Nam Anh

[Matthew @embee_research]

These two #malware configs came entirely from a local LLM setup with no internet access.

- GLM5.3-Flash (Tensorfold, EXL3)
- Pi harness
- Driving a windows 10 VM over MCP.

The heavy hitter today was DnSpy, vibe modded to have a headless mode + debugger over MCP.

[Nicolas Krassas @Dinosn]

Kubernetes Penetration Testing: Guide, Tools & Best Practices https://t.co/Dl8PrF1tzf

[수뢰스트뢰밍 @ilovellovelove]

Ts 말포이의 가슴이 커야되냐 작아야 되냐는 크게 중요하지 않음

제일 중요한 공식은

Ts 말포이의 가슴은 헤르미온느와 반비례 해야 한다는거임

거유 말포이는 헤르미온느 보고 잡종 답게 빈약한 가슴이구나 라고 매도하고

빈유 말포이는 헤르미온느에게 천박한 가슴이라고 매도해야 함

[clibm079 @clibm079]

APT Encyclopedia
Threat Intelligence Database

https://t.co/ntvsAEhCEe

[The Haag™ @M_haggis]

If you are a threat hunter or Detection engineer -
Baseline your wscript usage. The numbers will be staggering and then take it up the chain to get wscript, mshta, cscript blocked globally.

“ … it copies a size-matching cache entry to %LOCALAPPDATA%\Temp\t.vbs, giving the cached payload a VBScript extension, then executes it with wscript.exe. “

The more we continue to allow the basics to execute, the longer clickfix continues.

Good luck out there friends. ⚔️

[安坂星海 Azaka || VTuber @AzakaSekai_]

I was informed of this specific ClickFix command being spotted in the wild yesterday, and was scratching my head trying to figure out what the hell it's doing

This is an incredibly weird, fragile but creative technique

[Florian Roth ⚡️ @cyb3rops]

We examined artifacts left behind by attackers during the recent Citrix #NetScaler compromises. Many were already covered by existing generic THOR rules, including rules we've shipped for years.

One script matched SUSP_Linux_Downloader_Jul20_1. That rule dates back to 2020, more than six years ago(!). The script also matched SUSP_Bash_Jul26.

The recovered webshells matched these existing generic rules:

- SUSP_WEBSHELL_PHP_Encoded_Jun21_1
- SUSP_Eval_Base64_Indicators_Feb22_1
- EXT_WEBSHELL_PHP_Generic_Eval
- EXT_WEBSHELL_PHP_OBFUSC_3
- EXT_WEBSHELL_PHP_Generic
- EXT_WEBSHELL_PHP_Gzinflated
- EXT_WEBSHELL_PHP_Dynamic_Big

Some of those webshell rules are in THOR Lite, too (EXT_*)

This is POST-EXPLOITATION DETECTION. We didn't need to know which zero-day got the attacker in to recognize what they left behind.

A scan could have flagged these artifacts from day one, before the exploited vulnerabilities were public. The rules were already there.
Scan your edge devices regularly. Daily, where practical. Use THOR via SSHFS or scheduled file collection for THOR Thunderstorm.

Don't wait for the next advisory to start looking

Why THOR detects what others miss
https://t.co/EbtVt3al8E

[Vivek Galatage @vivekgalatage]

Let's Learn x86-64 Assembly: a hands-on series

https://t.co/R2SxhFS5h1

[コウイ @koui0621]

Mela Alarm (CUTE)

[༺ཧคlคฝคཊ༻ @rybinfx]

Web crawlers /[•]\ #js x #css

[Ortaign @ortaign]

🗿:Kaela, do you have any summer memories?
🔨: I- *laughs* I talked about mine yesterday
🗿:You HAVE to tell me yours
🔨:My summer memories is about Kronii...

It so funny how on the very next day Biboo did the SAME exact thing that Raora did
#LIVEseki #kaelaif

[Duncan Ogilvie 🍍 @mrexodia]

Took around 1h to solve all of the challenges with this.... 🤯

[Hex-Rays SA @HexRaysSA]

The official IDA MCP Server is here. It's free, open source, and works with any LLM.

Your agent writes IDAPython, uses ~20% fewer tokens, and can share an IDB with you in real time.

𝚞𝚟𝚡 𝚒𝚍𝚊-𝚑𝚌𝚕𝚒 𝚖𝚌𝚙 𝚒𝚗𝚜𝚝𝚊𝚕𝚕

https://t.co/jXPiF6Wyvk
(copy-paste: uvx ida-hcli mcp install)

[cr3ghost @cr3ghost]

If you're learning exploit development, bookmark this.

A FREE collection of hands-on exploit development tutorials covering:

Linux + Windows buffer overflows
ROP + defeating DEP
ASLR + Windows mitigations
Heap overflows
Format string vulnerabilities
Race conditions
SEH exploitation
x64 assembly
ARM shellcode
iPhone exploitation

Created by @sambowne with @djhardb, @KaitlynGuru and @infosecirvin.

Start here: https://t.co/dpFck4hnwz

Excellent free resource for anyone getting into exploit development, binary exploitation and reverse engineering.

#ExploitDevelopment #ReverseEngineering #Infosec

[はるたろう @aiharu4k]

これ妻にやったらめっちゃ喜んでもらえた
めっちゃ楽になったって
妻を喜ばせたい紳士なみなさまにおすすめです

[Smukx.E @5mukx]

Recurse: Agentic reverse engineering environment with Ghidra-class desktop app. Built with Tauri 2 on top of an existing RE toolchain: radare2 does all parsing, analysis, disassembly, xrefs, strings and imports; r2ghidra (optional) provides decompilation.

Github:- https://t.co/nyk5FmEx0i

[Brut 🇮🇳 @wtf_yodhha]

Penetration-List

https://t.co/ZHCFxzEzho

#cybersecurity #infosec #pentesting #redteam #bugbounty

[Blackstorm Security @blackstormsecbr]

Static Analysis of a Multi-Stage Cobalt Strike Loader:

https://t.co/qdtqYPJ4Bu

#malware #cybersecurity #infosec #informationsecurity #malwareanalysis

[Co11ateral @co11ateral]

Digital Forensics - Memory Analysis Guide, Part 1

We made a guide showing how to use Volatility 2 and 3 for different tasks.

Handy cheat sheet

https://t.co/urogtnhWlr

[Koseki Bijou🗿hololive @kosekibijou]

Thank you for participating in our pre=alpha test.
Maintinence has now begun.
We look forward to hearing your feedback! #bibooSSR