Düzgün

Cyber Threat Researcher

[Düzgün @Root0ne]

Thanks. all 5 are in the table at the end of the post. honestly neither really. one is just naming, the other names vendors use for the family (IceNova, Unidentified 111, Lotus, BLACKWIDOW) which arent in the file itself. one is a small reversing detail only one analysis mentions, two imports get resolved with a hash other than CRC-32. the other three are ATT&CK labels the report didnt assign, T1055 T1083 and T1041. for T1055 the report actually says the opposite with evidence, the injection capable APIs get resolved but nothing in this sample ever calls them. and the sample was detonated in a sandbox during the run so runtime behaviour was covered too

[Düzgün @Root0ne]

AI Agents vs Human Malware Analysts

Nine Malspark AI agents on Claude Haiku 5.5 analysed a Latrodectus sample in 84 minutes for 8.24 USD. Against 89 facts from eight analyses by human malware analysts, their report recovered 84 and got none wrong. https://t.co/DbaZXNkCbn

[Düzgün @Root0ne]

@D3crypTor_X Thanks. Static Android analysis is already there: APK and dex files are routed to a JADX server that decompiles the bytecode for the agents, alongside manifest, permission and certificate parsing
https://t.co/RTOSd82sb9

[Düzgün @Root0ne]

@caliskanfurkan_ Yorumlarınızı bekliyorum

[Düzgün @Root0ne]

Yes, most of that set ships by default. The deterministic triage pack runs capa, strings with FLOSS decoding, YARA and Sigma over the sandbox events before any agent starts, and each result lands in the evidence ledger with its own ev_ id. For sandboxes, CAPEv2, Hatching Triage and a generic REST adapter are built in, and their process, network and API-call traces come in as one normalised report. You only supply your own instance URL or API key. Decompilers and the other tools come in as MCP servers, and any MCP server you add is cited the same way.

[Düzgün @Root0ne]

⚡️Meet Malspark: an open-source, multi-agent malware analysis platform.

AI analysts investigate with real tools, debate their findings, and a judge rules on the verdict. Every claim is backed by verifiable evidence.

https://t.co/roNU3Bmjwu
https://t.co/ldBoRtxjss

[Düzgün @Root0ne]

The Bitget attacker's wallet, analysed with Pusula: Lazarus Group pattern, 99.88% confidence.

Attribution from on-chain fund flows alone, not blocklists.

[Düzgün @Root0ne]

@catgirl_root @BleepinComputer Çok iyi fikirmiş

[Düzgün @Root0ne]

My new paper: Forensic Analysis of the HackRF One with PortaPack Mayhem Firmware

Paper: https://t.co/rQtWmg1Q8S
HackRF forensic image: https://t.co/EC3ze3aUQV

[0x6rss @0x6rss]

Türk tehdit aktörleri chatgpt daybreak için KYC kovalamaya başlamışlar. artık tehdit aktörlerimizin "doğrulanmış" onlarca siber ajanları olabilir. sıkıntı

[Düzgün @Root0ne]

Two new detectors are live on PusulaTrace: Locky and Cerber ransomware. Paste a Bitcoin address and the AI attributes the wallet to the group behind it.

Live evaluation:
• Locky: 98% recall, 0.2% false positives
• Cerber: 99.8% recall, 0.3% false positives

🔗 https://t.co/Xzm7kP0jO9

[Düzgün @Root0ne]

The Bitget attacker's wallet, analysed with Pusula: Lazarus Group pattern, 99.88% confidence.

Attribution from on-chain fund flows alone, not blocklists.

[Düzgün @Root0ne]

@0x6rss Paylaşım için teşekkürler 🙂

[0x6rss @0x6rss]

hatırlarsanız geçtiğimiz yaz BtcTürk'teki cüzdanlar hedef alınarak yaklaşık 45-50 milyon dolarlık bir siber saldırı gerçekleşmişti. @Root0ne 'ın geliştirdiği PusulaTrace isimli algoritmik model, bu saldırının Kuzey Kore ilişkili Lazarus APT grubuna atfetdildiğini önemli ölçüde kanıtlar nitelikte. 👇

[Düzgün @Root0ne]

@catgirl_root @DarkWebInformer 😄

[Düzgün @Root0ne]

@0x6rss Thank you!

[Düzgün @Root0ne]

The Bitget attacker's wallet, analysed with Pusula: Lazarus Group pattern, 99.88% confidence.

Attribution from on-chain fund flows alone, not blocklists.

[Düzgün @Root0ne]

Free access for researchers and cybersecurity professionals: fill in the form at https://t.co/3upRJWVi5p

Anonymous profiles will not be accepted.

[Düzgün @Root0ne]

@catgirl_root Beğenmene sevindim. Evet ismi ben de beğenmiştim :D

[Düzgün @Root0ne]

My blog post on the Iran-backed APT group MuddyWater is out. MuddyWater uses tools from TAG-150, a Malware-as-a-Service platform run by Russian-speaking cybercriminals. In this campaign, an MSI package is distributed through Amadey, installs the Deno-based DinDoor agent and runs it in memory. The agent collects browser passwords, cookies and crypto wallet data, and the final stage of the chain connects to a CastleRAT C2 server.

https://t.co/wtyOoeSRhV

[Düzgün @Root0ne]

@onuroktay Teşekkürler Onur hocam :)