BlackCat

Research: Hardware - Kernel |
Interests: Malware, Browser, Pentest |
Current Study: UEFI, Linux, Embedded |

[BlackCat @B1ack3at]

It's my first paper, and it contains my research on BOOTKITTY.
I’ll be presenting on August 12.
See you at USENIX!
https://t.co/yix4flj7HY

[0xor0ne @0xor0ne]

Single-stepping attack on TrustZone-M via interrupt-latency leakage (Usenix paper)

https://t.co/Y1e8PRK18s

#infosec

[Shweta Shinde @shw3ta_shinde]

🔓 Heracles @acm_ccs'25: Breaking AMD’s Confidential Computing!
We show that the hypervisor can read and move hardware-encrypted memory on AMD SEV-SNP.
We build a chosen-plaintext oracle to leak kernel memory, auth keys, and cookies from "confidential" VMs
https://t.co/upHXpLqSeA

[Shweta Shinde @shw3ta_shinde]

🚨Breaking AMD’s Confidential Computing (again!) — Meet RMPocalypse 🚨
Thrilled to share our 2nd paper at @acm_ccs 🎉
We break AMD SEV-SNP’s guarantees—with just one write!
Forge attestation & enable debug, with 100% success
👥Work with @BenedictSchluet
📄https://t.co/YhKS2jVQIi

[Shweta Shinde @shw3ta_shinde]

First attack on the interconnect that breaks confidential computing: Fabricked.
A malicious hypervisor misconfigures the Infinity Fabric to gain arbitrary read/write access to AMD SEV-SNP CVMs. 100% success. Software-only.

See https://t.co/bnvgrY7s5F

#ConfidentialComputing #AMD

[FFRI_Research @FFRI_Research]

A video of our research engineer Matsuo's presentation at Black Hat USA 2025 is now live!

Presentation: https://t.co/aKBVtIIq7J
PoC: https://t.co/nqzbHuy7PA

https://t.co/tREkSMRKGV

#ffri_research #BHUSA

[Ruiyi Zhang @Rayiizzz]

Today we reveal StackWarp: a new CPU vulnerability exploiting a synchronization bug in AMD’s stack engine across Zen 1–5 CPUs. It enables deterministic manipulation of Confidential VM's stack pointer, allowing RCE and privilege escalation via both control- and data-flow hijacking

[MachineHunter @InfPCTechStack]

https://t.co/tZ78SLEwOX

[BlackCat @B1ack3at]

@pppp46497 I really enjoyed talking with you! Let's meet again sometime! ともだち 👊

[BlackCat @B1ack3at]

I really enjoyed the two days at CODE BLUE 2025!

[Kenichi Saito @hj_saito]

イ・ジュノ氏+ソ・ヒョナ氏
『BOOTKITTY: ブートキットからルートキットまでのマルチOS信頼チェーンの侵害』
https://t.co/P2mRqSNoxF

#codeblue_jp ＃codeblue2025

[0xor0ne @0xor0ne]

Exploiting Retbleed CPU vulnerability by @_MatteoRizzo and @theflow0

https://t.co/ENe7uXA4Ta

#infosec

[Google VRP (Google Bug Hunters) @GoogleVRP]

We have an exciting piece of vulnerability research 🕵️‍♂️ to share, conducted in collaboration with external researchers from VU Amsterdam. Find out more about the L1TF vulnerability, a CPU vulnerability on some Intel CPUs (Skylake and older).

https://t.co/n6X5FoRJCR

[0xor0ne @0xor0ne]

Phoenix: Rowhammer Attacks on DDR5 with Self-Correcting Synchronization

https://t.co/tvwsu1FIwQ

#cybersecurity

[BlackCat @B1ack3at]

I'm happy to present at CODE BLUE 2025!
It’ll cover the same topic as my USENIX WOOT talk(BOOTKITTY), but this time I’ll present deeper insights into the bootkit details I couldn’t share at WOOT.
See you at CODE BLUE!
https://t.co/fXGEu19Ew2

[Google VRP (Google Bug Hunters) @GoogleVRP]

📢 📢 📢 Calling all vulnerability researchers interested in microcode!

Check out our blog post covering EntrySign, the AMD Zen microcode signature validation vulnerability recently discovered by the Google Security team.

https://t.co/gn4xvXwEsJ

[Google VRP (Google Bug Hunters) @GoogleVRP]

Our latest post details how we exploited Retbleed (a CPU vulnerability) to compromise a machine from a sandboxed process and VM!

Curious? 👇

https://t.co/CSD8kdlBjD

[ESET Research @ESETresearch]

#ESETresearch has discovered #HybridPetya ransomware on VirusTotal: a UEFI-compatible copycat of the infamous Petya/NotPetya malware. HybridPetya is capable of bypassing UEFI Secure Boot on outdated systems. @smolar_m https://t.co/UQAcC4O3Pu 1/8

[0xor0ne @0xor0ne]

Three part series on Insyde H2O SecureBoot bypass by @NikolajSchlej

Part 1: https://t.co/MoDNwdg3kK
Part 2: https://t.co/5u6D8J5wc5
Part 3: https://t.co/5u6D8J5wc5

#uefi #infosec

[BlackCat @B1ack3at]

If you have any questions about BOOTKITTY, please feel free to contact me:
Discord: @b1ack3at
Email: [email protected]

[BlackCat @B1ack3at]

I’m glad that my first academic conference presentation went well. It was truly a great experience.

Our team’s collective effort made it possible to submit our paper to WOOT ’25.
I would also like to thank Dr. JinHo Jung and Dr. HyungJun Koo for their guidance on the paper.

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Last papers session "Exploit All the Things" (Chair: Cristine Hoepers)
- Soufian El Yadmani: SecurePoC—detecting malicious GitHub exploits
- Andrea Mambretti: SoK on kernel vuln discovery & auto exploit generation
- Junho Lee: BOOTKITTY—stealth bootkit-rootkit for modern OSes