Omar

Senior Security Researcher @Kaspersky GReAT - tweets and opinions are my own

[Leonid Bezvershenko @bzvr_]

just a little over a week left until the SAS CTF 2026 quals kick off. looking forward to seeing you at the onsite finals in Bali 🌴

[Georgy Kucherin @kucher1n]

Together with @bzvr_, @2igosha and Anton Kargin, we identified that the DAEMON Tools software has been compromised in a complex supply chain attack since April 8. We see thousands of infections across 100+ countries. If you use DAEMON Tools, run a malware scan immediately! [1/7]

[Theodor Arsenij @m4drat]

New blog post! Writeup for my SASCTF'25 Finals A/D challenge: BPF-style symbolic verification of bare-metal RISC-V using Triton, a custom QEMU machine, and 5 bugs hidden across the stack. From verifier bypasses to a full QEMU escape 🔑

(link in comments)

[Boris Larin @oct0xor]

We analyzed the Coruna exploit kit and found intriguing code overlaps with Operation Triangulation. Full analysis on our blog: link below.

[TLPBLACK @wearetlpblack]

Alice left the Wonderland - https://t.co/tKiuQLKjui

[Boris Larin @oct0xor]

Heartbroken to hear about the passing of @Skvern0. He was one of the best threat hunters in the industry - even APTs were afraid of him. I’m grateful for the time we worked together and for everything I learned from him. Rest in peace.

[Kaspersky @kaspersky]

Kaspersky GReAT researcher @malware_owl discovered CVE-2026-3102 — a command injection vulnerability in ExifTool (≤13.49) on macOS. A crafted image file with malicious metadata can trigger arbitrary code execution. Update to v13.50 now!

#Kaspersky #GReAT #Cybersecurity #VulnerabilityResearch #OpenSource #InfoSec #macOS

[Kaspersky @kaspersky]

Arkanix Stealer didn’t just steal data. It ran like a startup.

• MaaS model
• Discord marketing
• Referral program
• C++ & Python variants
• Crypto & browser data theft

Short-lived campaign. Long-term implications.

Full analysis: https://t.co/fcnkRrlXH6

#Malware #Infostealer #ThreatIntel #CyberSecurity

[Georgy Kucherin @kucher1n]

It turned out there are many more payloads used in the Notepad++ attack! To stay undetected, its masterminds were COMPLETELY changing execution chains about every month.

Here are more IPs used in the attack:
45.76.155[.]202
45.32.144[.]255

Read below for many other IoCs! [1/8]

[blackorbird @blackorbird]

A full iOS zero-day exploit chain used in the wild against targets in Egypt. #Intellexa #Predator

Stage 1: Initial RCE via JSKit Framework (Safari WebKit Exploitation)Entry Point: The chain starts with a zero-day RCE vulnerability in Safari's WebKit rendering engine, patched by Apple as CVE-2023-41993 (a memory corruption issue in the JIT compiler).

Stage 2: Sandbox Escape and Kernel Privilege EscalationVulnerabilities Exploited: CVE-2023-41992: Kernel IPC use-after-free (sandbox escape + local privilege escalation, LPE).
CVE-2023-41991: Code-signing bypass (LPE).

Stage 3: Persistence and Surveillance Setup (PREYHUNTER Modules)Components: Divided into two modules—"watcher" and "helper"—deployed via the escalated privileges from Stage 2.
https://t.co/VQACc9Bg5l

https://t.co/0aYeiQj8lj

[Omar @beacon_exe]

GhostCall by BlueNoroff is still going crazy.

[BadlandYW @BadlandYW]

⚠️ URGENT WARNING ⚠️

I’m sharing this as something urgent and important please be careful, everyone.

Linda is my friend. She used to work in capital markets, and we met years ago. Yesterday, she asked me to join a meeting. I thought it was for a project and accepted. She sent me a calendar invite, and I joined the meeting this morning at 9 AM.

It was supposed to be on Google Meet, but no one was there. Then they sent me a Zoom link. I clicked it and opened it in my browser.

When I joined, everything looked broken and the page asked me to run a “system update.”
Instead, I chose to download Zoom manually and asked for the meeting ID.
They refused to give it and said the update would be “easier.”

That’s when I deleted everything and shut it down.
I told them my computer couldn’t handle the update and that we should continue on Meet.
Strangely, my camera wouldn’t turn off no matter what I did.

I calmly closed all tabs, deleted everything, restarted my browser, and ran a full virus scan.
Then I realized Linda had been hacked, and the hackers were after me.

To those hackers: waving at you 👋 you almost got me, but not this time.

Linda was someone I really trusted.
Let this be a reminder to everyone:
If someone asks you to download or install something don’t do it!

[Omar @beacon_exe]

@3ffaaat مش عارف اقولك ايه ياعم 🤣🤣❤️❤️❤️

[Omar @beacon_exe]

couldn't ask for a better partner in crime at #TheSAS2025 stage.

Check out our full research, uncovering #GhostCall and #GhostHire of #Bluenoroff here:

https://t.co/xI1KwtTqI4

[hypen @hypen1117]

It was truly an honor to be part of #TheSAS2025 as a speaker! I and Omar (@beacon_exe) shared some juicy insights from our extensive research on #BlueNoroff's #GhostCall and #GhostHire campaign, part of #SnatchCrypto.

You can find our research below. ✅

https://t.co/UVH5GGQHBc

[Boris Larin @oct0xor]

Yesterday’s hackyard party was wild - still recovering 😅 #TheSAS2025

[Omar @beacon_exe]

@oct0xor @hypen1117 Thank you, Mr boris!!!! 🫡

[Boris Larin @oct0xor]

My teammates @hypen1117 and @beacon_exe are absolute gods of PowerPoint. Their slides design is on another level! #TheSAS2025

[Sergey Lozhkin @61ack1ynx]

New "Dante" malware from former "Hacking team"

https://t.co/hAMh0R0sI9

[Saurabh Sharma @SaurabhSha15]

We(@kucher1n and myself ) discovered a new advanced threat campaign, PassiveNeuron, is actively targeting Windows Server environments in government, financial and industrial organisations across Asia, Africa and Latin America.
For more details - https://t.co/g33kgGsMal

[Boris Larin @oct0xor]

The SAS conference (@TheSAScon) looks AMAZING this year!🔥 Love the talks lineup, the venue, the GTA theme (!!!), and the special guest! I’m also presenting something secret👀

I’ve got one extra ticket - DM me if I might know you and you’d like to come!

[TheSAS2026 @TheSAScon]

#TheSAS2025 agenda is almost ready! Keep an eye on the website updates as we iron out the final details with our stellar speaker lineup this week.
What to expect?
🕵️‍♂️ One in three talks covers recent APT TTPs and investigations. We expect four mind-blowing talks on 🚘 and telematics infrastructure and at least a couple on important topics like browser security and the realities of using EOL devices.
Expect a swirl of topics and slides in our favorite PechaKucha format too!

⚡️ So, bookmark this link and secure your spot before it's too late 👉 https://t.co/41ZlbIcJa1