Fotios Ailianos

Cybersec Professional . Malware and Cyber Incidents enthusiast

[Fotios Ailianos @__fastcall]

My first attempt to fully analyze a malware is related to a major #Emotet campaign that affected Greece during 2020. Any comments or recommendations will be more than welcome. You can read it here: https://t.co/I9dd9NOb6O

[Vaishnavi @_vmlops]

MICROSOFT OPEN-SOURCED THEIR ENTIRE SENTINEL SECURITY TOOLKIT

most teams building on azure figure out threat detection the hard way

trial and error, custom KQL, dashboards built from nothing, playbooks written by hand

nobody told them it was already done

the sentinel github repo has:

▫️ 1000+ pre-built threat detection rules
▫️ hunting queries for active threat investigation
▫️ automated response playbooks
▫️ security workbooks + dashboards
▫️ data connectors for 100s of sources

the hard part was already done

https://t.co/VHbH2pIRRe

[Tim Blazytko @mr_phrazer]

New blog post: Building a Pipeline for Agentic Malware Analysis

Agentic RE + malware analysis with custom skills, MCP tooling, and persistent case state to automate intial triage

Link: https://t.co/Itj9S3rA9q

Github: https://t.co/kfvjN7ot4d

[Moritz @m_r_tz]

Speakeasy emulator v2b1 is here! 🚀 Massive upgrade thanks to @williballenthin. Modernized codebase using Unicorn 2. Now handles complex multi-stage unpacking and deep system introspection. API traces on par with sandbox analysis.
https://t.co/gQJRqVxp7o
https://t.co/7MdrgadxqA

[Tom Hegel @TomHegel]

NEW DROP: A look at using LLMs to turn CTI narratives into structured knowledge graphs, complete with empirical evaluation across GPT-4.1, GPT-5, Claude Sonnet/Opus and more.

If you're building or evaluating AI-augmented CTI pipelines, this one's worth your time.

Great work from @milenkowski & Razvan Gabriel Cirstea:

https://t.co/3GBt0YHTzO

[YungBinary @YungBinary]

New blog is out! Deep dive into a suspected North Korean APT deploying #DEVPOPPER RAT (Node.js) and #OmniStealer (Python). Excellent resource for those interested in deobfuscation methods on highly obfuscated JavaScript and DPRK APT TTPs!
https://t.co/AjmYVEbFWq

[Fotios Ailianos @__fastcall]

@williballenthin how did that magic happen?

[vx-underground @vxunderground]

Chat, I've done it.

I've managed to get Windows Sockets (Winsock) functionality working by communicating directly with AFD (Ancillary Function Driver for WinSock) by IO control codes AND used it with HTTPS by using SSPI (Microsoft Security Support Provider Interface).

By doing this, this completely eliminates the need for WININET or WINHTTP for malware payloads. It also removes the weird telemetry and ETW stuff present in Winsocks, WININET, and WINHTTP.

My code is still in a debug state at the moment, but I'll eventually release a non-fucked-up version (no SYSCALLs, no position independence) so people can look at it, study it, or review it.

Currently this is only supports GET requests for simple pages (not even file downloads...). However, I'm having so much fun with this I think I am going to expand on it to do the following:

- HTTPS authentication
- HTTPS upload
- HTTPS download
- ???

I'll make it all open source, non-crazy, in a format people can copy pasta and have fun with it. I'll also probably make a fork where it's the crazy schizo version.

I hope all my malware development friends, reverse engineer friends, and anime friends, look at it and appreciate it. This is some of my favorite code I've written and I think it has a lot of applicability to Red team engagement. Conversely, it also offers insight to defenders on detecting this sort of functionality.

[Fotios Ailianos @__fastcall]

Excellent work

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

NEW BLOG: The Great VM Escape 💕

We caught threat actors deploying a VMware ESXi exploit toolkit in the wild - potentially was a zero-day developed over a year before VMware's disclosure 👀

If anyone has thoughts on it let me know, but I needed almost a full case of beer to wrap my head around this one 🍺

Full technical breakdown 👇
https://t.co/wXT9c7ytVh

[sandr0 @Sandr0x00]

@nickharbour To anybody who (like me) is disappointed in the official writeup, @SuperFashi1 actually has created very good one: https://t.co/02fnCet6k3

[Fotios Ailianos @__fastcall]

#flareon12 was definitely on of my favorites. Challenge 9 was written by a phycho which is a master in their craft. Overall, I enjoyed it much more than last year. Thank you @Mandiant , @nickharbour and the whole team.

[gmh5225.eth @gmhzxy]

Yet another DMCA project 😃
https://t.co/S6f8fND52b

[2OURC3 @2ourc3]

Just launched Code Auditor CTF — https://t.co/S87nvpjfht

A web platform to practice finding real-world C/C++ vulnerabilities
• 8000+ challenges
• Progress tracking + leaderboard
• Beginner-friendly
• Fully open source (beta): https://t.co/0yqyGmviCM

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

I have tried VSCode with co-pilot and Windsurf, but unfortunately, neither worked well for my projects. Then I recently came across @cursor_ai, and it’s been an amazing experience so far. I just wish Anthropic had more GPUs to better support Cursor’s traffic 🥲

[Adam Chester 🏴‍☠️ @_xpn_]

MS research on AI Impact on Critical Thinking… the results will shock you! https://t.co/285uVLyV43

[Jiří Vinopal @vinopaljiri]

You can give a try to edb-debbuger. It's actually a good one. I am mostly using it or debugging remotely with IDA. #linux #edb #debugger
https://t.co/DtQybQorSl

[PagedOut @pagedout_zine]

Why You Should Get An ATARI ST In 2024!

Article Highlight #9 - check it out in Paged Out! #4 page 13
https://t.co/A1iJb41WsZ

[Jiří Vinopal @vinopaljiri]

As I found this IDA plugin idea pretty cool and useful, I ported it to support Python2/3 and IDA>=7.4 (tested IDA 7.7, 8.4) ➡️ available Here:
https://t.co/K8Rrv2AUCT

It is a modified version of @williballenthin IDA Plugin "hint_calls.py"'. Enjoy, and thank you Willi 💙😊🙏

[Joe Stocker @ITguySoCal]

🧵Did some lightweight #DFIR on a Russian threat actor last night. Several observations to share here. 1) they may initial do some scanning from Russia but quickly pivot to IP’s inside the USA to bypass GeoFencing. Too customers feel way too safe with Geo Fencing! 2) …

[Fotios Ailianos @__fastcall]

Excellent presentation from Virus Bulleting 2023 by @kucher1n. I really enjoyed this one. https://t.co/sSqgynYzRx