He5ung

S2W Threat Analysis Team, Malware Analyst & Threat Intelligence Researcher, Cybercrime & Ransomware Group Tracking

[Thomas Roccia 🤘 @fr0gger_]

🤓 @GoogleDeepMind just released an AI Control Roadmap!

As part of the paper they created TRAIT&R (Taxonomy of Rogue AI Tactics and Routines)

It is a MITRE ATT&CK but for AI agents.

[Lenny Zeltser @lennyzeltser]

The REMnux MCP server can now draft malware analysis reports using my new report template:

https://t.co/kKcs6FolUl

[eversinc33 🤍🔪 @eversinc33]

Spent the last 2 weeks working on a devirtualizer for VMProtect 3.5 and learning Remill. Idk yet if I will blog about it, but I at least wanted to publish the code:

https://t.co/GLqKWpOOU7

The approach is different from my last blog, as it lifts the whole x86 code of the VM

[cr3ghost @cr3ghost]

Themida turns a few lines of code into thousands of VM handler instructions. Completely unreadable.

back engineering built a static devirtualizer that lifts it all to IR, resolves the control flow, and recovers the original logic.

The before/after in the repo is genuinely shocking.

Works on pretty much any VM obfuscator, not just Themida.

Blog: https://t.co/fY4YkY2aH3
Devirt output: https://t.co/p2gkKi1vXp

Author: @BackEngineerLab

#ReverseEngineering #InfoSec #Malware

[0xMarioNawfal @RoundtableSpace]

Great Resource to Learn Harness Engineering

https://t.co/JXR8k4FFUD

[eversinc33 🤍🔪 @eversinc33]

When practicing on a VM crackme recently, I created a devirtualizer which lifts the virtual machine to LLVM to defeat the protection. LLVM-based devirtualisation is a lot of fun and I wrote down my experience and lessons learned on my blog:

https://t.co/LiWNIj31uK

[Jiří Vinopal @vinopaljiri]

Let's Zoom-In to the new start of the week... 🔍
Releasing #IDA Plugin #ZoomAllViews — Ctrl+Scroll font zoom for every IDA view. 💪
Because this should work out of the box. Now it does. 🤓

• Zoom in/out in Disassembly, Pseudocode, Hex View, Strings, Imports, Functions, Structures, and every chooser 😲
• Works across Normal & Debug view widgets — Stack, Registers, Locals, Watch
• Row heights scale automatically with font size
• Graph/Proximity/Xref views excluded — IDA's native zoom untouched ☝️
• Toggle on/off via menu or Ctrl-Shift-Z
• Single file, zero dependencies 🫰
• Compatible IDA 8.x — 9.3+ (PyQt5 / PySide6) 🛠️

https://t.co/9ZGAhvqi2s

#IDAPro #ReverseEngineering #IDAPython #Malware #DFIR @HexRaysSA

[Thomas Roccia 🤘 @fr0gger_]

And I published my threat actor profiling skill in the repo we maintain with @Kostastsale 👇

https://t.co/dPs4HkA3OL

[Moritz @m_r_tz]

The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at https://t.co/bGCIjBfD3C. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD

[Tim Blazytko @mr_phrazer]

New blog post: Building a Pipeline for Agentic Malware Analysis

Agentic RE + malware analysis with custom skills, MCP tooling, and persistent case state to automate intial triage

Link: https://t.co/Itj9S3rA9q

Github: https://t.co/kfvjN7ot4d

[GitHub Projects Community @GithubProjects]

Developers are starting to run multiple AI models together instead of relying on just one.

ccg-workflow sets up a multi-model coding workflow where
Claude Code, Codex, and Gemini collaborate on development tasks.

It includes smart routing, Git tools, and 17+ commands for coding, review, and automation.

Let the models debate the code.

[Security Harvester @secharvesterx]

Agentic Reverse Engineering + Binary Analysis with Kong
https://t.co/8ozvCp16uA

[Jiří Vinopal @vinopaljiri]

#IDA Pro tip 🤙
ApplyCalleeTypeEx — ApplyCalleeType is Reborn 🔥
— — —
IMO one of the most practically useful IDA plugins ever written. It died on IDA 9.x. Not anymore. Rebuilt from scratch — compatible IDA 8.x → 9.3+.
https://t.co/UVkcJw6D5m
— — —
What's new:
✅ IDA 9.3 ready + backward compat to 8.x — single file, zero deps
✅ Right-click menu in disasm and pseudocode view
✅ Cursor on call line, call expr "(" or variable v2 — all work
✅ Multi-line editor with live SAL/MSDN/ntdoc preprocessing
✅ Paste straight from MSDN or SDK headers — no cleanup needed
— — —
The original plugin was perfect at its job. It just needed a new life 🙏 Big shoutout to the @Mandiant #FLARE team for building something this useful in the first place — and to @HexRaysSA for the best disassembler/decompiler on the planet.
#ReverseEngineering #IDA #MalwareAnalysis #Reversing

[Paweł Huryn @PawelHuryn]

1,300+ stars on GitHub in 72 hours. 400+ in the last 4 hours. I didn’t expect this.

I built an open-source PM Skills Marketplace for Claude: 100+ skills and commands that turn AI into a product management partner.

Not generic prompts. Structured skills that actually know PM frameworks.

8 plugins covering the full PM lifecycle:

→ Product Discovery: problem & solution space exploration

→ Product Strategy: vision, business model, strategy docs

→ Execution: PRDs, OKRs, roadmaps, sprint planning, user stories

→ Market Research: personas, segmentation, TAM/SAM/SOM

→ Data & Analytics: cohorts, A/B testing, retention analysis

→ Go-to-Market: GTM strategy, beachhead, ICP, growth loops

→ Marketing & Growth: positioning, North Star Metric

→ PM Toolkit: including PM resume review

Built for Claude Code and Cowork. Compatible with Gemini CLI, Cursor, Codex CLI, and Kiro.

If this helps you, ⭐ the repo!

[Ihtesham Ali @ihteshamali]

10 BEST Prompt Engineering Resources:

1. Anthropic Prompting Guide
https://t.co/DbypO3bDm5

2. OpenAI Prompting Guide
https://t.co/3Jv2kqZtO4

3. Prompt Engineering Guide (GitHub)
https://t.co/47brFkSoEz

4. Learn Prompting
https://t.co/r7AWzjZcAL

5. OpenAI Cookbook
https://t.co/2ibiQudYqW

6. Hugging Face Prompting Guide
https://t.co/rp2VEZAtlj

7. FlowGPT Prompt Library
https://t.co/9OvgbftKuZ

8. PromptBase Prompt Marketplace
https://t.co/K2u6I0YBDC

9. DeepLearningAI Prompt Engineering Course
https://t.co/VxiZEAYBIS

10. Stanford Prompt Engineering Lecture
https://t.co/WR2yf4sFMN

Prompt engineering isn't magic.

It's structured thinking.

Constraints + iteration + testing.

Study examples.
Break prompts.
Rebuild them better.

[SolidSnake @soolidsnakee]

HexRays released Cyberchef for ida 🥳 https://t.co/iu04w8uX63

Now I can ditch my 2 cent quick plugin lol, it did it's job; you can rest now https://t.co/p10D4zXjqf
Great work @williballenthin 🫡

[The Haag™ @M_haggis]

Security Detections MCP 3.0 is LIVE

What started as a detection search MCP is now an autonomous detection engineering pipeline.

Agents now run a full workflow:

CTI → coverage analysis → detection generation → SIEM validation → PR staging

Pipeline example:

• CTI Analyst → extracts MITRE techniques from threat intel
• Coverage Analyzer → checks 7k+ detections across Sigma / Splunk / KQL / Elastic
• Detection Engineer → generates missing detections
• Atomic Executor + SIEM Validator → tests detections
• PR Stager → prepares them for review

Multi-SIEM support:
Splunk • Sentinel • Elastic • Sigma

Open source 👇
Repo
https://t.co/hF5mrvTJkT

npm
https://t.co/ai3fqSmnri

Pulse MCP listing
https://t.co/gEy3m5aUP1

Watch the full demo:
https://t.co/xIIk9mhYmw

[Darius Houle (darbonzo) @dariushoule]

I added a shellcode analyzer to my x64dbg skills repo! It was awesome watching it unpack a multi-stage payload, annotate everything in the debugger, and produce a solid report.

chuck a bin at it - the skill knows how to load raw shellcode 🦾

https://t.co/lSzmPxDS9B

[Buzzer @buzz3r_]

I decided to try out agentic coding/reversing, so I’m releasing a project that assists with reverse engineering in both Binja and IDA Pro. It’s an agent, not an MCP, that support multiple providers, it has some interesting features such as code exploration
https://t.co/VCY5et5LYq

[yed @frdfzi]

@subhashdasyam I'll ping you in this reply if I have committed the "deep analyzer" update. For now, the initial version is ready at github https://t.co/2rHhdZq2ar