assets.afcdn.com/expertclub/20200622/292574_origin
![assets.afcdn.com/expertclub/20200622/292574_origin](https://assets.afcdn.com/expertclub/20200622/292574_origin.jpg)
Mangusta on X: #Amadey propagated via compromised USB similar TTPs observed before. Probably same TA 🧐 USB > .lnk > .ps1 > Runtime Broker.exe S1 🔗s://arstechnica.]com/civis/members/frncbf22.1062014/about/ S2 👾 s://evinfeoptasw.]dedyn.]io/updater
![](https://media.infosec.exchange/infosec.exchange/accounts/headers/109/265/991/243/138/319/original/62397e2047c2ff7f.jpg)
Randy :donor: (@rmceoin@) - Infosec Exchange
![](https://media.infosec.exchange/infosec.exchange/media_attachments/files/111/790/559/843/377/439/original/2932340e8d229221.png)
Randy :donor: (@rmceoin@) - Infosec Exchange
![](https://pbs.twimg.com/media/GAm12ZIWUAAz0M6.jpg)
Mangusta on X: #Amadey propagated via compromised USB similar TTPs observed before. Probably same TA 🧐 USB > .lnk > .ps1 > Runtime Broker.exe S1 🔗s://arstechnica.]com/civis/members/frncbf22.1062014/about/ S2 👾 s://evinfeoptasw.]dedyn.]io/updater
![](https://assets.afcdn.com/expertclub/20200622/292573_w200.jpg)
Ruban de Masquage Multi-Surfaces Scotch Blue_Testing - aufeminin
Mangusta on X: #Amadey propagated via compromised USB similar TTPs observed before. Probably same TA 🧐 USB > .lnk > .ps1 > Runtime Broker.exe S1 🔗s://arstechnica.]com/civis/members/frncbf22.1062014/about/ S2 👾 s://evinfeoptasw.]dedyn.]io/updater
![](https://assets.afcdn.com/expertclub/20230517/293524_w300h300.jpg)
Ruban de Masquage Multi-Surfaces Scotch Blue_Testing - aufeminin
![](https://media.infosec.exchange/infosec.exchange/accounts/avatars/109/265/991/243/138/319/original/1d65f0b5b92ced15.jpg)
Randy :donor: (@rmceoin@) - Infosec Exchange
![](https://assets.afcdn.com/expertclub/20200622/292574_origin.jpg)
Ruban de Masquage Multi-Surfaces Scotch Blue_Testing - aufeminin
![](https://assets.infosec.exchange/avatars/original/missing.png)
Randy :donor: (@rmceoin@) - Infosec Exchange