Chris Bukavich

Aircall DART lead
Ex-Microsoft Threat Hunt Analyst #DFIR #Threathunting #Python

[Chris Bukavich @APT_410]

@ryanaraine I don’t think this is any trap for the researcher or ill will honestly. Most prod sec teams are drowning still in bug reports, AI only made it worse with slop. Really only think they’re trying to be proactive on things they may have missed

[Chris Bukavich @APT_410]

@ItsReallyNick Or a bunch current create 10 inefficient queries to achieve coverage

[Chris Bukavich @APT_410]

@ItsReallyNick Many of the current AI detection platforms have the problem, they never saw the attack so they guess… Do you have logs? Is it pure noise? I always made the best detections replicating the attack -> hunt and tune off that -> implement

[Chris Bukavich @APT_410]

@IceSolst Main reason atleast for me Claude is good enough with the setup. Only real problem harness helped me with atleast so far is implemented as autonomous I want safeguards, know what it did exactly etc and how can we tune it for running at scale

[Chris Bukavich @APT_410]

@IceSolst Some AI SOC tools I’m making broke down to:
1. Interactive - Claude + layers rules + routing to other rules + mcp servers has been fine. Non deterministic is fine
2. Background hands off agents - need custom telem, schema enforcement, control custom harness made sense here

[Chris Bukavich @APT_410]

@elonmusk @grok why is it ending and what’s next

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Chris Bukavich @APT_410]

@HackingDave Autonomous not as much like openclaw. Steering it is just easier in Claude manually to me.

[Chris Bukavich @APT_410]

@HackingDave Claude with access to email, calendar, Jira and confluence is a game changer at least for me engineering. Had it read through several code repositories, look back to confluence and jira -> output mermaid diagrams to understand how systems were built.

[Chris Bukavich @APT_410]

@cgtwts @grok is this video real

[Chris Bukavich @APT_410]

@UK_Daniel_Card @fmdz387 The port that’s actually exposed is mdns leaking a bunch of info on the os but pretty sure you can’t call it directly from the internet unless it’s listening on a messaging app? Correct me if I’m wrong?

[Chris Bukavich @APT_410]

@BehizyTweets @grok verify this

[Chris Bukavich @APT_410]

@Knesix @grok is this real

[Chris Bukavich @APT_410]

@TansuYegen @grok is this true?

[International Cyber Digest @IntCyberDigest]

‼️🇰🇵 Another North Korean hacker using AI to alter his face caught while trying to infiltrate Bitso.

Meet "Sebastian," a software engineer from Colombia who can't speak Spanish. Strange, right?

[Chris Bukavich @APT_410]

@PyroTek3 Main edge case for not disabling is for headless apps. Most users won’t use this especially on windows

[Chris Bukavich @APT_410]

@ItsReallyNick I’m curious when the user clicks authorize does it enable the attacker to continue after the session to access the account with all those perms?

[Chris Bukavich @APT_410]

@manishkhosiya What are you talking about you can go buy this right now, if you use it maliciously that’s on you.

[Nick Carr @ItsReallyNick]

We are scouting for reverse engineering talent to contribute to Microsoft’s intelligence mission: https://t.co/awiZyJBlal
I can’t guarantee you will understand the vast security data, but I can promise you will often be the first human defender to ever look at a certain malicious code. You have the opportunity (duty?) to create global protections for that malware – for enterprises and home users alike. Quite a few times, you will do this before it causes any harm.
Curiosity & ingenuity as important as technical experience.
If we have worked together (#FLARE 👀 or otherwise), please DM for questions.

[Chris Bukavich @APT_410]

@sherrod_im Cast iron like this from Walmart if inside, can put butter in it too. It’ll be the best inside, salt lightly both sides and sprinkle steak seasoning like below

https://t.co/t0t9WRMQ3C

Lodge Cast Iron 10.5" Seasoned Square Grill Pan https://t.co/YHGzxL9JK6