆕New version of #Emmenhtal loader actively distributed worldwide since early March, leading to #Lumma or #Rhadamanthys stealers. Very low AV detection on VT for now. Similarly to V2, Emmenhtal V3 masquerades as #mp3 or #mp4 files, including relaxation songs.🧘‍♀️

131

Orange Cyberdefense CERT @ocd-cert.bsky.social · 05/03/2025

🆕New version of our #ransomware mapping is out on our GitHub! ➡️https://github.com/cert-orangecyberdefense/ransomware_map/blob/main/OCD_WorldWatch_Ransomware-ecosystem-map.pdf V28 (!) includes latest newcomers and recent ecosystem evolutions.🔍 As always, feedback is welcome! #cti #threatintel

033