Holger Unterbrink

Researcher at Talos. No infosec drama, no opinions, no politics, Tech and Tools only. Author of Dyn. Data Resolver (Winner of Hex-Rays Plugin Contest 2020).

[cr3ghost @cr3ghost]

This is the type of malware game hackers build to bypass kernel anti-cheat. The same techniques can be used by malware authors to evade EDRs.

A UEFI bootkit that injects into Microsoft's own Hyper-V at ring -1 before the OS even loads (easier than building a custom hypervisor from scratch).

Four phase bootloader. Hypervisor VM-exit interception. EPT page shadowing. MSR virtualization. EFI memory map ghosting. TPM measurement spoofing.

Reads like malware. Because it is. Videos and full technical breakdown in the link.

Author: https://t.co/iHtxyJSbwy

#ReverseEngineering #Malware #AntiCheat

[Back Engineering Labs @BackEngineerLab]

Static Devirtualization of Themida/CodeVirtualizer. The techniques in this article apply to pretty much every virtual machine obfuscator with minor modifications.

https://t.co/RMvPKcv3KB

Original Program & Devirtualized Output

https://t.co/R8hLk9ISRZ

[Alex Albert @alexalbert__]

With the help of Claude Mythos Preview, the Firefox team fixed more security bugs in April than in the past 15 months combined.

[Holger Unterbrink @hunterbr72]

I am very happy that @reconmtl accepted my talk about real world EDR killer. Looking forward to see you guys in Montréal 😁

https://t.co/7NFTSKVEPQ

[REcon @reconmtl]

We have started announcing Recon 2026 Presentations https://t.co/HwPY5z16lV
More talks to be announced soon once we have confirmations @frodosobon @realytcracker @allthingsida @hexnomad @0x464D @hunterbr72 @joegrand @clearbluejar @InvokeReversing @LennertWo @pinkflawd @Coiffeur0x90 @MathildeVenault @NicoleFishi19 @nicolodev @phLaul @SinSinology @i0n1c @mr_phrazer @tmanning @hex86_64
#REcon2026 #ReverseEngineering #InfoSec #cybersecurity

[ς๏гєɭคภς0๔3г ([email protected]) @corelanc0d3r]

New Post: Debugging - WinDBG(X) Automation & Scripting - Part 1 https://t.co/4E19TTdDQJ

[Gossip Goblin @Gossip_Goblin]

https://t.co/FBCPqrUEfE

[Chi-en (Ashley) Shen (@ashl3y-shen.bsky.social) @ashl3y_shen]

1/♟️Just published new research on LucidRook, a Lua-based malware framework observed in spearphishing campaigns targeting Taiwan. LucidRook uses Rust libraries and an embedded Lua interpreter to execute payloads downloaded from FTP servers.
https://t.co/yD6Gm2eM3d @TalosSecurity

[yed @frdfzi]

I added a simple hex viewer for IDA in the PseudoNote plugin. It supports highlighting byte ranges, copying selected bytes as hex, Shift + Click to extend selection, cursor sync with the current instruction, and jumping to addresses.

https://t.co/SnfDO6DvtI

[Holger Unterbrink @hunterbr72]

I would say blindfolded and killed ;)

[Holger Unterbrink @hunterbr72]

If you are interested in how EDRs are bypassed in real world malware:
https://t.co/qEskJ4OPb3

[Josh Stroschein | The Cyber Yeti @jstrosch]

🔥 Ready to chat about IDA productivity tools?! @allthingsida joins the stream Thursday April 9th to do just that:

- QScripts
- idacpp
- eject_idb
- idasql
- windbg_agent

Join us on YouTube -> https://t.co/suudQSvtyQ

[Marc R @Seifreed]

Updated my #bindiff fork to support building against IDA Pro 9.3 / IDA SDK 9.x, including Qt6-era plugin fixes
@Google

https://t.co/bKDTFQlcTW

[allthingsida @allthingsida]

In the next version of idacpp, you can ".connect <host:port>" to a foreign process and directly issue remote c++ commands (or run full c++ files) in the context of the debugged program (Appcall on steroids).

[allthingsida @allthingsida]

Ok, now you can use C++ scripts in IDA (in the snippet window, the cli box and as script files). You need to build from source.

https://t.co/vcTntMUO19

[Tim Blazytko @mr_phrazer]

Agentic reverse engineering can do a lot, but obfuscation still breaks many analysis workflows in malware and commercial software.

If you want to learn how to build and steer automation for analyzing protected code, check out my training at @reconmtl:

https://t.co/IJzaZPH2oe

[Tim Blazytko @mr_phrazer]

New blog post: Building a Pipeline for Agentic Malware Analysis

Agentic RE + malware analysis with custom skills, MCP tooling, and persistent case state to automate intial triage

Link: https://t.co/Itj9S3rA9q

Github: https://t.co/kfvjN7ot4d

[Tim Blazytko @mr_phrazer]

Happy to bring my Software Deobfuscation Techniques training back to @reconmtl - June 15–18, 2026 in Montreal!

Learn systematic approaches to defeating modern obfuscation found in DRM/anti-tamper & APT malware.

https://t.co/IJzaZPGuyG

[Tim Blazytko @mr_phrazer]

Recently my RE workflow moved into sandboxed VMs where agents have full control over the environment. I needed an MCP server that runs headless in the same sandbox and exposes way more of the #BinaryNinja API than others.

Here's the release: https://t.co/HU2Vf8Uj6T

[Holger Unterbrink @hunterbr72]

Guess some infosec people will reimage their PC today

https://t.co/vAAfP11Nnk