Bruno Philippe

Digital Forensic Analyst and Incident Responder. Opinions are my own.

[Muqsit 𝕏 @mqst_]

♾ Comprehensive Guide: Reverse Engineering Tutorials for Beginners

PDF: https://t.co/vbqCpQQNB6

Author: @mytechnotalent

[CISA Cyber @CISACyber]

🛡️ Akira ransomware is on the rise—primarily targeting small & medium sized orgs. Review our updated joint advisory with additional details on IOCs & TTPs & implement the recommended mitigations to help protect your data from this ongoing cyber threat. 🔗 https://t.co/TPF61FzbGL

[Grzegorz Tworek @0gtweet]

WHAT?! 😂
If you provide /FS:FILESYSTEM parameter to the format[.]com utility, the resulting process will try to load ("U"+FILESYSTEM).DLL using the default search path...
The weirdest custom DLL launcher I have meet so far :D

[Josh Stroschein | The Cyber Yeti @jstrosch]

🤹‍♂️ Let us not forget x64dbg - a must for any Windows reverse engineer, malware analyst or offensive security pro! In this video, we'll cover shellcode debugging basics 👇

https://t.co/ec3zBgRmpM

[Binni Shah @binitamshah]

Exploiting the Synology DiskStation DS1823xs+ to obtain remote code execution as root : https://t.co/TxaOG8XuoT

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

Autopsy of a Failed Stealer: StealC v2
When Your $3000 Malware Budget Goes to Marketing Instead of Actually Enabling the Encryption Function

I did some analysis on the updated #StealC v2. The blog comes with config extractor, hunting queries and Yara rule. Let me know your thoughts 💙

Link: https://t.co/y1slYfYhwF

Thank you @g0njxa , @iamaachum and @pancak3lullz for providing the valuable information. As well as @ValidinLLC, @censysio and @anyrun_app for providing their platforms for analysis and threat hunting ❤️🫶

[Alexandre Borges @ale_sp_brazil]

Although it is not my area of ​​work, this professional maintains a well-organized blog about building an EDR in Rust:

Theory: EDR Syscall hooking and Ghost Hunting, my approach to detection:

https://t.co/HcwEFeIOUw

#edr #cybersecuritty #redteam #blueteam #ir #dfir

[Bruno Philippe @BrunolPhilippe]

@RussianPanda9xx For static analysis it’s quite impressive.

We still have dynamic analysis with the debugging tools 🙂

Finally for now 🥲

[LaurieWired @lauriewired]

Just built an MCP for Ghidra.

Now basically any LLM (Claude, Gemini, local...) can Reverse Engineer malware for you. With the right prompting, it automates a *ton* of tedious tasks.

One-shot markups of entire binaries with just a click.

Open source, on Github now.

[Unit 42 @Unit42_Intel]

We have tested CVE-2025-24813. Under specific circumstances, an exploit sent to a vulnerable Apache web server running outdated Tomcat software could lead to remote code execution. We used a 2-step method that resulted in a successful attempt. Details at https://t.co/1ZWtac6sLh

[Mohit Mishra @chessMan786]

Understanding the .bss Segment in C Programming
In C programming, memory is divided into several segments, including the .text, .data, .bss, heap, and stack.

You can read this in more detail using the article attached below.

Thread🧵

[Binni Shah @binitamshah]

From arbitrary pointer dereference to arbitrary read/write in latest Windows 11 : https://t.co/CuZMqQA338

[Binni Shah @binitamshah]

MemProcFS-Analyzer : Automated Forensic Analysis of Windows Memory Dumps for DFIR : https://t.co/jHOqyxwFNs credits @Evild3ad79

[Will @BushidoToken]

🧵 My Key Takeaways from counter-ransomware activities in 2024 🔍

Read the blog for more details:
https://t.co/Fl9sQ3Rzu2
#cybercrime #ransomware #lockbit

[0xor0ne @0xor0ne]

Vulnerabilities analysis from patch diffing

https://t.co/mOMWazUL3Q

Credits @suidpit and @Th3Zer0

#embedded #cybersecurity

[ClamAV @clamav]

ClamAV 1.4 is now designated as our latest Long-Term Stable (LTS) release. Read the latest blog to learn more: https://t.co/6IOrFyOQZv

[Binni Shah @binitamshah]

Awesome Threat Detection and Hunting : https://t.co/afjyZWWkA9 credits @0x4D31

[Bruno Philippe @BrunolPhilippe]

@tazwake Quick question about your Sans FOR577 course. Do you know if there will be GIAC certification?

[Unit 42 @Unit42_Intel]

2024-04-15 (Monday): #ContactForms campaign pushing #SSLoad malware as early as Thursday, 2024-04-11. List of indicators available at https://t.co/MLr80TUH73

#Wirshark #Unit42ThreatIntel #TimelyThreatIntel #InfectionTraffic

[Paul Rascagnères @r00tbsd]

You can read the details of our investigation concerning the CVE-2024-3400 on our blog post: https://t.co/SoAq4SyYue. It covers the backdoor (UPSTYLE) and also the post exploitation. #PaloAlto 1/4