Florian Roth ⚡️

Head of Research @nextronsystems #DFIR #YARA #Sigma | detection engineer | creator of @thor_scanner, Aurora, Sigma, LOKI, YARA-Forge | always busy ⌚️🐇 | vi/vim

[Florian Roth ⚡️ @cyb3rops]

I've decided to put a screenshot showing the hex editor view of a Turla Kazuar sample behind acrylic glass on my desk to always remind me, why I am doing all this ...

because I 💛 to be a pain in the neck of the bad guys

https://t.co/LnoC5rwkWV

[Florian Roth ⚡️ @cyb3rops]

It seems that I have some fans over in Russia 🐻

#TurlaLicksAss

thx to the FireEye analyst who brought this to my attention

https://t.co/8qsaFLT8HL

[Florian Roth ⚡️ @cyb3rops]

@RealRusty Boeing HQ is in Virginia, US

[Nextron Research ⚡️ @nextronresearch]

We analyzed a Sharp Dragon APT chain targeting Malaysian government officials

A weaponized Word document posing as a US-China policy brief. Same actor. New campaign. New geography.

The document is convincing, formatted as a legitimate diplomatic policy brief titled “Malaysia Policy Brief: Trump China Visit”, with a professional structure clearly designed for senior officials tracking US-China-ASEAN relations.

The payload is a VBA macro that hides the embedded binary across 15 Form TextBox objects in the document’s UserForm. Nothing is dropped to disk until execution.

Execution chain:

VBA macro decodes the 15 TextBox chunks at runtime → assembles and drops a loader disguised as OneNote.exe → custom AES-128-ECB + LZ4 decompression, intentionally avoiding CryptoAPI → Download_s.dll beacon → HTTP GET to /microsoftonline/common/oauth2/authorize.php impersonating Microsoft → NtMapViewOfSection into rundll32.exe → Stage 4 delivered

Our @thor_scanner run produced the following YARA hits:

SUSP_VBA_Dropper_Feb26
https://t.co/jZT7ZLn9ww

APT_MAL_DLL_Loader_May24
https://t.co/nGd3x3BHTS

Doc sample (2/62)
https://t.co/OxXMGeH2wQ

Second stage
https://t.co/vaP4uSBWqq

Downloader (stage3) sample
https://t.co/dhzqgke6X1

[Marius Benthin @marius_benthin]

Looks like npm packages by @JagReehal got compromised tonight by the same credential-stealing worm that targeted Red Hat npm packages.

For example:
[email protected]
[email protected]

Full list of packages: https://t.co/cPgeWq6Txx

[Eyal Sela @eyalsela]

User danielapolkasu0619-rgb on GitHub is trying to perform prompt injection in comments and submit malicious PRs to multiple crypto related projects

[Florian Roth ⚡️ @cyb3rops]

Gemma4 31B was the strongest open source model running on consumer hardware (e.g. RTX 4090) in my security event triage benchmark

Google has now released Gemma4 12B, which should run reasonably well even on an RTX 4070 and 5070

https://t.co/GYfXT5uqE5

[Google Gemma @googlegemma]

Meet Gemma 4 12B!

A unified, encoder-free multimodal model designed to bring high-performance intelligence directly to your laptop, and released under an Apache 2.0 license.

Bridging the gap between edge efficiency and advanced reasoning. Here is what’s new with Gemma 4 12B: 👇

[Marius Benthin @marius_benthin]

Two more recently published npm packages related to the same malware campaign: "[email protected]" and "[email protected]". Both detected by THOR with multiple YARA rules.

[Florian Roth ⚡️ @cyb3rops]

This is what they consider a fix
#MetaAIFail #MetaAIFixFail

[Florian Roth ⚡️ @cyb3rops]

The fix for Meta's AI bot vulnerability was apparently:
- remove the feature from the UI ❌
- leave the API endpoint accessible ✅
I wish I was joking.

[Florian Roth ⚡️ @cyb3rops]

@RachelTobac https://t.co/Cu5QiCpekU

[Florian Roth ⚡️ @cyb3rops]

The fix for Meta's AI bot vulnerability was apparently:
- remove the feature from the UI ❌
- leave the API endpoint accessible ✅
I wish I was joking.

[Florian Roth ⚡️ @cyb3rops]

The fix for Meta's AI bot vulnerability was apparently:
- remove the feature from the UI ❌
- leave the API endpoint accessible ✅
I wish I was joking.

[bet3rd @bet3rd]

So instead of shutting down that API for good, they just removed it from the page?
Are meta employees on drugs???

You can read more on https://t.co/He7s7zj5dA

[Florian Roth ⚡️ @cyb3rops]

About a month ago, my team spotted recent activity tied to this Iranian threat actor and started collecting details.

Then Mandiant and Check Point Research published on the same actor, so we dropped our own cluster name and decided to add what we had seen in the latest activity.

The targeting is the part that matters here:
aerospace, aviation, defense, telecom and software/IT services - across Europe, the Middle East and North America.

Given the current geopolitical situation, that’s not just another random malware case.

We published the write-up, IOCs and public YARA rules.

Nice work by @cod3nym and the team

[Nextron Research ⚡️ @nextronresearch]

Detecting Nimbus Manticore (UNC1549)

While previous reporting documented the threat actor’s operations, our analysis focuses on defender value:

◾ Multiple public YARA rules
◾ Campaign-specific detections
◾ Generic hunting logic
◾ IOC enrichment
◾ Detection opportunities across the full infection chain

From LinkedIn lures and fake hiring portals to AppDomain hijacking, Azure infrastructure, and custom implants.

Read the full research by @cod3nym:
https://t.co/IGqkbAoFxD

#ThreatResearch #YARA #ThreatIntel

[Microsoft Threat Intelligence @MsftSecIntel]

Compromised npm packages ([email protected], [email protected]) are abusing Hugging Face repos as exfiltration infrastructure. The packages deploy a remote access trojan (RAT) that captures keystrokes, screenshots, and crypto wallet credentials.

Indicators of compromise (IOCs):
- npm user: hexalpha10 / author: toskypi
- 195.201.194[.]107:8010 (WebSocket C2)
- c2-toskypi.onrender[.]com (HTTP C2)
- huggingface[.]co/api (exfiltration endpoint)
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftSystem64 (persistence)
- MicrosoftSystem64.service (Linux systemd persistence)
- \MicrosoftSystem64 (Windows scheduled task)
- MicrosoftSystem64/payload.js (payload directory)

Defenders: treat unexpected huggingface[.]co/api calls from non-ML workloads as suspicious.

[ALI TAJRAN @alitajran]

Block High Risk AI Agents in Microsoft 365!

So many AI Agents are available to use in your Microsoft tenant without you even knowing.

More and more agents are becoming available, and this trend will continue.

The first thing you should do is block the high-risk AI agents from accessing your organization's resources.

Read more: https://t.co/6ixle7ED96

#Microsoft365 #EntraID #Cybersecurity

[vx-underground @vxunderground]

Yeah, so pretty much this guy is releasing an exploit in solidarity with Nightmare Eclipse guy. He said he notified GitHub about the exploit 60 minutes before releasing this paper.

I don't do web stuff, and I'm not a VSCode nerd, so I'm confused by the underlying technologies.

If you're a stinky GitHub and VSCode nerd maybe you'll understand.

tl;dr click github dev, github dev opens editor, in github dev editor have javascript, javascript does shortcuts automatically. github treats javascript shortcuts as real human input, or something. use javascript shortcut stuff to automatically install vscode extension. the vscode extension steals your data

tl;dr tl;dr user clicks 1 link, 1 click steals all data from your github

https://t.co/uh17usZeEH

[Samir @SBousseaden]

new detection content for Kubernetes covering a variety of techniques using k8 audit logs:

https://t.co/VTBCknTQaP

[vx-underground @vxunderground]

As someone who enjoys malware and malware accessories, I for one believe this to be incredible news and I applaud Satya Nadella for this

As someone who deals with malware defensively, I for one believe this is terrible news and I hate Satya Nadella so much right now it's unreal

[Charles Guillemet @P3b7_]

🚨 Google Quantum result was just rediscovered and IMPROVED!

On March 31, 2026, Google Quantum AI published a paper showing that 256-bit ECDLP, the hard problem behind ECDSA and therefore behind Bitcoin, Ethereum, TLS, and most of the world's authentication, can be solved with fewer than 1,200 logical qubits and ~90M Toffoli gates. Under 20 minutes on ~500,000 physical qubits.

BUT, they didn't publish the circuits. They published a zero-knowledge proof that the circuits hit those numbers. The standard read at the time: clever responsible disclosure, elegant.

Two months later, that read needs an update. Two things happened, in opposite directions.

1. The ZKP wasn't a stylistic choice. Google was stopped from publishing.

What was speculation in April is no longer. Google did not choose to keep the circuits private. The U.S. government prevented publication. The blog post phrased it politely ("we engaged with the U.S. government"). Call it what it is: diplomatic cover for a publication block.

This is the line Scott Aaronson warned about. At some point, the people estimating the resources needed to break deployed cryptosystems would stop publishing. We just watched it happen, and the actor enforcing the silence isn't Google's PR team. It's a government.

2. The ZKP turned out to be a reward function. AI used it.

Here's the part that's almost funny.

A ZK proof that "this hidden circuit achieves these resource counts" is, when you flip it, a public verifier of any candidate circuit. Submit a circuit, get back: does it compute ECC point addition correctly, and at what cost. Pass/fail plus a number. That is exactly the shape of a reinforcement-learning reward function.

The ZKP was designed to hide the attack. What it actually published is the reward function for rediscovering it.

The research community wired the verifier into an automated AI-driven search loop. They reproduced Google's numbers. Then they improved them by 11.5%. Two months, from outside Google, no access to the circuits, using the very artifact Google released to keep them proprietary.

Both of these are true at once. Hiding the circuits worked: nobody outside Google has Google's exact circuits. And hiding the circuits did not slow the frontier; it changed who is doing the search, and arguably accelerated it, because the verifier industrialized the search loop.

Let's NOT PANIC!
Neither of these is a working CRQC. There is still no quantum computer that can run this circuit. The headline state of the world has not changed.

What has changed is the honesty of every public PQC timeline. Cryptography exists to create mathematical trust in the security of systems. Trust isn't broken when an attack runs. It is eroded when the foundation looks thinner than the public record suggests, and the public record is now demonstrably thinner than reality in two ways: by classification on one end, by AI-driven re-derivation on the other.

In security, the moment you start doubting the foundation is the moment you start rebuilding it. Not the moment you panic. The moment you plan.

This isn't a moment to rush. It's a moment to commit to a migration plan and execute against it, knowing the threat model is shaped by what governments are willing to classify, not by what researchers are allowed to publish.

Stay safe. Stay honest about your trust assumptions.

[Lukasz Olejnik @lukOlejnik]

Another supply-chain compromise worm. Multiple packages in the official Red Hat redhat-cloud-services npm scope were compromised in a supply-chain attack distributing a credential-stealing worm. Affected packages added a preinstall hook that ran a script. The malware harvested npm, GitHub, AWS, Azure, GCP, Vault, Kubernetes, SSH, CI/CD, and local secrets, then attempted to propagate by abusing stolen credentials to publish additional malicious packages and modify repositories. Any environment that installed affected versions should be treated as compromised. https://t.co/gGXcaHySOV https://t.co/4D4qa7M1uc

[Hedgie @HedgieMarkets]

🦔GitHub Copilot switched to token-based billing this morning and users are already out of credits. Pro+ subscribers paying $39 a month are reporting 60% of their credits gone in two hours of normal use. One user lost 20% of their allowance from a single file review with no code changes. Another hit their monthly cap before the calendar even flipped to June.
Orgs with shared token pools have no way to see individual usage, so entire teams get cut off when one person runs a heavy prompt. Users are canceling and moving to Claude Code and Codex. GitHub community forums are on fire.

My Take
Flat-rate AI subscriptions were always subsidized. Everyone in the industry knew it. Today the subsidy ran out for a few million developers at once. The problem is a lot of companies already restructured around these tools. They cut headcount and told remaining engineers to lean on Copilot instead of building skills internally. Those companies now depend on a tool whose cost just became unpredictable and whose usefulness completely changes when you have to ration prompts to stay under budget.

The developers moving to Claude Code and Codex will hit the same wall eventually. Every AI provider faces the same unit economics. Anthropic filed its S-1 this morning, and the durability of its revenue depends on whether customers stick around once real pricing kicks in everywhere. If a $39 subscriber cancels after one day because the tool became unusable, multiply that across millions of seats and the churn risk becomes very real.

Today showed what happens when AI pricing meets reality. The companies that built their workflows around cheap tokens just discovered the tokens aren't cheap anymore and the people who knew how to do the work without them are already gone.

Hedgie🤗

[Pablo Fredrikson @PeladoNerd]

https://t.co/zfFpPnJbdr

[Nextron Systems @nextronsystems]

Faster reviews. Clearer detections. Less noise.

New THOR Cloud Log Inspection View:

✓ Condensed layouts
✓ Strings highlighted in context
✓ Smart filtering & saved filters

Available now.

https://t.co/h5PuiixhmO

#DFIR #ThreatHunting