Brian Baskin

Threat researcher, malware analysis, RE, incident response, with some old school forensics and CTFing. Apologetic ginger. These are my personal opinions

[Brian Baskin @bbaskin]

Thank you @BSidesVancouver for an awesome event. Happy to present on a modern, unique targeted phishing account, and then win the event @corelight_inc CTF.

Credit to the CoreLight platform. I've never used it before but picked it up quickly to finish first.

[eversinc33 🤍🔪⋆｡˚ ⋆ @eversinc33]

Spent the last 2 weeks working on a devirtualizer for VMProtect 3.5 and learning Remill. Idk yet if I will blog about it, but I at least wanted to publish the code:

https://t.co/GLqKWpOOU7

The approach is different from my last blog, as it lifts the whole x86 code of the VM

[Brian Baskin @bbaskin]

At a Free Palestine protest in a city when a car passenger throws a water bottle at a protestor... And then just sits there because they're stuck in traffic

Cops just walks over and yanks him out of car. If you're going to commit a crime at least think through your escape 😂

[Calle Svensson @ZetaTwo]

I'm optimistic we can create _some_ type of knowledge-based security-related community activity but traditional online jeopardy-style CTF as a competitive format is on its deathbed and this video hurts. Big love to the community that has meant the world to me the past 11 years!

[Jackson Atkins @JacksonAtkinsX]

My current experience with coding models.

[Zack Korman @ZackKorman]

Might be a dumb question, but how are devs on personal machines supposed to catch this?

Or do a lot of them just stay pwned and never know it?

[Alexander Leishman 🇺🇸 @Leishman]

hilarious phishing email I just got. 10/10 execution

[Brian Baskin @bbaskin]

We keep talking about the housing crisis. We never discuss how our kids will never afford services we were grandfathered into

[Wario64 @Wario64]

new Lifetime Plex Pass will price increase to $749.99 on July 1st (from $249.99) https://t.co/USt6IjsvHR

[theselongwars @theselongwars_]

still not quite over the fact that i watched 15 year olds get sued for millions of dollars for downloading twelve songs and now we all have to accept AI slop because every tech company in the known universe decided that IP laws don't exist now that they're inconvenient for them

[Brian Baskin @bbaskin]

@bugfireIO @sublime_sec Thank you! Luke and I had fun with the webinar, even if it was just the two of us chatting with an audience

I can try to produce a sanitized version of one of the variants. Shoot me a DM and I can get it to you in a safe way.

[Anonymous @YourAnonNews]

Shark Tank Billionaire Kevin O'leary says 2 people fighting data centers in Utah are Chinese agents. Turns out its just 2 local girls in Utah, they make a hilarious video calling him the fuck out

[Brian Baskin @bbaskin]

@TheUncleBob Hah and almost guarantee this person did.

And also probably banking on the other not wanting the trouble of filing a police report.

[Brian Baskin @bbaskin]

TIL, if you forget $60 cash back at a Walmart self checkout, it will just patiently keep it there for anyone to take. It won't retract it. Kudos to the two people after me at that station who ignored it, but not to the third that took it.

[Aaron Rupar @atrupar]

Q: Did you talk to Xi about the cyber attacks that he's done in the United States?

TRUMP: I did. And he talked about attacks we did in China. You know, what they do, we do too. We spy like hell on them too. I told him, 'we do a lot of stuff to you that that you don't know about.'

[Brian Baskin @bbaskin]

I don't know how anything works anymore

[Brian Baskin @bbaskin]

@bugfireIO @sublime_sec Each sample has the victim's address embedded, so we're not able to directly share any unfortunately.

[Brian Baskin @bbaskin]

This type of decoding is always fun to me. I gave a presentation 14 years ago (OMG!) at @novahackers on deobfuscating and reading encoded Java opcodes:

https://t.co/E1vqkj1Day

[Brian Baskin @bbaskin]

Teammate raised this as an interesting campaign ITW

Full in-memory VM written in JavaScript (e.g. ADD, SUB, MOV instructions as functions). Zero hits on internet, VT hits were just a few weeks old.

What I thought was a clever VM attack was just a brand new open-source project

[Sublime Security @sublime_sec]

🚨 Threat actors are now using JavaScript virtual machines to hide phishing payloads inside HTML attachments.

Sublime Threat Intelligence and Research (STIR) observed FlowerStorm operators adopting KrakVM just weeks after its release.

The campaign included:
• VM-based obfuscation
• Credential harvesting
• Real-time MFA interception

A key takeaway: advanced obfuscation is becoming easier to operationalize.

Our latest research breaks down the attack chain and what defenders should watch for next.

https://t.co/2PaLq4eQvE

#Cybersecurity #Phishing

[Brian Baskin @bbaskin]

It wasn't until I started searching variables for code reuse on Github did I realize it was a brand new open source project released just a few weeks prior: https://t.co/hfyNcbFDbI

Lesson to learn: New open source tools will be found and immediately put into use by threat actors