Costin Raiu (@craiu) / X

Costin Raiu

10.2K posts

Costin Raiu

@craiu

Cybersecurity researcher focused on threat intel & APTs. Breaking down attacks, hunting threats, and crafting YARA rules. Buddy @ Three Buddy Problem

Bucharest

Joined October 2007

@craiu

See Costin Raiu’s full profile

Open X

Pinned
Costin Raiu
@craiu
Jan 9
The Cybersecurity Booklist: 11 Must-Reads for 2026 from The Three Buddy Problem Podcast: medium.com/@costin.raiu/t… @ryanaraine @juanandres_gs
The Cybersecurity Booklist: 11 Must-Reads for 2026 from The Three Buddy Problem Podcast
From medium.com
4
8
53
17K
Costin Raiu
@craiu
Mar 22, 2019
When Lily from Human Resources develops BIOS code in her spare time.
25
399
1.6K
Costin Raiu
@craiu
Sep 3, 2020
Working in ITSec, a chess view
24
358
1.3K
Costin Raiu
@craiu
Jul 19, 2024
It is a bit weird so many things went down, airports, hospitals, critical infrastructure - Crowdstrike can't have a footprint this big. The first thing to go down was Azure. Perhaps MS runs Crowdstrike on some of their Azure servers? So CS fails, brings Azure down, then
39
125
1.3K
186K
Costin Raiu
@craiu
Sep 14, 2023
Start by disabling iMessage, FaceTime and then enable Lockdown mode. Reboot daily. This takes care of 90% of the things out there.
46
265
1.1K
235K
Costin Raiu
@craiu
Nov 15, 2024
Always look at PDF files with a (preferably blue) text viewer, sometimes the metadata has interesting goodies!
22
72
1.1K
119K
Costin Raiu
@craiu
Sep 27, 2021
In iOS 15, the phone is findable even when “Powered off”.
43
213
894
Costin Raiu
@craiu
Jul 19, 2024
Some people report that the files responsible for the CrowdStrike crashes (Eg. C-00000291-00000000-00000032.sys) are full of zeroes. This is not the case for any of the machines I fixed by hand today. One example is
6
102
794
151K
Costin Raiu
@craiu
Jun 16, 2023
23 years ago, I joined the Kaspersky team. Today, I am 46 and that makes it half my life dedicated to protecting the world. You probably know some of the research we did over the years in GReAT – looking back, I’m very proud of what we accomplished. It has been an incredible
102
58
676
140K
Costin Raiu
@craiu
Dec 16, 2020
This is nuts. Solarwinds had a support page (now removed) advising users to DISABLE antivirus scanning for Orion products' folders.
25
190
613
Costin Raiu
@craiu
Dec 13, 2021
"Little Bobby Tables", 2021 upgrade
4
115
587
Costin Raiu
@craiu
Mar 10, 2021
Out of the 140 known C2 servers we are tracking at OVH that are used by APT and sophisticated crime groups, approximately 64% are still online. The affected 36% include several APTs: Charming Kitten, APT39, Bahamut and OceanLotus.
14
245
599
Costin Raiu
@craiu
Jan 27, 2021
Wow, is that a floppy disk reader on this Emotet server in Ukraine? Also love the soldering iron next to it.
34
117
540
Costin Raiu
@craiu
Sep 24, 2019
A sample of the iOS malware family described by Google and used in zero days attacks finally hit multi-scanner services today. sha256: 0d2ee9ade24163613772fdda201af985d852ab506e3d3e7f07fb3fa8b0853560
7
281
546