silence-is-best
silence-is-best
/ gist:df9627fac2f23aaa0a17cd7ff3cb71f8
Created
September 1, 2026 12:47
August Malspam Campaigns
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Date,Details,Email Payload Type,Users Targeted | |
| 8/3/2026,You have a new voicemail.; vbs -> screenconnect,Attachment,11 | |
| 8/4/2026,Project Inquiry: New Commercial Development; uue -> js -> originlogger,Attachment,7 | |
| 8/4/2026,Your Statement is ready; link -> exe -> screenconnect,Link,2 | |
| 8/4/2026,Zoom Meeting - EFT Settlement; link -> screenconnect,Link,132 | |
| 8/4/2026,Anthem Blue Cross EFT Settlement|Payment Approved on; link -> msi -> screenconnect,Link,129 | |
| 8/4/2026,NEW ORDER FROM EUROPE; gz -> js -> xloader,Attachment,2 | |
| 8/5/2026,Olvera SettIement Advlse; rar -> js -> xloader,Attachment,3 | |
| 8/5/2026,RV: ??: PO FOR AFLA Gmbh - Amendment PO# no. 2110_2110921-PO_ Updated; r00 -> donutloader -> originlogger,Attachment,3 | |
| 8/5/2026,Transfer Update|Electronic Funds Transfer; link -> screenconnect continued whole month,Link,15 |
silence-is-best
/ gist:48b613e82bf64f1fd8b9a231ccdd590b
Created
August 3, 2026 17:37
July Malspam Campaigns
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Date,Details,Email Payload Type,Users Targeted | |
| 7/1/2026,ATTN: Complete with Docusign: Download You've received a New Secured Document ; link -> screenconnect,Link,726 | |
| 7/2/2026,RE: PO # 100955; txz -> purerat,Attachment,6 | |
| 7/2/2026,New Order PO031430; xls -> hta -> remcos,Attachment,2 | |
| 7/4/2026,ORD-2026-02120 & PUR-ORD-2026-02104|ORDER CONFIRMATION FOR ORDER #88321; zip -> js -> originlogger,Attachment,3 | |
| 7/6/2026,RFQ documents.; zip|rar -> originlogger,Attachment,3 | |
| 7/6/2026,RV: RES: Ref: MAR- JUNE GEN-QIU _Updated SOA & OC SI#9828392091.; ra00-> donutloader -> originlogger,Attachment,4 | |
| 7/7/2026,Wire Transfer Update; link -> zip -> js -> medusahvnc,Link,30 | |
| 7/7/2026,INVOICE; link -> zip -> js -> xworm,Link,22 | |
| 7/7/2026,RFQ : PR/APSL/BFS/INST/08-26 : Supply of Instrument items for ICF Compressors at Beneku; xls -> hta -> originlogger,Attachment,2 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| I'm asking anyone who uses an LLM (especially from one of the larger companies) to pause and ask a handful of questions, and to maybe listen to (read) a few thoughts. Your answers will probably be different than mine. I promise it will be short. So let's go. | |
| First up, ultimately, what is the purpose of an LLM (generally)? | |
| To make shareholders money. | |
| What would be the BEST way to guarantee people use it? | |
| Make people dependent upon it. Among the myriad of things covid showed me, it's the stark difference between a necessity and a luxury, and how people will pay out the nose for a necessity, and practically ignore any type of luxury. | |
| What other strategies and tactics could be use to monetize LLM's? | |
| Honestly, all of them. In app advertisement, data gathering, telemetry, token/credit schemes, the list goes on. |
silence-is-best
/ gist:29afec335264313e9bf5bfa1c6e60144
Created
July 16, 2026 16:56
Screenconnect initial check suricata rule
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Change to your liking; any any and sid number: | |
| alert tls any any -> any any (msg:"TLS SNI (check . screenconnect .com)"; flow:established,to_server; tls.sni; bsize:23; content:"check.screenconnect.com"; fast_pattern; reference:url,attack.mitre.org/techniques/T1219/; reference:url,help.gorelo.io/en/articles/8651857-gorelo-connect-remote-control; reference:url,discord.gorelo.io/m/1399561240031789116; classtype:misc-activity; sid:3000001; rev:1; metadata:attack_target Client_and_Server, created_at 2026_07_16, deployment Perimeter, performance_impact Low, confidence High, signature_severity Informational, tag RAT, tag RemoteAccessTool, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1219, mitre_technique_name Remote_Access_Software;) |
silence-is-best
/ gist:247bf72a24c316a9d4c9bedc62df2ea0
Created
July 1, 2026 13:38
Jun Malspam Campaigns
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Date,Details,Email Payload Type,Users Targeted | |
| 6/2/2026,Fwd: ATTENTION MR. DANISH MEHMOOD PCT; rar -> darkcloud,Attachment,2 | |
| 6/3/2026,New Confidential Court Document � Immediate Review Recommended; link -> vbs -> screenconnect,Link,3 | |
| 6/5/2026,RFQ 102603813; zip -> originlogger,Attachment,6 | |
| 6/5/2026,Document Access Notification � View Now; link -> vbs -> screenconnect,Link,2 | |
| 6/9/2026,Shipping docs 34328910949; rar -> purelogsstealer,Attachment,2 | |
| 6/9/2026,Payment Advice - Advice Ref.G91222721471; rar -> originlogger,Attachment,2 | |
| 6/11/2026,Quotation request 6572600197_00003221; gz -> masslogger,Attachment,2 | |
| 6/11/2026,Solicitud de Cotizaci�n|Quotation and specifications; zip ->js -> xloader,Attachment,6 | |
| 6/12/2026,Invoice S100346809.001 PO# WWTP PAA; zip -> screenconnect,Attachment,19 |
silence-is-best
/ gist:9b7365532f5ceb3b963bbc2dc3d8e876
Created
June 1, 2026 15:15
May Malspam Campaigns
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 5/1/2026,RE: REPRESENTACI�N DE PAGO (Q112700-TAM20648); arj -> xloader,Attachment,5 | |
| 5/1/2026,invoice + a few clarifications; gz -> remcos,Attachment,7 | |
| 5/2/2026,Your April SSA Statement Is Ready For Review; zip -> cmd -> screenconnect,Attachment,4 | |
| 5/2/2026,Purchase Order No-4010014227 // Date-04.05.26; xlam -> hta -> xworm,Attachment,3 | |
| 5/4/2026,Zoom Update Available � v6.3.11 Now Ready to Install; link -> tiflux,Link,3 | |
| 5/5/2026,Curriculum vitae; xls -> hta -> reverseloader -> xloader continued to may 8,Attachment,18 | |
| 5/5/2026,Re: New Order (PO7656-05-04 ) Confirmation & PI Request; rar -> donutloader -> originlogger,Attachment,2 | |
| 5/5/2026,Webmail Workspace: Your invoice is available; gz -> remcos,Attachment,14 | |
| 5/5/2026,Arrival Notice(BL#: TAOG66729900) Vessel/Voyage: ONE OWL 0033E; zip -> phantomstealer,Attachment,6 | |
| 5/7/2026,CONFIRM PAYMENT INVOICE�; rar -> originlogger,Attachment,3 |
silence-is-best
/ gist:bc95a949f272f8c5487d057bbd74d14f
Created
May 1, 2026 12:56
April Malspam Campaigns
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Date,Details,Email Payload Type,Users Targeted | |
| 4/1/2026,New Order PO E2329-001; zip -> originlogger,Attachment,2 | |
| 4/1/2026,Attacment name starts with skm; rar -> purelogsstealer,Attachment,7 | |
| 4/1/2026,pago de aerocargo Q112700-TAM20648; rar -> xloader,Attachment,5 | |
| 4/1/2026,New PO (#1437); rar -> xloader,Attachment,4 | |
| 4/2/2026,Attachment name is PO E2329-001 ,zip -> originlogger,Attachment,3 | |
| 4/3/2026,Quotation; zip -> originlogger,Attachment,3 | |
| 4/6/2026,Please see the attached file: Annual SSA Remittance e-Statement; zip -> screenconnect,Attachment,5 | |
| 4/6/2026,Attachment name is 629174800.rar; rar -> purelogsstealer,Attachment,2 | |
| 4/8/2026,RE: Inquiry About Your Product; bat -> screenconnect,Attachment,7 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| https://redirect-bucket-081fc262.s3.amazonaws.com/redirect-17d0268f.html | |
| https://redirect-bucket-2766cdff.s3.amazonaws.com/redirect-5be57918.html | |
| https://redirect-bucket-32b4b8cd.s3.amazonaws.com/redirect-70f9c1ff.html | |
| https://redirect-bucket-3a343f0b.s3.amazonaws.com/redirect-55d409f6.html | |
| https://redirect-bucket-6fb2bd0a.s3.amazonaws.com/redirect-aeaa3359.html | |
| https://redirect-bucket-9be41d44.s3.amazonaws.com/redirect-7e794a14.html | |
| https://redirect-bucket-b92954d7.s3.amazonaws.com/redirect-b42cb816.html | |
| https://redirect-bucket-e23f3ab1.s3.amazonaws.com/redirect-3fa9db96.html | |
| https://redirect-bucket-f81197a8.s3.amazonaws.com/redirect-93b7611c.html |
silence-is-best
/ gist:440abd3e683adf69f531371cf56cd338
Created
April 8, 2026 12:36
March Malspam Campaigns
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Date,Details,Email Payload Type,Users Targeted | |
| 3/1/2026,RE:CONFIRM PAYMENT INVOICE; zip -> originlogger,Attachment,2 | |
| 3/1/2026,Your shipment has arrived; pdf -> link -> screenconnect continued to 3/6,Attachment,267 | |
| 3/2/2026,Error synchronizing message ; rar -> js -> originlogger,Attachment,2 | |
| 3/3/2026,BL DRAFT / 3425005143 SO 202552948280; gz -> remcos,Attachment,2 | |
| 3/3/2026,Solicitud de precio; lha -> originlogger,Attachment,2 | |
| 3/6/2026,RFQ FOR TOOL-EM78625; bz2 -> vbs -> xworm,Attachment,2 | |
| 3/9/2026,Your 2026 Social Security Statement Is Ready|Action Required: Update Your Device Security; link -> screenconnect,Link,10 | |
| 3/11/2026,"Re: CMA CGM China Ltd � SOA Confirmation Needed USD 15,452.81 (Dec�Jan); rar -> xloader",Attachment,4 | |
| 3/11/2026,Purchase Order Stock-8787 -IAT; 7z -> bat -> donutloader -> vipkeylogger,Attachment,2 |
silence-is-best
/ gist:49cbc51145478ed68d06e02e14ddc135
Created
March 2, 2026 15:56
February Malspam Campaigns
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Date,Details,Payload Type,Users Targeted | |
| 2/1/2026,Your Social Security e-Statement Is Ready � View Using the SSA Gov Viewer App; zip -> screenconnect,Attachment,2 | |
| 2/1/2026,Final shipping documents; zip -> phantomstealer,Attachment,2 | |
| 2/2/2026,STATEMENT OF ACCOUNTS DEC.2025 USF; zip -> bat -> guloader -> phantomstealer,Attachment,3 | |
| 2/2/2026,FW: SS24 NEW TPI E407SH005 / E423SH006 RIA; docx -> rtf -> xloader continued to 2/4,Attachment,3 | |
| 2/2/2026,Fw: RFQ-S75502262N; z -> xloader continued to 2/4,Attachment,2 | |
| 2/3/2026,Signature Via Docusign Required; link -> msi -> screenconnect,Link,17 | |
| 2/3/2026,You have an important notice from BMO Bank; link -> msi -> screenconnect,Link,15 | |
| 2/4/2026,Re:Order H600287395; rar -> guloader -> phantomstealer continued to 2/6,Attachment,7 | |
| 2/4/2026,PURCHASE ORDER AND SAMPLES 2026; docx -> rtf -> vbs -> xworm,Attachment,3 |
NewerOlder