Marcus Hutchins

Professional Shitposter

[Marcus Hutchins @MalwareTechBlog]

Since my posts have been shared here ~30 times in the past few weeks, it seems like I'm going to be contributing to Space Karen's Ketamine Extravaganza whether I like it or not.

I don't really intend to be active here, but I'll post some of the more important cybersecurity-focused stuff, since it gets screenshotted anyway. That way, people don't have to read post a week late and out of context.

[Marcus Hutchins @MalwareTechBlog]

@Timmo_AFC Pretty clear, based on what exactly?

[Marcus Hutchins @MalwareTechBlog]

The reason these "throw everything at once" style agentic cyberattacks work is because most orgs are chronically terrified of deploying deterministic detection + remediation automations.

Most security products have a "lock out this account" or "disconnect this system" or "block this IP" options that you can set if certain alerts are triggered. But because business function takes precedent, most orgs would rather risk a successful intrusion than an accidental disruption.

There's no reason to believe that "agentic defenders" would be a viable solution. Defenders need to consume many times more context/signals that attackers do, therefore by nature are slower. Defenders win on controlling the playing field, not out-maneuvering attackers like it's some Hollywood style fighter jet battle.

In the same way that reactive human defenses are slower than human offense, reactive AI defense are slower than AI offense (and regular old deterministic automations, too). The whole "fight AI with AI" thing is pretty ridiculous and misunderstands what good defense looks like.

The only answer is proactive defense + fast deterministic detection & response. But nobody is ready for that talk yet, so we're probably just gonna do like 10 years of "agentic AI SOC", until everyone runs out of money and/or figures out it doesn't work.

[Marcus Hutchins @MalwareTechBlog]

@ClownYouAllDay @LisaForteUK @UK_Daniel_Card So we've basically learned that AI sucks and doesn't do what you ask. Glad that's out of the way :)

[Marcus Hutchins @MalwareTechBlog]

idk about this whole "AI enables attackers to write more effective phishing emails" thing. If AI slop is more effective than you at phishing, you should probably take that information to the grave. Couldn't waterboard it out of me.

[Marcus Hutchins @MalwareTechBlog]

@NLAndersson How many tailored phishing emails have you seen in your life that go beyond basic "Hello {first_name}" mail merge?

[Marcus Hutchins @MalwareTechBlog]

@ClownYouAllDay @LisaForteUK @UK_Daniel_Card I just wanna know why it randomly decided I don't capitalize letters at the start of sentences.

[Pat Opet @patopet]

if you’re working for a company in cybersecurity, you should be evaluating your options to abstract your companies services from the internet

what i mean is: why allow an unauthenticated anonymous agent of an attacker to interact with your systems?

consider your architectural levers now, you’re going to need them

[Marcus Hutchins @MalwareTechBlog]

@ClownYouAllDay @LisaForteUK @UK_Daniel_Card Crappy AI language, rule of threes, crap rhetorical devices, and apparently I don't know how to capitalize letters anymore?

[Marcus Hutchins @MalwareTechBlog]

@acd421 @amiateapot So, this oversized baby isn't you?

[Marcus Hutchins @MalwareTechBlog]

@acd421 @amiateapot Bro you literally built like slender man had an eating disorder. I'd be more scared of a literal child threatening me than you. You are a monumental fucking loser.

[Marcus Hutchins @MalwareTechBlog]

@LisaForteUK @UK_Daniel_Card Maybe the AI phishing superhackers can make more money legally by teaching companies how to write AI communications that don't sounds like slop

[Marcus Hutchins @MalwareTechBlog]

LCFR is cool and has talent though, he also privately disclosed the vulnerability to try and prevent talentless LARPers like you from causing harm. I'm loving the 10+ day long crashout though. Just like with cybersecurity, you pretend to fight the good fight, then platform a pro-genocide transphobic stalker the second you face the slightest amount of criticism. I genuinely could not be this much of a generational-level spineless loser even if I dedicated my entire life to studying the art.

Good luck with your new psychopath friend, maybe you can cheer on vaporizing kids together. You've somehow manage to take my extremely low opinion of you and lower it through the center of the earth. I scrolled your feed and was like "well at least his politics aren't awful". But turns out that was all an act, just like your security researcher status.

Grifter gonna grift ig.

[Marcus Hutchins @MalwareTechBlog]

Why not make the exploit then? Should be super easy.

Also, even the most basic of criminals know to break up the requests into smaller parts & split them up across different sessions, or reframe them to avoid the LLM acquiring enough context to realize what it's being asked to do.

This explains your abliterated GLM obsession though. You're coming at it from the angle of thinking even the most inept criminals on the planet are 10x dumber than they actually are.

[Marcus Hutchins @MalwareTechBlog]

@konsolitus Translate & grammar checking features has existed since long before generative AI

[Marcus Hutchins @MalwareTechBlog]

@akses_0x00 I also get the feeling all the unironic "abliterated GLM" people don't realize abliteration doesn't just remove guardrails, it also lobotomizes the model. Between what you said and that, there's a good reason why most threat actors are just using regular GLM or frontier models.

[Marcus Hutchins @MalwareTechBlog]

@msuiche @IceSolst @0x4D31 @HeidyKhlaaf @calif_io @XorNinja @brucedang IceSolst's post clearly went over your head also.

[Marcus Hutchins @MalwareTechBlog]

@amiateapot @acd421 Just goes to show what kind of person he is. I called him out for causing overt harm and profiting from it, so he proves me wrong by immediately giving up all his core beliefs and aligning with a genocidal psychopath who is also suffering from severe psychosis. lol. gg, no re.

[Marcus Hutchins @MalwareTechBlog]

@tannerbhaas Super bad take. I you ignore how ridiculous that is, plenty of orgs don't get hacked for their data.

[Marcus Hutchins @MalwareTechBlog]

@blaktron @travisharder @ZackKorman haha, me too. Stressed as hell 🤣

[Marcus Hutchins @MalwareTechBlog]

@blaktron @travisharder @ZackKorman I thought about creating a follow up to just be like "wtaf guys" but I was too busy with work

[Marcus Hutchins @MalwareTechBlog]

@vans12njinca I have been known to take out the trawler on occasions

[Marcus Hutchins @MalwareTechBlog]

@HackingLZ I feel like peak OST has been surpassed. I walked in to people trying to release php2shell exploits 13 hours before patch went live, claiming it was "educating defenders", then immediately using the attention to promote a shitcoin that netted them $78k in trading fees