Leo🇰🇪

Security Researcher | Detection Engineering
#CTI | #threatintel

Progress. Not perfection.

[Kevin2600 @Kevin2600]

@Muse made firmware reverse engineering and bug hunting easier than ever. From “RTFM” to “Hey Muse, find me a 0-day” — the hacker life has never been this lazy. 😂💻💀

[Cyber_OSINT @Cyber_O51NT]

The Com ecosystem is expanding into a modular, multi-layered network where access, services, and personas drive operations across Hacker, IRL, and Extortion groups, with brand continuity, shared tools, and affiliate dynamics shaping attribution. https://t.co/DSaqjNvwEh

[Off Grid Pete @OGridPete]

Interesting validation for Fieldwatch. 🛰️

In Feb 2025, the @AFResearchLab reportedly awarded a $1.74M contract to use ordinary phones' raw GNSS data to detect jamming and spoofing and send alerts into TAK. It's being field-tested in Ukraine and in US military exercises.

Fieldwatch 1.1.25 already does the core of that on your own phone. Its detection builds on published research from the University of Colorado Boulder, the European Commission's Joint Research Centre, and Politecnico di Torino, along with Google's Android GNSS guidance. That's likely the same body of work behind efforts like that one.

When it sees signs of interference or spoofing, Fieldwatch drops a mark on the ATAK map where you were. If the hit lasts while you're moving, the mark stretches into an oval along your path. With a few Fieldwatch phones on the same TAK network, your team's map starts to show where GNSS is affected, with no server needed.

The difference is that the funded project is a commercial SDK built around a central server. Fieldwatch runs entirely on the phone, works offline, and is free and open source.

https://t.co/UwggkbF8fY

[Moonlock Lab @moonlock_lab]

1/ New #macOS #malware, seems FUD for now, shared by @malwrhunterteam.
A hidden-VNC (hVNC) implant that doesn't mirror your screen. It secretly clones your browser profile and drives a ghost copy of Chrome/Firefox with your live logins. Decided to track it as GhostProfile 👇

[0xor0ne @0xor0ne]

Using Claude for porting an exploit for an eventpoll vulnerability to Android (@Shiftreduce)

https://t.co/lDBjbt7Pzp

#infosec #llm

[Aleandro Sy @AleandroSy]

ClickFix + EtherHiding: Decrypting a Malicious Domain with CyberChef
Malicious domain: voderlence[.]com
Smart address: 0x4dBdca7277427eDEe4D5b4E3D012bCa73Aefadf1

[Anderson Nascimento @andersonc0d3]

Hardware-Assisted Rootkits: Abusing Performance Counters on the ARM and x86 Architectures
https://t.co/Ly45UTGRkb

[h0m3us3r @h0m3us3r]

Turned a WiFi 7 router into a 320Msps SDR.

Custom firmware on its MediaTek MT7996 streams raw 14-bit IQ from 2.4/5/6GHz over 10GbE without dropping samples. It's not a snapshot mode, the waterfall is just one thing reading the stream.

https://t.co/r8KCX6Y8Ca

[rootkittie @LxlxIxlxlxL]

got tired of researching MITRE ATT&CK in browser tabs. built a terminal client instead.

one C binary. no telemetry. offline.

- search techniques, groups, campaigns
- render the Enterprise matrix
- notes as plain markdown
- ncurses browser

https://t.co/AwjmDEaDQR

[Lontz @lontze7]

SOCRadar Threat Research Unit (STRU) has published new research on #ICMacOS (Icarus macOS), a macOS Malware-as-a-Service that rapidly evolved from an infostealer into a persistent RAT.

Full breakdown 👉 https://t.co/6N4M4fMwVg

[cr3ghost @cr3ghost]

If you're into Windows internals, malware analysis or low-level offensive security, bookmark this.

@AliceCliment has a great FREE technical research archive covering:

- Windows kernel internals
- BYOVD + vulnerable driver research
- Driver reversing + IOCTLs
- Process-killer drivers
- EDR bypass techniques
- Import Address Table hooking + unhooking
- Direct syscalls
- Hell's Gate + Halo's Gate
- FreshyCalls + SysWhispers2
- SSDT + syscall dispatch internals
- NotPetya reverse engineering
- Named pipes
- Linux disk-encryption attacks

Some particularly good rabbit holes:

- Finding exploitable process-killer drivers using LOLDrivers
- Reversing Avast + PowerTool kernel drivers
- Following a syscall from user mode into the Windows kernel
- Comparing syscall-ID retrieval techniques
- Unhooking EDR modifications to the IAT
- Reverse engineering NotPetya's named-pipe behavior

A lot of it walks through the actual reversing process rather than just describing the technique at a high level.

Start digging:
https://t.co/mkaynSZQdM

Huge credit to @AliceCliment for keeping the research publicly available.

#WindowsInternals #ReverseEngineering #MalwareAnalysis

[SEKTOR7 Institute @SEKTOR7net]

Launching payloads via a service recovery.

RecoverIt crashes a broken Windows service so its recovery action launches a given payload. No Event ID 7045 fired.

A tool by @TwoSevenOneT

Tool: https://t.co/FNnCnRwoSt

Post: https://t.co/jpJgIfFpFZ

#redteam #blueteam

[Nextron Research ⚡️ @nextronresearch]

An Iranian threat actor is still running a GitHub-based loader with low detection rate on VirusTotal, six weeks after first submission.

We went hunting after reading Unit 42's Blinder Tunnel report and found a new variant with infrastructure changes not covered in prior reporting: a Cloudflare Workers relay, a new GitHub account, and credential-rotation instructions hidden inside HTML comments on Microsoft/vscode issues, encrypted per-victim so only the targeted host can read them.

The loader was delivered via an Inno Setup installer themed as a Dubai Airport careers IT assessment, targeting Iraq.

Technical analysis + decompiled source + IOCs:
https://t.co/Waj9rI8YBL

[Dominic Chell 👻 @domchell]

Last week I watched our team use codex to build 2 new fully functional agents for Nighthawk using our open agent protocol, including with custom c2 support. They were deployed to a live project and worked flawlessly. Everyone has their own throwaway c2 at their fingertips…. The c2 game is dead

[PandaRE 🐼 🇺🇦 @PandaRE__]

Now opendirs please and thank you

[Michael R @nahamike01]

Exposed Eclipse ransomware staging server at 46.165.212[.]179 observed by @Huntio on 8-Oct-26.

Open directory contents:
- Eclipse ransomware binaries (ESXi and Windows builds).
- Exfiltrated victim data and credentials
- Markdown files written in Russian and English walking the actor through reconnaissance findings from a victim network, dated September 2026.

Additional Infrastructure:
- Port 8080 hosts an API for a "Hypersocks C2 Health Monitor."
- Tor-based "Eclipse Recovery Portal": nmdzzsm7qjy7qjq5m3ifuz7wepip2adjlkscve5s3b2ewpi6wvqnq3ad[.]onion

SHA-256:
- esxi: 7f9cb5a53b69a16ad785caed6d37b1ed630040cf3359d848198f79228f75160d

- locker.exe: 446d94febd47a77e822a1a2a45e7e4edc0e873c67ff2ddbe65cfc3034acf28f5

This server also hosts some interesting TLS certificates, frequently rotated dating back to August 2026.

[cr3ghost @cr3ghost]

If you're into malware analysis, reverse engineering or threat intelligence, bookmark this.

@embee_research has built an incredible FREE archive of practical security research covering:

• Ghidra + x64dbg
• Malware unpacking + shellcode
• Cobalt Strike analysis
• API hashing + string decryption
• PE-bear + Dumpulator
• .NET malware + dnSpy
• CyberChef + Python deobfuscation
• YARA + Sigma
• Qakbot, IcedID, AgentTesla, DarkGate + more
• Passive DNS + infrastructure hunting
• Censys / FOFA pivots
• APT infrastructure tracking
• URL hunting
• Module stomping + API hash evasion

A lot of this is hands-on research using real malware samples, not just theory.

Also includes deep dives into campaigns like SideWinder and Gamaredon infrastructure hunting.

Main site:
https://t.co/V5fxg7Ondc

Full archive:
https://t.co/4C1gyIinNM

Huge credit to fellow Australian @embee_research / Matthew for making this research publicly available.

#MalwareAnalysis #ReverseEngineering #ThreatIntel

[vx-underground @vxunderground]

> be me
> get dm
> "smelly, i found goop"
> wtf i love goop (malware)
> weird .vbs file sent
> "RateConfirmation.vbs"
> hmmm
> download
> look inside
> shrimple file loader
> downloads "grape" .zip from funny domain
> download grape zip file
> NodeJS electron goop
> masquerading as Grape Electron
> weird project on GitHub, legit tho
> weird outdated thingie called ChatGrape
> last update 5 years ago
> ???
> exact same source code as ChatGrape on GitHub
> index.js (start of program) modified
> does malware stuff
> launches ChatGrape regularly afterward
> malware appears to try targeting UniWays
> small to medium size company
> freight and transportation company
> covers 48/50 states in US (no alaska or hawaii)
> hmmm
> see C2
> uniwaysllc(.)com
> code sent POST request to C2
> code waits for response
> hmmmm weird
> try to manually contact C2
> nothing happens
> try again
> nothing happens
> looks like malware operator manually reviewing incoming connections

wtf? is this goop is targeting freight and transportation companies? thats awfully suspicious because last time on dragon ball z (if youve been paying attention to my goop posts) we saw a very, very similar goop doing masquerading targeting freight and transportation companies.

this is the 2nd mystery goop weve seen targeting this type of company, except this time the malware has gotten a little smarter and (potentially) manually reviews incoming connections to ensure its the actual target and not reverse engineers. clever clever goop

tell us your secrets mystery threat group attacking transportation companies in the united states. who are you and why do you need to know what truckers are delivering

rate confirmation (loader):
4f342ccb8005a82bed93d9a3c18aab45d32590ffa34834b789229f736889cf56

masqueraded grape:
e8a7ea884593cd26adecbbf602846b2cbd9bd1ec420ebd78c1bf7a64dbf73912

grape modified index.js (payload):
b6c75b53e37e37f743457d10f24fa3f7c51d6e2adc50e68b9c9aebb21c5303c5

pic unrelated

[vx-underground @vxunderground]

Someone sent me some really fucking annoying goop.

The malware (maybe accidentally?) infected a healthcare facility.

The malware was sent to a healthcare worker from a trusted individuals compromised email. Hence, they did not suspect it to be malicious.

The malware has several different stages, it ultimately is a malicious Control Panel Applet, and it's written in Go

Really weird goop, can't find any known malware campaigns that fit the criteria for this malware. I'm not sure if it's a new malware campaign, an enhancement (or modification) of an existing one, or if it's a special goop.

It's really annoying though, it is Go stripped to the bare ass cheeks, but has a bunch of junk and bullshit dependencies it doesn't use, ... It just sucks. Not a fan of this goop.

The C2 it connects to isn't flagged by any AVs yet.

I need to finish bonking it, but holy cannoli is this goop annoying

[DbgMan ^_^ @0XDbgMan]

I can’t talk to people,but I can bypass any EDR ( I’m losing it )