iiinova — where your digital self keeps evolving

Tom @tom.wicked.design · 15/12/2025

Und im Gegensatz zu klassischen #MSSP managed security service providern ist sie keine Blackbox. Bei uns bekommt ihr Zugang zu euren Daten und könnt mit ihnen Arbeiten und für euren Alltag nutzen.

010

Tom @tom.wicked.design · 15/12/2025

Mit @wicked.design möchte ich nicht nur mehr Sicherheit schaffen, sondern auch den Alltag in #KMU vereinfachen. Der IT-Betrieb hat mittlerweile dutzende von Tools, die Compliance Anforderungen steigen, deswegen haben wir unsere Cyber Defence & IT Operations (CDI) Plattform gebaut.

110

Tom @tom.wicked.design · 15/12/2025

Der Notepad++-Updater konnte umgeleitet werden und lud #Malware. Aus dem Grund kombinieren wir #Cybersecurity mit #IT-Betrieb und #Audit & #Compliance. Unsere Plattform erlaubt es tausende von Softwarepaketen einfach zu durchsuchen. Deswegen ist die Plattform auch offen für unsere Kunden:innen

Screenshot unsere Cybersecurity und IT-Plattform.

Screenshot unsere Cybersecurity und IT-Plattform mit einer Suchmaske über die Notepad Softwarepakete gesucht wurden und in einer Liste dargestellt werden.

110

Tom @tom.wicked.design · 20/10/2025

#Scattered #LAPSUS$ #Hunters #SLH website shinyhunte[.]rs disapeared and is displaying a personal warning message. #ScatteredLAPSUS$Hunters #Cybercrime

010

Tom @tom.wicked.design · 15/10/2025

Daraus ergibt sich ein sehr enger Blick rein auf die Technik. Und natürlich möchte man seinen eigenen Bereich auch bestmöglich darstellen. Was am Ende zu grösseren Problemen führt. 🔗: - www.ncsc.gov.uk/files/ncsc-a... - www.bitkom.org/sites/main/f...

bitkom.org

010

Tom @tom.wicked.design · 15/10/2025

Deswegen bin ich auch sehr skeptisch ob der Selbsteinschätzung der Firmen im Wirtschaftsschutz 2025 Bericht der @bitkom.org. Gerade im Mittelstand, aber auch in grossen Orgs, sehen wir noch immer einen IT Fokus. Kaum jemand verfügt über die CISO Rolle, und wenn dann meist wieder nur in der IT.

Balkendiagramm zeigt die Wahrnehmung von Cyberbedrohungen in deutschen Unternehmen. Links: 50% der Unternehmen halten sich für sehr gut vorbereitet (2024: 53%). Rechts: Anstieg der Unternehmen, die Cyberangriffe als existenzbedrohend einstehen - von 9% (2021) über 45% (2022), 52% (2023), 65% (2024) auf 59% (2025). Quelle: Bitkom Research 2025.

110

Tom @tom.wicked.design · 15/10/2025

#Cyber ist so lange ein IT Thema bis im Betrieb nichts mehr geht. IMHO einer der wichtigsten Punkte im neuen Bericht des @ncsc.gov.uk - und etwas was in den meisten Organisationen noch immer nicht angekommen ist. #Cybersecurity ist #Business!

Screenshot of pdf report. It is the portrait of Richard Horne — CEO, NCSC

With the quote above his head:
For too long, cyber security has been
regarded as an issue predominantly
for technical staff. This must change.
All business leaders need to take
responsibility for their organisation’s
cyber resilience.’

130

Tom @tom.wicked.design · 13/08/2025

Was wollen wir schützen? Was haben wir für, regulatorische, Anforderungen? Wogegen wollen wir es schützen (was kann tatsächlich passiern)? Und vor allem, was machen wir wenn es passiert? Deswegen liefern wir nicht nur Excel Listen, sondern diskutieren mit unseren Kundinnen & Kunden!💪

000

Tom @tom.wicked.design · 13/08/2025

Somit besteht auch keine oder kaum mehr die Möglichkeit für ein MDM den angedachten remote wipe durchzuführen. Genau deswegen lohnt es ernsthaftes #Risikomanagement.

100

Tom @tom.wicked.design · 13/08/2025

Häufig höre ich bei Kunden:innen: "Wir haben ein MDM, damit wir Geräte remote löschen können!" Die Idee ist gut, und häufig auch durch Compliance gefordert. Bis der Ernstfall eintritt. SIM-Karte weg, Netzverbindung getrennt 📵 Durch die Alufolie blockiert man WiFi 🛜, GPS🛰️

100

Tom @tom.wicked.design · 13/08/2025

#StreetParade, #MobileDeviceManagement und #Risiken - warum ein #MDM alleine nicht reicht 📲 >800k Leute feierten an der weltgrössten Techno Parade in Züri. Darunter auch einige Diebe mit Fokus Mobiltelefone. Den Geräten wurde direkt die SIM-Karte entfernt und sie in Alufolie gewickelt.

110

Tom @tom.wicked.design · 28/07/2025

Seems like quite some internal systems were infected by InfoStealers. Quite the irony given the fact that #infostealer like #Lumma, #RedLine, #Raccoon, #Vidar are russion developed and operated #CybercrimeAsaService platforms.

000

Tom @tom.wicked.design · 28/07/2025

🚩 Data obtained includes 12TB of databases, 8TB of files from Windows Share, and 2TB of corporate email. Passengers flight data has also been exfiltrated and is available for researchers for further analysis. www.linkedin.com/posts/wicked...

linkedin.com

Aeroflot suffers massive outage of their IT systems. | Tom H.

Aeroflot suffers massive outage of their IT systems. 🛬🚫 Two groups, Silent Crow and Cyberpartisans BY, claim responsibility in support of Ukraine🇺🇦. 🚩 7,000 servers — physical and virtual — were de...

110

Tom @tom.wicked.design · 28/07/2025

#Aeroflot airline got hacked by two pro-ukranian groups, #SilentCrow and #Cyberpartisans. 🛫🚫 🚩 7`000 servers — physical & virtual — destroyed. 🚩 Compromise of 122 hypervisors, 43 installations of ZVIRT virtualization, ~100 iLO interfaces, & 4 Proxmox clusters. #Ukraine 🇺🇦

120

Tom @tom.wicked.design · 08/05/2025

Full panel and blog are still functioning. The hacker supposedly goes by "kho-kho" from Prague. Let me know who he is—I'll pay real money if the information is genuine." 2/2

000

Tom @tom.wicked.design · 08/05/2025

Lockbit confirmed: "On 7 May, someone hacked the light panel with auto registration for all comers, stole the database, but not a single decryptor and not a single company's stolen data were compromised. I'm investigating how they managed to hack it and rebuilding it now. 1/2

100

Tom @tom.wicked.design · 08/05/2025

It reveals the brutal reality of ransomware attacks. They are even attacking #schools: "Dude, we’re #non-profit, educating children,". Another victim begs: "Dear, $40k is my 6-year salary... Don't spoil my life." Just remember when #ALPHV / #BlackCat ransomed a breast cancer clinc.

100

Tom @tom.wicked.design · 08/05/2025

#LockBit #ransomware got breached and leaked tonight. A hacker called "kho-kho" (allegedly from Prague 🇨🇿) breached their panel & leaked a 30MB SQL dump containing: 💶 ~ 60K BTC addresses 💬 Negotiation chats with their victims 🛠️ Build info (dating back to Dec 2024) 📈 Client lists, etc.

100

Tom @tom.wicked.design · 26/02/2025

After some analysis the campaign appears to use Tycoon2FA Phishing Kit. The website is loading O365 assets from oktacdn[.]com This domain has been attributed to Tycoon before. Any.Run: any.run/cybersecurit... Others like JoeSandbox or Hybrid Analysis currently label it as clean

100

Tom @tom.wicked.design · 26/02/2025

For anyone interested, here is the sourcode of the phishing site - heavily obfuscated: drive.proton.me/urls/3Z8SZZN...

drive.proton.me

Proton Drive

Securely store, share, and access your important files and photos. Anytime, anywhere.

000

Tom @tom.wicked.design · 26/02/2025

Be cautious: As the QR code is ment to be scanned via smartphone, DNS and firewall blocking might have a limited effect! IOCs: ▶️ [01] no-reply@nepalpottery[.]com ▶️ [02] 864b5744a8e3e6f83afff7bd2c6.altedsx… ▶️ [03] w5vv.mdernstyle[.]ru

100

Tom @tom.wicked.design · 26/02/2025

Defender apparently picks up on it while other mail filters currently let it pass. Recommended actions: ▶️ Implement a block filter for the nepalpottery ▶️ Implementation of DNS filtering should be implemented. ▶️ Inform your organisation about the current situation.

100

Tom @tom.wicked.design · 26/02/2025

It contains a lure about an updated company handbook and a QR code. The QR code leads to Cloudflare protected website [02]. It then forwards to a Microsoft Microsoft 365 themed phishing website [03].

100

Tom @tom.wicked.design · 26/02/2025

The sender is the compromised mail account Nepal pottery [01]. The subject follows a certain pattern: <ORG-NAME>-2025 Q1 Staff Pay Adjustment Handbook-<NUMBER>

100

Tom @tom.wicked.design · 26/02/2025

We currently see an uprising in Adobe QR code based phishing for MS O365 creds 🎣 Recipiens are named, TA apparently did some intel: ▶️ Company name ▶️ Employee names (First and Last) #Phishing #Adobe #O365 #Microsoft #Cybersecurity #Awareness

100

Reposted by Tom

netzpolitik.org @netzpolitik.org · 27/01/2025

Mit Überwachungs-Programmen wie mSpy können Privatpersonen einander ausspionieren. Wir erklären, wie man solche Angriffe aufdecken und abwehren kann. netzpolitik.org/2025/mspy-le... Alle Beiträge zum #mSpyLeak: netzpolitik.org/mspy-leak/

netzpolitik.org

mSpy-Leak: So stoppt man Spionage-Apps

Mit Überwachungs-Programmen wie mSpy können Privatpersonen einander ausspionieren. Wir erklären, wie man solche Angriffe aufdecken und abwehren kann.

38130

Tom @tom.wicked.design · 26/01/2025

What is the problem of people and companies with the concept „a better place for all of us - no matter who you are“. It doesn‘t hurt anyone, but it helps people who are already marginalized.

000

Reposted by Tom

Eric Geller @ericjgeller.com · 21/01/2025

DHS has terminated the memberships of everyone on its advisory committees. This includes several cyber committees, like CISA's advisory panel and the Cyber Safety Review Board, which was investigating Salt Typhoon. That review is "dead," person familiar says. www.documentcloud.org/documents/25...

501059595

Tom @tom.wicked.design · 22/01/2025

US president pardons drug market founder and operator to “ honor of her [mother] and the Libertarian Movement, which supported me so strongly”. What a singal to law enforcement, law abiding citizens and everyone who works to make our society a safer and healthier place. #SilkRoad

010

Tom @tom.wicked.design · 19/01/2025

Ich war in Bucha🇺🇦, habe mit den Menschen dort gesprochen, gesehen was die Russen verbrochen haben. Menschen haben mir von den Verbrechen erzählt. Und in der sicheren 🇨🇭sitzen Handlanger der Kriegsverbrecher wie Köppel. #SlavaUkraini #Ukraine

Destroyed house in Ukraine. Bombed by Russian aggressors in their war of aggression.

Burned out car in Bucha, Ukraine. Bombed by Russian aggressors in their war of aggression.

Memorial in Bucha, Ukraine. In remembrance of the victims of the massacres

020

Tom @tom.wicked.design · 18/01/2025

Genau das! Traurigstes Beispiel ist der institutionelle Rassismus in CH. www.edi.admin.ch/edi/de/home/...

000

Tom @tom.wicked.design · 18/01/2025

The inspiration for the domain apparently came from agricamex[.]cl - a Chile food company. Might be a south american TA.

000

Tom @tom.wicked.design · 18/01/2025

Apparent threat actor: agricamex[.]com 🎣 We observed this domain cloning #MS #Azure #Entra ID websites of our clients. Domain fronted by #Cloudflare, registered by #GoDaddy. Cert transparency logs shows activiy since around 2025-01-12. Inc. #Okta, #ADFS, #SCP, #outlook and #O365

100

Reposted by Tom

Jason Koebler @jasonkoebler.bsky.social · 09/01/2025

We had to evacuate Los Angeles. Most people I know there have also had to leave. We are safe in San Diego and our apartment is unlikely to burn down. We are very lucky. But alongside the visceral horror of the wildfires there is also the mundanity of dystopia www.404media.co/were-fine-lo...

404media.co

‘We’re Fine’: Lying to Ourselves About a Climate Disaster

The dystopia of Los Angeles' fires are horrifying, mundane, and everything in between.

22617140

Reposted by Tom

C3VOC releases @media.ccc.de · 29/12/2024

Wir wissen wo dein Auto steht - Volksdaten von Volkswagen has been released on media.ccc.de media.ccc.de/v/38c3-wir-wissen-wo-d… events.ccc.de/congress/2024/hub/eve…

021

Reposted by Tom

Matthew Green @matthewdgreen.bsky.social · 29/12/2024

I love that Apple is trying to do privacy-related services, but this just appeared at the bottom of my Settings screen over the holiday break when I wasn’t paying attention. It sends data about my private photos to Apple.

39344162

Tom @tom.wicked.design · 29/12/2024

cat.exe stopped working. Resource exhaustion. Chilling after Christmas 🎄 🐈 #cat #catsofbsky #christmas #AdoptDontShop #AnimalRescue #tierschutz

060

Tom @tom.wicked.design · 28/12/2024

So with the docker you might have to install the agent separately on the main server OS. This way you can get all the info directly forwarded to the Docker. And setup additional monitoring.

110

Tom @tom.wicked.design · 27/12/2024

Not sure if you got an answer already, but right now (before 5.0 next year) the agent is included. So it should be all there in one place.

110

Tom @tom.wicked.design · 27/12/2024

Die elektronische Patientenakte - ein jahrelanges Trauerspiel. Wie so oft "Es kann nicht sein was nicht sein darf!" 🙊🙈🙉 Politische Entscheidungen & ihre Auswirkungen auf unser aller (Cyber)Sicherheit. What about 🇨🇭 Elektronisches Patientendossier (EPDG) 🤔 ogy.de/rpag #38C3 #CCC #Gematik #ePA

events.ccc.de

010

Reposted by Tom

UK Defence Journal @ukdefencejournal.org.uk · 20/12/2024

BREAKING - A tragic vehicle-ramming attack occurred this evening at a Christmas market in Magdeburg, Germany, resulting in the deaths of two people and injuries to at least 60 others. ukdefencejournal.org.uk/lethal-car-r...

ukdefencejournal.org.uk

Lethal car ramming attack at German Christmas market

BREAKING - A tragic vehicle-ramming attack occurred this evening at a Christmas market in Magdeburg, Germany, resulting in the deaths of two people and injuries to at least 60 others.

194

Tom @tom.wicked.design · 20/12/2024

🔹In December I was able to onboard my first colleague, expanding our team to Spain 🇪🇸 What a wild ride. Never would I have thought we go international within the first year as a bootstrapped startup 🚀

100

Tom @tom.wicked.design · 20/12/2024

🔹Together with #Threema, we did some great talks and events - resulting in our first integration of Threema and our Cyber Defence Center (#CDC).

000

Tom @tom.wicked.design · 20/12/2024

🔹In summer, we organised the first remote lecture at #KNU, giving students from Ukraine and Poland an introduction to cyber-security, threat actors and current activities in the cyberspace. 🔹Together with #FHNW and #UZH, we did some amazing lectures on cyber-security and #OSINT.

100