Nikhith

Incident Response guy | Ex-Threat Hunter @Microsoft | Ex-Red Team @Mandiant |
RCE || GTFO | 🪂 Paragliding P2 Pilot | 🤿 Scuba EXP30

[Wietze @Wietze]

https://t.co/r67jck8ZGo just got a visual refresh 🌟

Explore 600+ documented DLL Hijacking cases, including:
• JSON/CSV/YAML feeds
• Sigma detection content for every DLL
• A single Sigma rule covering all DLLs

Check it out: https://t.co/2PJCgKEZwO

[cr3ghost @cr3ghost]

While gamers debate kernel anti-cheat, ring-1[.]io was shipping a Themida-protected UEFI bootkit that injects into Hyper-V, manipulates EPT entries, clones game page tables, and hides memory contents below the OS entirely.

After partially deobfuscating their binaries and recovering critical functions, this is what was inside.
Bungie and Ubisoft sued them.

They found $12 million in Bitcoin and kept going.

This is what kernel anti-cheat is actually fighting.

https://t.co/zHjWeLgQ3X

Authors: @BackEngineerLab

#AntiCheat #Malware #InfoSec

[adam_cyber @Adam_Cyber]

On May 26, 2026, at 14:00 UTC, the CrowdStrike Counter Adversary Operations team executed a coordinated takedown of the Glassworm botnet, a global threat targeting software developers through the open-source supply chain. In collaboration with Google and the Shadowserver Foundation, we struck all four of Glassworm's command-and-control (C2) channels simultaneously, severing the operators from their infected machines and their ability to deliver new malicious payloads.

This takedown matters beyond the botnet. Glassworm marked a significant shift in the threat landscape that should serve as a wake-up call for every organization that ships or consumes software. Adversaries are no longer just targeting products, they're targeting the developers who build them.

https://t.co/rl9EVrA371

[Krutik @krutikvirani]

I once criticized CERT-In on LinkedIn and got calls from terrified employers (past & then present) asking me to remove it.

I said no and proceeded to change all my employment history to ‘Confidential’ to ease their worries.

The reason they panic is because they don’t want to lose their “CERT-In Empanelment”.

CERT-In Empanelment is one of the biggest scams in the Indian cyber security industry.

CERT-In makes you go through several stages of tests (all worthless btw) and then “certifies” you as an empaneled auditing firm.

This status then allows you to bid on government contracts for cyber security projects along with enabling you to serve compliance customers under regulatory bodies.

If, for whatever reason, CERT-In decides to revoke this empanelment, the firm would lose majority of its business.

That’s how CERT-In keeps all the major cyber security firms in India under their thumb.

[Nikhith @Nikhith_]

@moonlock_lab @patrickwardle About time folks!

[blackorbird @blackorbird]

#Turla #Kazuar has expanded from a relatively traditional backdoor into a highly modular peer-to-peer (P2P) #botnet ecosystem designed to enable persistent, covert access to target environments.
https://t.co/mjkfLG8o6q

[Justin Elze @HackingLZ]

If you’re into Impacket you might want to checkout Titanis. Perhaps it’s more opsec safe 🤷‍♂️

https://t.co/cx2JzY6ta1

[🕳 @sekurlsa_pw]

Description of all currently implemented #NetExec modules.

Split by protocol, with example command and all module options.

https://t.co/nGpaLvYje2

[Pyro @0x3b33]

Lazarus group has been paid ~1.6B in bug bounties last year

[Nikhith @Nikhith_]

@corelanc0d3r @RedHatPentester You are the OG

[Gameel Ali 🤘 @MalGamy12]

🔬 Built https://t.co/BabZ0NwkTR for hands-on malware analysis practice.

14 free challenges + 2 APT labs covering API hashing, shellcode, C2 reversing & full attack chains.

Real binaries. Real questions. No setup.

Discord: https://t.co/fxX32X7nso

[Kostas @Kostastsale]

During our research, it’s become apparent that EDRs need to do a better job of collecting telemetry from macOS endpoints. Head over to the https://t.co/3uoNBdqpei to checkout the results yourselves. While you’re there, checkout the scores as well to see how they compare.

Out of the ~43 total points, the average is 16… and that’s with one EDR bringing up the average 🙂

[Thinkst Canary @ThinkstCanary]

Last week we acquired UK-based DeceptIQ.

DeceptIQ (@deceptiq_) is built by red-teamers with a deep desire to turn the tables on attackers. In our ten years of doing Canary, we’ve never seen such a strong natural alignment.

We are super excited to help defenders win, together.

[Stefan @schteppe]

std::vector<bool>

[Nikhith @Nikhith_]

Extremely impressed by the @UIDAI's new website and app. The UI/UX from onboarding to filling an application is completely seamless.

Looks like stellar work by @NICMeity & @GoI_MeitY.

Who's behind this design and execution?

Credit where it’s due! 👏🔥

[Nikhith @Nikhith_]

Any @hackthebox_eu players with Guru / Omniscient rank from India?

Please DM. There's something I got for you.

#CTF

[Aman @Amank1412]

Someone built a web-based System Design Simulator,

where you drag & drop architecture components and actually simulate traffic, failures, latency, and scaling in real time,

System design just got way more interactive.

[Nikhith @Nikhith_]

@NinjaParanoid It's all a spectrum 🌈

[Pavel Yosifovich @zodiacon]

Process hollowing isn’t always “unmap and replace.” This post looks at a variant where the original image stays mapped, a second executable is mapped, and execution is redirected. Close enough to matter for defenders.
https://t.co/LxEqvT3Gsw