Pinned Tweet
For analysts and researchers: releasing a new advanced search query language and Search Sessions. Read the announcement:
validin.com/blog/validin_i…
validin.com/blog/validin_i…
0
0
2
4,875
Using Validin's Open Directories, a researcher uncovered an attacker's NetScaler exploit toolkit, revealing C2 infrastructure, exploitation techniques, and IOCs.
Discover attacker tooling, intent, and evolution with Validin's Open Directories.
mokki.sh/posts/2026-10-…
Discover attacker tooling, intent, and evolution with Validin's Open Directories.
mokki.sh/posts/2026-10-…
1
3
34
2,950
These findings reveal evolved weaponization of the existing watchTowr proof of concept with several novel enhancements in the Nuclei template.
0
1
1
667
Validin retweeted
To investigate this campaign, we used @anyrun_app to capture the gated delivery chain in action and @ValidinLLC to map the infrastructure behind it.
0
1
1
130
Validin retweeted
New Okta Vishing Theme: "Contact"
Themes switching: support -> claims -> report -> contact
Hunt for:
- contact-{org}.com
- {org}.contact
Tracked through @ValidinLLC
Themes switching: support -> claims -> report -> contact
Hunt for:
- contact-{org}.com
- {org}.contact
Tracked through @ValidinLLC
2
6
17
1,594
Validin retweeted
H/t again to @ValidinLLC and @500mk500. We got some great pivots through banner hashes and bouncing finds off maltrail.
Also some white glove assistance from @SreekarMad.
Also some white glove assistance from @SreekarMad.
Hijacked YouTube channels are pushing an emerging infostealer.
We're tracking #REVSTEALER: at least 17 compromised channels advertising free game cheats, funneling viewers to 2 malicious domains.
The stealer itself is built for long-term operation:
- Sandbox scoring: 10 erminates at a score of 7+
- App-Bound Encryption bypass: reads the decrypted key from browser memory under debugger control
- EtherHiding: fallback C2 stored in a Polygon smart contract, swappable without touching the binary
- Gaming focus: session cookies from Steam, Battlenet, and Roblox, feeding account resale markets
- 4,700 related samples hit VirusTotal in the past year.
Our team observed 4 follow-on modules that haven't been publicly documented until now.
Full analysis, whitepaper, YARA rule, and an IDAPython string decryption tool by @k33b0i, @soolidsnakee and @DanielStepanic:
Blog: go.es.io/4iJZRQe
Whitepaper: go.es.io/4xcanmZ
1
3
6
674
Validin retweeted
🫡 A strong LABScon salute to our partners at Validin for their generous support of the conference!
🔬 Validin is an internet intelligence and threat-hunting platform that helps security teams uncover and track malicious infrastructure using DNS, host and certificate data. validin.com/platform
🔬 Validin is an internet intelligence and threat-hunting platform that helps security teams uncover and track malicious infrastructure using DNS, host and certificate data. validin.com/platform
0
2
8
453
Researching 3 clusters recently reported by GTIG to find unreported fake banquet invitations, Google Drive links, and more.
Inhospitable: Tracking Russian Cyber Espionage Infrastructure validin.com/blog/inhospita…
Inhospitable: Tracking Russian Cyber Espionage Infrastructure validin.com/blog/inhospita…
0
2
5
1,777
❤️
I've probably said it before, but @ValidinLLC is seriously one of the most useful and underrated threat intel tools out there.
0
0
3
1,654
Validin retweeted
A Security Conversations interview with Kenneth Kinion, CEO at threat-intelligence firm Validin @ValidinLLC
open.spotify.com/episode/3aryz9…
open.spotify.com/episode/3aryz9…
2
6
12
1,448
Validin retweeted
7/16/26 packetwatch.com/resources/beyo… - This case study shows how to investigate malicious traffic and a threat actor's infrastructure, IP addresses, and domain indicators of compromise.
#validin @ValidinLLC #threatfeed #threatintelligence #threathunting #cybersecurity ttack #dfir #networksecurity #informationsecurity #teamsixty43
#validin @ValidinLLC #threatfeed #threatintelligence #threathunting #cybersecurity ttack #dfir #networksecurity #informationsecurity #teamsixty43
0
2
2
806
PacketWatch, a network threat-hunting and managed cybersecurity company, has both a research workflow and direct product integration with Validin. See how @packetwatch helps protect their customers with Validin in our latest case study:
validin.com/blog/packetwat…
validin.com/blog/packetwat…
0
1
0
2,192
Validin retweeted
We have improved our Oracle E-Business Suite fingerprinting by adding domain based scans in collaboration with @ValidinLLC. Around 950 exposed instances now seen globally (no vulnerability assessment). CVE-2026-46817 attempts have been observed in the wild by @DefusedCyber
2
10
22
5,683
With the World Cup in full swing, we dug into the IoCs from @GroupIB's Ghost Stadium report and found 3,079 domains still active in the past 14 days.
We've published the full list of 6,000+ suspected domains publicly. Full write-up below ⤵️
validin.com/blog/ghost_sta…
We've published the full list of 6,000+ suspected domains publicly. Full write-up below ⤵️
validin.com/blog/ghost_sta…
1
1
4
2,024
Read their report, with more technical breakdown of the mechanics of the campaign, here:
x.com/GroupIB/status…
x.com/GroupIB/status…
0
0
0
1,214
Validin retweeted
1/
Just came across this using @ValidinLLC searching for "Launch Meeting - Zoom"
domains hosting what looks like XSS > RCE > MS Signed > dropper.exe > miniplasma > more fun
@astrarce @Gi7w0rm @RussianPanda9xx @SquiblydooBlog @MsftSecIntel @banthisguy9349 @_JohnHammond
Just came across this using @ValidinLLC searching for "Launch Meeting - Zoom"
domains hosting what looks like XSS > RCE > MS Signed > dropper.exe > miniplasma > more fun
@astrarce @Gi7w0rm @RussianPanda9xx @SquiblydooBlog @MsftSecIntel @banthisguy9349 @_JohnHammond
3
7
11
2,495
Validin retweeted
Lets use this pivot point on @ValidinLLC
Title: Zoom Client Update
Reported to @abuse_ch
Telegram info
'bot_url' "6366434554:AAFV0fUvPM4BdKKUvMt9aQwg1nQ8MsxCpXE"
'chat_id' "588250349"
Title: Zoom Client Update
Reported to @abuse_ch
Telegram info
'bot_url' "6366434554:AAFV0fUvPM4BdKKUvMt9aQwg1nQ8MsxCpXE"
'chat_id' "588250349"
⚠️Observed phishing URLs delivering RMM payload:
Theme: Zoom
RMM: ScreenConnect
URL: hxxp://zoom.web-interviews[.]live
VBS Download URL: hxxps://zoom.web-interviews.live/download.php
SHA256:65208b731a5a0956a90d8cd415825123029712acdf240ab6d613154c4307c087
#ThreatIntel #Phishing #RMM
2
7
6
2,957
Validin retweeted
Validin's threat intelligence platform requires unfettered access to data, with affordable, high-performance storage, bandwidth, and scaling.
They’ve found that with Vultr Bare Metal, Cloud Compute, and File System.
See how @ValidinLLC wins with Vultr: blogs.vultr.com/validin-case-s…
They’ve found that with Vultr Bare Metal, Cloud Compute, and File System.
See how @ValidinLLC wins with Vultr: blogs.vultr.com/validin-case-s…
0
2
1
1,653
Six months after @DJSnM and @_JohnHammond were targeted with a fake "DMCA takedown" campaign, we revisit old pivots and find some new connections.
validin.com/blog/dmca_phis…
validin.com/blog/dmca_phis…
0
4
12
4,878
Validin retweeted
#PIVOTcon26 edition is over! Time to #pivot to #PIVOTcon27
Big thanks to our sponsors for making this happen!
@silentpush @vtxproject @censysio @urlscanio @ValidinLLC @TalosSecurity @abuse_ch @SpamhausTech @ecrime_ch @epieos @sekoia_io @wearetlpblack @webscout_io @rationaledge 1/
Big thanks to our sponsors for making this happen!
@silentpush @vtxproject @censysio @urlscanio @ValidinLLC @TalosSecurity @abuse_ch @SpamhausTech @ecrime_ch @epieos @sekoia_io @wearetlpblack @webscout_io @rationaledge 1/
3
6
20
2,341