iiinova — where your digital self keeps evolving

Tom @tom.wicked.design · 15/12/2025

Der Notepad++-Updater konnte umgeleitet werden und lud #Malware. Aus dem Grund kombinieren wir #Cybersecurity mit #IT-Betrieb und #Audit & #Compliance. Unsere Plattform erlaubt es tausende von Softwarepaketen einfach zu durchsuchen. Deswegen ist die Plattform auch offen für unsere Kunden:innen

Screenshot unsere Cybersecurity und IT-Plattform.

Screenshot unsere Cybersecurity und IT-Plattform mit einer Suchmaske über die Notepad Softwarepakete gesucht wurden und in einer Liste dargestellt werden.

110

Tom @tom.wicked.design · 20/10/2025

#Scattered #LAPSUS$ #Hunters #SLH website shinyhunte[.]rs disapeared and is displaying a personal warning message. #ScatteredLAPSUS$Hunters #Cybercrime

010

Tom @tom.wicked.design · 15/10/2025

Deswegen bin ich auch sehr skeptisch ob der Selbsteinschätzung der Firmen im Wirtschaftsschutz 2025 Bericht der @bitkom.org. Gerade im Mittelstand, aber auch in grossen Orgs, sehen wir noch immer einen IT Fokus. Kaum jemand verfügt über die CISO Rolle, und wenn dann meist wieder nur in der IT.

Balkendiagramm zeigt die Wahrnehmung von Cyberbedrohungen in deutschen Unternehmen. Links: 50% der Unternehmen halten sich für sehr gut vorbereitet (2024: 53%). Rechts: Anstieg der Unternehmen, die Cyberangriffe als existenzbedrohend einstehen - von 9% (2021) über 45% (2022), 52% (2023), 65% (2024) auf 59% (2025). Quelle: Bitkom Research 2025.

110

Tom @tom.wicked.design · 15/10/2025

#Cyber ist so lange ein IT Thema bis im Betrieb nichts mehr geht. IMHO einer der wichtigsten Punkte im neuen Bericht des @ncsc.gov.uk - und etwas was in den meisten Organisationen noch immer nicht angekommen ist. #Cybersecurity ist #Business!

Screenshot of pdf report. It is the portrait of Richard Horne — CEO, NCSC

With the quote above his head:
For too long, cyber security has been
regarded as an issue predominantly
for technical staff. This must change.
All business leaders need to take
responsibility for their organisation’s
cyber resilience.’

130

Tom @tom.wicked.design · 13/08/2025

#StreetParade, #MobileDeviceManagement und #Risiken - warum ein #MDM alleine nicht reicht 📲 >800k Leute feierten an der weltgrössten Techno Parade in Züri. Darunter auch einige Diebe mit Fokus Mobiltelefone. Den Geräten wurde direkt die SIM-Karte entfernt und sie in Alufolie gewickelt.

110

Tom @tom.wicked.design · 28/07/2025

Seems like quite some internal systems were infected by InfoStealers. Quite the irony given the fact that #infostealer like #Lumma, #RedLine, #Raccoon, #Vidar are russion developed and operated #CybercrimeAsaService platforms.

000

Tom @tom.wicked.design · 28/07/2025

#Aeroflot airline got hacked by two pro-ukranian groups, #SilentCrow and #Cyberpartisans. 🛫🚫 🚩 7`000 servers — physical & virtual — destroyed. 🚩 Compromise of 122 hypervisors, 43 installations of ZVIRT virtualization, ~100 iLO interfaces, & 4 Proxmox clusters. #Ukraine 🇺🇦

120

Tom @tom.wicked.design · 08/05/2025

Lockbit confirmed: "On 7 May, someone hacked the light panel with auto registration for all comers, stole the database, but not a single decryptor and not a single company's stolen data were compromised. I'm investigating how they managed to hack it and rebuilding it now. 1/2

100

Tom @tom.wicked.design · 08/05/2025

It reveals the brutal reality of ransomware attacks. They are even attacking #schools: "Dude, we’re #non-profit, educating children,". Another victim begs: "Dear, $40k is my 6-year salary... Don't spoil my life." Just remember when #ALPHV / #BlackCat ransomed a breast cancer clinc.

100

Tom @tom.wicked.design · 08/05/2025

#LockBit #ransomware got breached and leaked tonight. A hacker called "kho-kho" (allegedly from Prague 🇨🇿) breached their panel & leaked a 30MB SQL dump containing: 💶 ~ 60K BTC addresses 💬 Negotiation chats with their victims 🛠️ Build info (dating back to Dec 2024) 📈 Client lists, etc.

100

Tom @tom.wicked.design · 26/02/2025

After some analysis the campaign appears to use Tycoon2FA Phishing Kit. The website is loading O365 assets from oktacdn[.]com This domain has been attributed to Tycoon before. Any.Run: any.run/cybersecurit... Others like JoeSandbox or Hybrid Analysis currently label it as clean

100

Tom @tom.wicked.design · 26/02/2025

We currently see an uprising in Adobe QR code based phishing for MS O365 creds 🎣 Recipiens are named, TA apparently did some intel: ▶️ Company name ▶️ Employee names (First and Last) #Phishing #Adobe #O365 #Microsoft #Cybersecurity #Awareness

100

Tom @tom.wicked.design · 19/01/2025

Ich war in Bucha🇺🇦, habe mit den Menschen dort gesprochen, gesehen was die Russen verbrochen haben. Menschen haben mir von den Verbrechen erzählt. Und in der sicheren 🇨🇭sitzen Handlanger der Kriegsverbrecher wie Köppel. #SlavaUkraini #Ukraine

Destroyed house in Ukraine. Bombed by Russian aggressors in their war of aggression.

Burned out car in Bucha, Ukraine. Bombed by Russian aggressors in their war of aggression.

Memorial in Bucha, Ukraine. In remembrance of the victims of the massacres

020

Tom @tom.wicked.design · 18/01/2025

Genau das! Traurigstes Beispiel ist der institutionelle Rassismus in CH. www.edi.admin.ch/edi/de/home/...

000

Tom @tom.wicked.design · 18/01/2025

Apparent threat actor: agricamex[.]com 🎣 We observed this domain cloning #MS #Azure #Entra ID websites of our clients. Domain fronted by #Cloudflare, registered by #GoDaddy. Cert transparency logs shows activiy since around 2025-01-12. Inc. #Okta, #ADFS, #SCP, #outlook and #O365

100

Tom @tom.wicked.design · 29/12/2024

cat.exe stopped working. Resource exhaustion. Chilling after Christmas 🎄 🐈 #cat #catsofbsky #christmas #AdoptDontShop #AnimalRescue #tierschutz

060

Tom @tom.wicked.design · 20/12/2024

It is this time of the year again - happy holidays 🎄, merry Christmas 🎅🏻 and a lovely festive season to all our friends, partners and clients! We don’t print physical cards or send out fancy gifts, we make a donation to an amazing organisation 👉🏻 www.limon-vergessene-seelen.de

Black and white image of cat sitting in front of PC screen - looking at password manager manual.

Black and white image of cat laying on desktop, in front of PC screen with LimeRat Ransomware.

110

Tom @tom.wicked.design · 14/12/2024

Der Besuch in Bucha war unglaublich bedrückend. Die Schilderungen über die wahllosen Morde, Misshandlungen und Zerstörungen. Währenddessen erklären wir Menschen das sie doch einfach wieder gehen sollen.

010

Tom @tom.wicked.design · 11/12/2024

Every time my students ask me why cyber-sec is more then just internal IT and protection of data. #InfoSec #CyberSecurity #Academia #Students #Lecturing

110

Tom @tom.wicked.design · 28/11/2024

Best coworker. He just needs to improve his credential management 😼 #Cat #CatsOfBsky #cyber

Image of cat looking at a screen with documentation for a password manager

0131

Tom @tom.wicked.design · 22/11/2024

🤷 Ach naja, das mit diesem DMARC und co. ist ja auch nicht so wichtig.

120

Tom @tom.wicked.design · 21/11/2024

For some of those mSpy clients you even get their account to darknet drug marketplaces 🤦 At least you get their BitDefender account as well 😂

000

Tom @tom.wicked.design · 21/11/2024

mSpy - #stalkerware for everyone. From parents to lovers and companies. Truly worrying documentation by Swiss television. The thing is, the bad OpSec of those people exposes their victims to an even greater threat - #InfoStealer #malware. For just $10 I can buy access to peoples #mSpy account.

Screenshot of russian darknet forum selling stolen credentials. Highlighted entry for cart.mspy.com

Screenshot of russian darknet forum selling stolen credentials. Highlighted entry for my.mspyonline.om

Screenshot of russian darknet forum selling stolen credentials. Highlighted entry for a darkent market.

100

Tom @tom.wicked.design · 05/12/2023

Swiss city of #Baden gets pwned and data is leaked by #DragonForce #Ransomware

Screenshot of a cybercrime forum posting, showing the poster "DragonForce" and the onion link to the download website, where data of the city of Baden in Switzerland can be found.

100

Tom @tom.wicked.design · 06/11/2023

A cyber-attack on a German municipality IT serivce provider now affects more than 100 cities, municipalities and districts kommunaler-notbetrieb.de/2023/10/30/e...

Map of North-Rine Westfalia in Germany. It shows 103 red markers, indicating cities, municipalities and districts taken offline by the cyber-attack.

000

Tom @tom.wicked.design · 31/10/2023

Tell you sisters, wives, daughters to delete their tracking apps. Don‘t use google to search for assistance. Use Startpage.com for example. Don‘t use Google Maps or similar to navigate. Don‘t use FB, Insta, or any other social media to communicate. Use Threema.ch and delete chats.

Screenshot from the article that says: Lord told Tortoise he was aware of cases of blood tests being taken with the woman’s consent by NHS staff at the request of police, including, he said, “when women knew they were innocent after suffering an unexpected premature delivery”.

Screenshot from the article that says: Even when the test finds no trace of abortion medication women can continue to remain under suspicion “as a negative test does not exclude earlier use of drugs”, he said. In that event, he argued, “the only motivation for testing is entrapment”.

000

Tom @tom.wicked.design · 30/10/2023

Wake up sheeple! If it flies, it spies!

131

Tom @tom.wicked.design · 20/10/2023

One of the things infosec is missing is story telling. We need to get better to convey our concerns & thoughts. Dashboards & honeypots can be one good example. Why care about internet facing assets? Why care about MFA? Well, because this is what 7 days of a server on the internet looks like

Screenshot of a honeypot dashboard with various graphs.
It visualizes the attack attempts of a server over the course of 7 days.
Most notably it has about 400.000 attempts to login or otherwise exploit exposed services on the server. China and the Unites States are to top two countries for attacks.

011

Tom @tom.wicked.design · 19/10/2023

Am Sonntag ist es soweit,🇨🇭wählt! Wir brauchen zukunftsfähige & lösungsorientierte Politiker:innen, wie @bglaettli.bsky.social & @rahelestermann.bsky.social 💚 Wir brauchen jede Stimme! ✅

Screenshot der Website: https://ecorating.ch/de/find?type=abstimmungsverhalten-eidgenossisch&group=51-legislatur-2019-2023-nationalrat

Sie zeigt das Abstimmungsverhalten der Schweizer Parteien. Auf der linken Seite eine Liste aller Parteien und ihr Abstimmungsverhalten in Umweltfragen. Ganz oben die Grüne mit 99.2% umweltfreundlich, unten SVP mit 4% auf dem letzten Platz.
Rechts sind die Daten über ein Diagramm visualisiert.

Liste der Politiker:innen der Grüne Schweiz und ihr Umweltrating. Alle haben 100% Prozent.

121

Tom @tom.wicked.design · 18/10/2023

Ist ihr echter Handle :/

100

Tom @tom.wicked.design · 18/10/2023

The strangest thing about the #MotelOne hotel chain breach by #Alphv / #BlackCat, the passwords. 88Illuminati!, Illuminati2022, Illuminati2023!!. 88? Srsly? Illuminati? Was ist da los bei Motel One in Köln? Free advice: Excel is not a password manager! #InfoSec #Ransomware #Cybercrime

Screenshot of an excel sheet, posted on a ransomware website.
It shows usernames and passwords. Three passwords are circled in red and contain conspiracy theory name Illuminati.

110