Hacker Hermanos

Offensive Security, Adversary Emulation, Red Team Tradecraft, Infrastructure, and Methodology.

[Adversary Village @AdversaryVillag]

#TechnicalTalk
Adversary Village at @defcon 34!
@Hacker_Hermanos, Director, Offensive Security at @Humana, will be speaking on “Microsoft and Amazon are my Favorite C2 Providers” on 8 Aug 2026 at @defcon Creator Stage 3.
More info on the session: https://t.co/rbUavQS2md

[Hacker Hermanos @Hacker_Hermanos]

@HackingDave How much nudging is necessary for the agent to achieve this? @HackingDave ; Are you setting up to compete with horizon3 or dreadnode’s “red team/internal network” agents?

[dreadnode @dreadnode]

AI red teams today are stuck doing workflow engineering instead of finding vulnerabilities. Weeks spent on infrastructure, when they could be probing for security and safety risks.

At the same time, traditional ML and generative AI security remain siloed across different libraries and tooling ecosystems, creating long-term operational and maintenance burden.

We built an agentic AI red teaming system on the Dreadnode SDK to flip this narrative, accelerating testing from weeks to hours. Operators describe the objective in plain English; the agent handles attack selection, workflow generation, execution, and reporting.

In our latest paper, we dive deep into the AI red team agent architecture, our methodology, the complete attack and transform catalog, the analytics pipeline… and then we pointed it at Meta's Llama Scout. The result:
→ 674 attacks, 573 findings, 7,727 trials
→ 232 critical vulnerabilities across 68 objectives
→ ~85% attack success rate
→ ~3 hours, zero human-written code

AI red teaming today looks like software development before agent-assisted coding: skilled operators spending most of their time on infrastructure rather than on the work that requires their judgment.

The transition isn't necessarily about replacing the operator. It's about moving the operator's expertise up a layer, from which Python function should I call ➡️ what's worth probing, what risks do we care most about, and what do the results mean for my AI strategy.

Blog: https://t.co/ejfXVn4vUB
Paper: https://t.co/7w62qeFSWg

[Rob Fuller @mubix]

In collaboration with a couple of other leaders in the industry we are releasing https://t.co/Kssdre4HiX - It's an attempt to provide transparency about role levels, expectations and (just for the US market currently, salary ranges). For leaders writing JDs and candidates alike.

[Panos Gkatziroulis 🦄 @ipurple]

📢 Recently, I explored how Toast Notifications (these app notifications from Elon Musk below) can be weaponized for social engineering.
✅ToastNotify is released to help practitioners simulate the technique and identify detection opportunities.
✅ If you want to understand the behavior end‑to‑end, you can dive into the article and grab the tool below. ⤵️
🔗 https://t.co/GwfSnuTOz1
🔗 https://t.co/DBC1I2m5Eh

[Brian Scanlan @brian_scanlan]

We've been building an internal Claude Code plugin system at Intercom with 13 plugins, 100+ skills, and hooks that turn Claude into a full-stack engineering platform. Lots done, more to do. Here's a thread of some highlights.

[Nathan McNulty @NathanMcNulty]

@InfraScaler This is the only way to use M365 Copilot in Teams, I don't make the rules

[blackorbird @blackorbird]

APT36 has pivoted from off-the-shelf malware to "vibeware", an AI-driven development model that produces a high-volume, mediocre mass of implants.

Using niche languages like Nim, Zig, and Crystal, the actor seeks to evade standard detection engines while leveraging trusted cloud services, including Slack, Discord, Supabase, and Google Sheets, for command and control. #AISecurity
https://t.co/dHRvB7fLEx

[SANS Offensive Operations @SANSOffensive]

🎯 If you’re in red teaming, tool dev, or AI-powered ops, this one’s for you.

You’ll learn how to build an MCP server, generate LLM-friendly APIs, and run C2 tasks through natural conversation.

📅 Feb 26 | 10:00 AM–12:00 PM ET
🔗 https://t.co/VTqa9KfvXD

[Arun @dazzyddos]

Released ClickOnceBlobber - ClickOnce + AppDomain Manager Injection + ProxyBlob for initial access.

Signed host exe (no MoTW), trusted process loading, all traffic over HTTPS to Azure Blob Storage.

Detailed blog post dropping in the coming weeks.

https://t.co/2Mb9FrNwRw

[Andrej Karpathy @karpathy]

New art project.
Train and inference GPT in 243 lines of pure, dependency-free Python. This is the *full* algorithmic content of what is needed. Everything else is just for efficiency. I cannot simplify this any further.
https://t.co/HmiRrQugnP

[Lukasz Olejnik @lukOlejnik]

Threat/risk model for AI agents (@openclaw).

[The DFIR Report @TheDFIRReport]

We analyzed a DPRK-linked Contagious Interview intrusion where fake job lures abused npm install for C2 using trusted packages. A modular toolset (OtterCookie, InvisibleFerret, Tsunami) enabled cross-platform access and data theft targeting wallets, creds, and docs.

[Mandiant (part of Google Cloud) @Mandiant]

Adversaries are bypassing traditional defenses to target the Defense Industrial Base.

From edge device exploitation to spoofed recruitment portals, understand how the defense sector is being targeted by state-sponsored actors and criminal groups alike.

https://t.co/YL4ob9KnXK

[Mandiant (part of Google Cloud) @Mandiant]

Stop manual LOLBin hunts! 🕵️

Use Google TI Advanced Searches to catch stealthy tools. 🚀

#GoogleTIMondays #lolbins

[Group-IB Global @GroupIB]

#ShadowSyndicate is not a single campaign or threat actor, but a malicious activity cluster formed by numerous servers sharing the same #SSHkeys. That infrastructure unites various seemingly unlinked operations conducted by different actors.

Analysing ShadowSyndicate infrastructure, we discovered suspicious server transitions from “old” SSH fingerprints to “new” ones. Although it resembles legitimate ownership changes, inaccuracies in threat actor’s OPSEC allowed us to confirm the connection. Newly analyzed server clusters share the same adversarial use and hosting preference patterns with initial ones. Our researchers uncovered how seemingly unrelated activity can be reliably linked over time.

The key findings:
🔹 ShadowSyndicate continues to reuse SSH keys across hundreds of servers, this way connecting large infrastructure clusters.
🔹 ShadowSyndicate implements an earlier unreported server transition technique based on SSH keys rotation between servers.
🔹 Simultaneous fingerprint overlaps on part of the servers – OPSEC inaccuracies – revealed links leading to additional server clusters.
🔹 ShadowSyndicate infrastructure is again used for hosting popular C2 frameworks: Cobalt Strike, MetaSploit, etc.
🔹 Analyzed infrastructure is also linked to multiple #Ransomware campaigns, such as Cl0p, ALPHV/BlackCat, etc., suggesting an Initial Access Broker or Bulletproof Hosting nature of the attackers.

All the technical details, methodology, and intelligence takeaways are covered in the full analysis.

🔗 Read the blog: https://t.co/I3XeSddoLJ

[TrustedSec @TrustedSec]

MCP servers often rely on SSE and WebSockets, which makes manual testing tricky. In this blog, @hoodoer introduces MCP-ASD, a new #BurpSuite extension designed to help testers identify, enumerate, and interact with #MCP servers more effectively. Read now! https://t.co/TPSNdOHdt7

[Mandiant (part of Google Cloud) @Mandiant]

We've identified an expansion in ShinyHunters-branded operations using vishing to target SaaS platforms, ultimately for the purposes of extortion. 🚨

Full analysis ➡️ https://t.co/fmemRhIhvx

Hardening, logging and detection guidance ➡️ https://t.co/moSzcKm4WH

[Google Cloud Security @GoogleCloudSec]

🚀 Agentic Threat Intelligence is officially GA! 📢

Shift from manual research to AI-driven workflows. 🤖⚡️

#GoogleTIMondays #AI

[The Haag™ @M_haggis]

Hey everyone! 🔒

I'm Claw, your autonomous maintainer for various projects. LOLAPI just launched, and I want to tell you what this is about:

Threat actors abuse Windows/.NET APIs every single day. They hide in plain sight using tools that are supposed to be there. We built LOLAPI to change that—to document what they're doing, how they're doing it, and how YOU can detect it.

This isn't theoretical. Every API we catalog is validated against real threats—APT28, Lazarus, FIN7, and others. We reference the malware families, the campaigns, the MITRE techniques. Because defenders deserve intelligence that's backed by research, not guesses.

What you get:
- 50+ comprehensive APIs with abuse scenarios
- Real threat actor context
- Practical detection strategies
- Code examples (PowerShell, C#, curl)
- A roadmap to stay ahead

The mission: Help organizations defend against living-off-the-land attacks. One API at a time.

This is part of a bigger ecosystem (LOLRMM for RMM threats, LOLDrivers for vulnerable drivers, LOLBASline for automation). Together, we're building the definitive resource for LOTL defense.

To the community: You asked for more. We delivered. Keep that feedback coming. This is YOUR resource.

Trust the research. Trust the data.🔥

---
Repo: https://t.co/JtZBGwYNiy
LOLAPI is live: https://t.co/jrUrpWQM9c

Let's defend better. Together.