Cedric Pernet
@cedricpernet.bsky.social
Senior Threat Researcher @ Proofpoint.
Cybercrime / Cyberespionage aficionado.
Has worked in several CSIRTs/CERTs.
Metal & Rock dude, never enough guitars.
Motorcycles fan.
Wrote a book in French language on cyberespionage.
Ex-Law Enforcement Officer
Cybercrime / Cyberespionage aficionado.
Has worked in several CSIRTs/CERTs.
Metal & Rock dude, never enough guitars.
Motorcycles fan.
Wrote a book in French language on cyberespionage.
Ex-Law Enforcement Officer
Common mistake for some CTI people: flagging a web provider's parking IP addresses as malicious. Please check carefully. This can lead to total nonsense attribution/pivots when unverified. #fail #ThreatIntelligence
December 11, 2025 at 8:26 AM
Common mistake for some CTI people: flagging a web provider's parking IP addresses as malicious. Please check carefully. This can lead to total nonsense attribution/pivots when unverified. #fail #ThreatIntelligence
Reposted by Cedric Pernet
Brian Krebs identified the real-world identity of Rey, a key administrator of Scattered Lapsus$ Hunters, a hacking group blamed for dozens of high profile hacks.
The hacker, identified as a Jordanian teenager, agreed to be interviewed after Krebs tracked him down and contacted his father.
The hacker, identified as a Jordanian teenager, agreed to be interviewed after Krebs tracked him down and contacted his father.
Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’
A prolific cybercriminal group that calls itself "Scattered LAPSUS$ Hunters" made headlines regularly this year by stealing data from and publicly mass extorting dozens of major corporations. But the ...
krebsonsecurity.com
November 26, 2025 at 5:50 PM
Brian Krebs identified the real-world identity of Rey, a key administrator of Scattered Lapsus$ Hunters, a hacking group blamed for dozens of high profile hacks.
The hacker, identified as a Jordanian teenager, agreed to be interviewed after Krebs tracked him down and contacted his father.
The hacker, identified as a Jordanian teenager, agreed to be interviewed after Krebs tracked him down and contacted his father.
Reposted by Cedric Pernet
NEW: Myanmar has made a big show of destroying the notorious KK Park scam compound—even publishing a video of a steamroller driving over thousands of phones
But new images show buildings are only destroyed in one area. Hundreds are left untouched and experts say the crackdown is mostly propaganda
But new images show buildings are only destroyed in one area. Hundreds are left untouched and experts say the crackdown is mostly propaganda
The Destruction of a Notorious Myanmar Scam Compound Appears to Have Been ‘Performative’
Myanmar’s military has been blowing up parts of the KK Park scam compound. Experts say the actions are likely for show.
www.wired.com
November 26, 2025 at 5:11 PM
NEW: Myanmar has made a big show of destroying the notorious KK Park scam compound—even publishing a video of a steamroller driving over thousands of phones
But new images show buildings are only destroyed in one area. Hundreds are left untouched and experts say the crackdown is mostly propaganda
But new images show buildings are only destroyed in one area. Hundreds are left untouched and experts say the crackdown is mostly propaganda
Reposted by Cedric Pernet
Le géant de l’informatique HP annonce la suppression de 4 000 à 6 000 emplois d’ici 2028 du fait de l’IA
Le géant de l’informatique HP annonce la suppression de 4 000 à 6 000 emplois d’ici 2028 du fait de l’IA
C’est l’une des premières fois qu’une entreprise de taille importante fait publiquement un lien direct entre des réductions de personnel et la mise en place d’outils IA.
www.lemonde.fr
November 26, 2025 at 3:43 AM
Le géant de l’informatique HP annonce la suppression de 4 000 à 6 000 emplois d’ici 2028 du fait de l’IA
Charming Kitten exposed: spy unit led Iran’s surveillance for deadly plots - content.iranintl.com/secret-spy-u...
November 26, 2025 at 6:41 AM
Charming Kitten exposed: spy unit led Iran’s surveillance for deadly plots - content.iranintl.com/secret-spy-u...
Reposted by Cedric Pernet
Incroyable histoire dévoilé par @theguardian.com : "Rise of the ‘porno-trolls’: how one porn platform made millions suing its viewers" www.theguardian.com/society/ng-i...
Rise of the ‘porno-trolls’: how one porn platform made millions suing its viewers
A company called Strike 3, owner of Vixen and Tushy, has clogged US courts with lawsuits, mostly against porn watchers who feel shamed into settling privately
www.theguardian.com
November 5, 2025 at 9:04 AM
Incroyable histoire dévoilé par @theguardian.com : "Rise of the ‘porno-trolls’: how one porn platform made millions suing its viewers" www.theguardian.com/society/ng-i...
My thought of the day: all registrars should rethink their registration processes, so that automatic registration cannot be done that easily by cybercriminals. Some of them register hundreds of domains every day... #fightautomation #cybercrime
November 5, 2025 at 8:41 AM
My thought of the day: all registrars should rethink their registration processes, so that automatic registration cannot be done that easily by cybercriminals. Some of them register hundreds of domains every day... #fightautomation #cybercrime
Well some people here asked me where the hell I have been. To make it short: lot of good work (not public), and getting separated from my wife. So, quite a hot-cold situation. Will try to come more often here and start spreading cybercrime/APT stuff again.
November 5, 2025 at 8:22 AM
Well some people here asked me where the hell I have been. To make it short: lot of good work (not public), and getting separated from my wife. So, quite a hot-cold situation. Will try to come more often here and start spreading cybercrime/APT stuff again.
Infamous BreachForums Is Back Online With All Old Accounts and Posts Restored - cybersecuritynews.com/breachforums...
#cybercrime
#cybercrime
July 27, 2025 at 8:41 AM
Infamous BreachForums Is Back Online With All Old Accounts and Posts Restored - cybersecuritynews.com/breachforums...
#cybercrime
#cybercrime
Reposted by Cedric Pernet
NEW: Data broker sites were allegedly used by the Minnesota shooting suspect, authorities claim, highlighting the danger of an industry that freely sells your personal information. @lhn.bsky.social reports www.wired.com/story/minnes...
Minnesota Shooting Suspect Allegedly Used Data Broker Sites to Find Targets' Addresses
The Minnesota shooter allegedly researched several “people search” sites in an attempt to target his victims, highlighting the potential dangers of widely available personal data.
www.wired.com
June 17, 2025 at 2:25 AM
NEW: Data broker sites were allegedly used by the Minnesota shooting suspect, authorities claim, highlighting the danger of an industry that freely sells your personal information. @lhn.bsky.social reports www.wired.com/story/minnes...
Reposted by Cedric Pernet
We recently discovered an infostealer in our data that we originally dubbed "Aurotun," named for a misspelling of "autorun" in its strings.
After collab w/ @intel471.bsky.social, @malwareindepth.com & others, we believe this malware is actually MonsterV2, a newer version of an existing infostealer.
After collab w/ @intel471.bsky.social, @malwareindepth.com & others, we believe this malware is actually MonsterV2, a newer version of an existing infostealer.
June 5, 2025 at 9:07 PM
We recently discovered an infostealer in our data that we originally dubbed "Aurotun," named for a misspelling of "autorun" in its strings.
After collab w/ @intel471.bsky.social, @malwareindepth.com & others, we believe this malware is actually MonsterV2, a newer version of an existing infostealer.
After collab w/ @intel471.bsky.social, @malwareindepth.com & others, we believe this malware is actually MonsterV2, a newer version of an existing infostealer.
Reposted by Cedric Pernet
Tu envoies des e-mails de phishing usurpant Le Monde ?
@flrnd.bsky.social et @okami.bsky.social retrouvent ton adresse e-mail.
@flrnd.bsky.social et @okami.bsky.social retrouvent ton adresse e-mail.
Qui organise les campagnes d’hameçonnage visant les abonnés du « Monde » et de « Télérama » ?
Des tentatives d’arnaques avec des messages piégés ont ciblé, ces dernières semaines, les abonnés de plusieurs grands journaux, dont « Le Figaro » ou « Le Monde ». La trace des pirates mène en France.
www.lemonde.fr
April 30, 2025 at 8:04 AM
Tu envoies des e-mails de phishing usurpant Le Monde ?
@flrnd.bsky.social et @okami.bsky.social retrouvent ton adresse e-mail.
@flrnd.bsky.social et @okami.bsky.social retrouvent ton adresse e-mail.
Very happy and proud that one of my "weekend research" has been exposed in an article from Le Monde.
I had spent some time during my short unemployed period to dig into #Traffyque infrastructure.
www.lemonde.fr/pixels/artic...
#cybercrime #lemonde
I had spent some time during my short unemployed period to dig into #Traffyque infrastructure.
www.lemonde.fr/pixels/artic...
#cybercrime #lemonde
April 30, 2025 at 8:00 AM
Very happy and proud that one of my "weekend research" has been exposed in an article from Le Monde.
I had spent some time during my short unemployed period to dig into #Traffyque infrastructure.
www.lemonde.fr/pixels/artic...
#cybercrime #lemonde
I had spent some time during my short unemployed period to dig into #Traffyque infrastructure.
www.lemonde.fr/pixels/artic...
#cybercrime #lemonde
Reposted by Cedric Pernet
New from 404 Media: the age of realtime deepfake fraud is here. Scammers in Nigeria are using realtime deepfakes to change their race, facial hair, gender, more to appear as someone else on video calls. Results very realistic now. Also tricking verification systems www.404media.co/the-age-of-r...
The Age of Realtime Deepfake Fraud Is Here
Fraudsters are able to change their race, facial hair, voice, and more during live video calls with very little effort. Scammers are already fooling the elderly and verification systems.
www.404media.co
April 28, 2025 at 1:03 PM
New from 404 Media: the age of realtime deepfake fraud is here. Scammers in Nigeria are using realtime deepfakes to change their race, facial hair, gender, more to appear as someone else on video calls. Results very realistic now. Also tricking verification systems www.404media.co/the-age-of-r...
Reposted by Cedric Pernet
Spyware-infected apps are being used to target individuals and organizations worldwide who are tied to Uyghur, Tibetan and Taiwanese activities “considered by the Chinese state to pose a threat to its stability,” @suzannesmalley.bsky.social reports this morning.
NCSC shares technical details of spyware targeting Uyghur, Tibetan and Taiwanese groups
The U.K.’s National Cyber Security Centre and international cybersecurity and intelligence agencies on Wednesday said hackers are deploying two forms of previously identified spyware to snoop on Uyghu...
therecord.media
April 9, 2025 at 6:22 AM
Spyware-infected apps are being used to target individuals and organizations worldwide who are tied to Uyghur, Tibetan and Taiwanese activities “considered by the Chinese state to pose a threat to its stability,” @suzannesmalley.bsky.social reports this morning.
Reposted by Cedric Pernet
From firmware dumps to wireless exploration — check out our latest dive into DVB receiver analysis and the hidden attack surface it exposes!
www.synacktiv.com/en/publicati...
www.synacktiv.com/en/publicati...
Hack the channel: A Deep Dive into DVB Receiver Security
Introduction During a garage cleaning, we found a DVB receiver and thought it would be a great target for vulnerability research.
www.synacktiv.com
April 9, 2025 at 6:36 AM
From firmware dumps to wireless exploration — check out our latest dive into DVB receiver analysis and the hidden attack surface it exposes!
www.synacktiv.com/en/publicati...
www.synacktiv.com/en/publicati...
Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation - www.sygnia.co/threat-repor... #APT #longpersistence
March 29, 2025 at 11:48 PM
Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation - www.sygnia.co/threat-repor... #APT #longpersistence
Reposted by Cedric Pernet
The Grandoreiro malware operation is back up and running after some of its members were detained last year.
Forcepoint has detected new large-scale phishing operations spreading the banking trojan to users in Europe and Latin America
www.forcepoint.com/blog/x-labs/...
Forcepoint has detected new large-scale phishing operations spreading the banking trojan to users in Europe and Latin America
www.forcepoint.com/blog/x-labs/...
Grandoreiro Trojan Distributed via Contabo-Hosted Servers in Phishing Campaigns
Cybercriminals are spreading the Grandoreiro banking trojan in Mexico, Argentina and Spain through phishing emails impersonating a tax agency.
www.forcepoint.com
March 29, 2025 at 7:28 PM
The Grandoreiro malware operation is back up and running after some of its members were detained last year.
Forcepoint has detected new large-scale phishing operations spreading the banking trojan to users in Europe and Latin America
www.forcepoint.com/blog/x-labs/...
Forcepoint has detected new large-scale phishing operations spreading the banking trojan to users in Europe and Latin America
www.forcepoint.com/blog/x-labs/...
Pulling the Threads on the Phish of Troy Hunt - www.validin.com/blog/pulling... #cybercrime #phishing
March 29, 2025 at 11:30 PM
Pulling the Threads on the Phish of Troy Hunt - www.validin.com/blog/pulling... #cybercrime #phishing
Reposted by Cedric Pernet
Zscaler has spotted a new malware loader named CoffeeLoader, used in the wild since September of last year. The malware was used together and appears to bear similarities with SmokeLoader.
www.zscaler.com/blogs/securi...
www.zscaler.com/blogs/securi...
CoffeeLoader: A Brew of Stealthy Techniques | ThreatLabz
CoffeeLoader is a new malware loader that employs stealthy techniques including call stack spoofing, sleep obfuscation, and Windows fibers to evade detection.
www.zscaler.com
March 29, 2025 at 10:13 PM
Zscaler has spotted a new malware loader named CoffeeLoader, used in the wild since September of last year. The malware was used together and appears to bear similarities with SmokeLoader.
www.zscaler.com/blogs/securi...
www.zscaler.com/blogs/securi...
Following the discreet layoffs at Trend Micro at the end of last year, I am now incredibly proud to announce that I just joined the powerful forces of @proofpoint.com ! I feel very gifted and honored to start working with such an amazing team of researchers !
March 10, 2025 at 10:23 PM
Following the discreet layoffs at Trend Micro at the end of last year, I am now incredibly proud to announce that I just joined the powerful forces of @proofpoint.com ! I feel very gifted and honored to start working with such an amazing team of researchers !
Reposted by Cedric Pernet
L'Assemblée nationale entame aujourd'hui l'examen de la loi narcotrafic et de ses backdoors. La mesure serait au mieux inefficace, au pire dangereuse, mais Bruno Retailleau s'y accroche, affirmant contre les évidences qu'il ne s'agit pas ni d'une backdoor, ni d'un affaiblissement du chiffrement.
Loi contre le narcotrafic : Bruno Retailleau confirme son soutien à une disposition controversée visant le chiffrement des messages
Le ministre de l’intérieur a tenté de rassurer sur l’encadrement de ces « backdoors », qui permettraient aux forces de l’ordre d’accéder aux échanges chiffrés. Il s’est cependant dit « sans illusion »...
www.lemonde.fr
March 5, 2025 at 8:10 AM
L'Assemblée nationale entame aujourd'hui l'examen de la loi narcotrafic et de ses backdoors. La mesure serait au mieux inefficace, au pire dangereuse, mais Bruno Retailleau s'y accroche, affirmant contre les évidences qu'il ne s'agit pas ni d'une backdoor, ni d'un affaiblissement du chiffrement.
Reposted by Cedric Pernet
