Nadav Lorber

Director of Research @ Mate Security | Ex. Morphisec & IronSource & Verint

[Nadav Lorber @LNadav]

Joining the MCP trend with windbg-ext-mcp 🐛Now you can vibe debugging your Windows kernel:
https://t.co/toVteRak6b

Example of asking Claude to hide explorer.exe by unlinking it from EPROCESS + PspCidTable:
#windbg #mcp

[Nadav Lorber @LNadav]

@nivctl אני פרוד עכשיו.. נראה לי הגיע הזמן לבאג חדש

[vx-underground @vxunderground]

One way to differentiate a real nerd from a phony nerd is their appreciation of stuff

For example, someone may share an idea, or proof-of-concept, which illustrates something which is unusual

A nerd will appreciate it for it's documentation and appreciation that someone has shared this finding

A phony nerd will almost immediately, without hesitation, question the applicability of the thing being presented

Dawg, not everything has to have a purpose. Sometimes things are fun. Sometimes it's cool to do shit, just do to do shit. Not everything has to be for profit, or progress, or whatever the fuck else.

I've done so much useless stupid bullshit just because I thought it was interesting.

I've seen nerds share weird ass notes on something they reversed on Windows that basically no one uses or gives a shit about, and I love it and appreciate it.

You can just do things bro

The unknown is cool and badass. Explore it

If it's known and you wanna explore it, do it anyway so you can experience it yourself

Just fuckin have fun idfk

[Nadav Lorber @LNadav]

@grok @Ainthropos @elder_plinius @vxunderground might help u with this mystery

[Nadav Lorber @LNadav]

@yacineMTB Lets start by making our detection solution fully functional before lowering prevention costs 🥲🥲

[Andrej Karpathy @karpathy]

@sama Smarter! I can go for a nice walk or something it's okay.

[Nadav Lorber @LNadav]

@levelsio True. I treat it like IRL - dont complicate what is simple. Best practice IMO: dont let it auto-pick the mode (like the ‘old’ times 😅). Just switch manually between instant and thinking when you actually need to (can be done within the same chat context)

[Krakovia @krakovia_evm]

someone deployed a malware extension for @cursor_ai but seems he forgot to delete promotional messages and the clear-text payload lol
extra loot: download booster script

[Nadav Lorber @LNadav]

ssl expired. attention didn’t. total mvp!
(static sites don’t need it, npcs do)

[kache @yacineMTB]

hey guys, just set up my website. you can see it at https://t.co/iGywIxJkde

[Nadav Lorber @LNadav]

@Presidentlin They actually had one of the major leaks including chat history, API secrets and more
https://t.co/6oS4EYJSwV

[Nadav Lorber @LNadav]

By 'implementing a waitlist' all they did was remove the installer download link from their site 🙄 You can just get the installer from other sources and first-time login will activate it! I'd expect more from AWS 😂

[Kiro @kirodotdev]

🚀 Thank you for your amazing response to Kiro! We're seeing unprecedented demand. To ensure we can continue to provide the experience our community loves, we’ve implemented a waitlist as we fine tune Kiro.

👉 Sign up here https://t.co/PfhA0JXxKp

[kache @yacineMTB]

ENGINEER TIER LIST
chinese
israeli
canadian
indian
french
polish
<power gap>
american
spanish

[Nadav Lorber @LNadav]

@KernelDBG I also anticipated that but it did not trigger in my tests (up to 15min post), perhaps the routine checks are pretty lazy 😬

[Nadav Lorber @LNadav]

Joining the MCP trend with windbg-ext-mcp 🐛Now you can vibe debugging your Windows kernel:
https://t.co/toVteRak6b

Example of asking Claude to hide explorer.exe by unlinking it from EPROCESS + PspCidTable:
#windbg #mcp

[Nadav Lorber @LNadav]

@mrexodia Does not supports live debugging. For a robust solution I preferred to implement the functionality into WinDbg extension instead of wrapper library.

[Virus Bulletin @virusbtn]

Morphisec's Nadav Lorber analyses ResolverRAT, a newly identified remote access trojan that combines advanced in-memory execution, API and resource resolution at runtime, and layered evasion techniques. https://t.co/28xWuAshLw

[Nadav Lorber @LNadav]

@elad_bn מוזמן להתייעץ איתי בפרטי, אתן לך כמה כיוונים מב כדאי לעשות (:
מצרף תמונה מהג׳ונגל הביתי שלי ליחס (יש עוד באינסטגרם n.exotics)

[Nadav Lorber @LNadav]

@regev_miri אם תתפטרי, לפחות תוכלי להמשיך לחיות את חייך עם טיפונת כבוד בכך שתהווי דוגמא לשאר השרים המתנהלים כמוך.

[Morphisec @morphisec]

Throughout the year, Morphisec has learned much about the Chae$ 4 malware variant.

On October 18th, our team will help you understand what is new and how it can impact your business.

Reserve your spot at our 45-minute interactive webinar here: https://t.co/XnmBcLXmeK!

[Nadav Lorber @LNadav]

Our new research is one of our best publications in recent years, if you are interested in the malware & threat domain it's a must-read!

[Hido Cohen @0xhido]

Excited to release our latest research. This time, @osipov_ar and I have researched a new variant of the #Chaes malware by #Lucifer #APT.

🔴Fully written in Python
🔴Packed with 7 modules
🔴Updated target list

Blog post and full research PDF: https://t.co/qwtq67h3h2

[Arnold Osipov @osipov_ar]

Ongoing #in2al5dp3in4er (invalid printer) loader delivering #Aurora stealer from a #MidJourney themed website.
Still #FUD on VirusTotal - 0 detections!

C2: 94.142.138[.]218:4561
Fake websites:
midj0urney[.]org
get.mid-journey[.]org/?gclid

More info - https://t.co/DVetrkO3Zo