Krish

#ReverseEngineer #TI #Incident Response #Phishing #Malware Analysis

[Ryan Wright @IQReactorAI]

A 7-person team just took 3 small open-source models to #1 in cybersecurity at their size classes.

They used Qwen3.8-27B, Qwen3.6-35B-A3B, and Qwen3.5-122B-A10B. All three ranked #1 among open models at comparable sizes.

TL:DR:

First they let agents work through controlled exploit / cyber environments, verified the results, then fine-tuned on that data.

Here is what they did:

They built coding, vulnerability, CTF, Linux-kernel-history, full-exploit, firmware, and device-backed environments.

Kept what worked: models learned from runs that passed execution verification / auditing.

Using pure fine-tuning (no RL), their three models improved an average of +23.76% on the full CyberGym suite. Feyospace-s1 hit 63.24% verified success and #10 on CyberGym

Paper: https://t.co/MJ8Bcm6arW

[INFINITE NIGHTMARE @MSNightmare2000]

Microsoft has failed to properly patch ShieldBreak CVE-2026-69414 - https://t.co/dsbfA9dHtE
ShieldCrash demonstrates a full bypass of the patch - https://t.co/nrGgk52947
Works with latest September 2026 patch

[Nicolas Krassas @Dinosn]

N-able patches max severity N-central flaw amid ongoing attacks https://t.co/cl86zaMoSk

[cr3ghost @cr3ghost]

Windows kernel 0-day.
Ring 0 rootkit.
EDR visibility disruption.
Post-quantum crypto.
Lazarus.

This attack chain is ridiculous.

CVE-2026-68820 is an actively exploited use-after-free in Windows AFD.sys that Lazarus used to jump from a local foothold to SYSTEM and deploy FudModule v3.1 against defense and aerospace targets.

And it gets better:

• Windows kernel exploitation
• FudModule rootkit
• ML-KEM post-quantum key exchange
• DLL sideloading
• In-memory malware
• Microsoft Graph + OneDrive C2
• Hijacked infrastructure
• Security telemetry disruption

Exploit devs and reverse engineers: study the kernel path.

Malware analysts: study the implant chain.

Red teamers: study the tradecraft.

Blue teams + detection engineers: figure out what telemetry is still trustworthy after the attacker reaches Ring 0.

Threat intel: this is Lazarus operationalizing serious Windows kernel research in the wild.

Fresh technical deep dive:
https://t.co/PtDT7FHksI

#0day #WindowsKernel #MalwareAnalysis #ThreatIntel

[0xor0ne @0xor0ne]

Series on Android SELinux internals (@8kSec)

Part 1: https://t.co/r8RhF2WIhE
Part 2: https://t.co/57bpqR5IgM
Part 3: https://t.co/SOOqLt0Xdq
Part 4: https://t.co/7DcJeMuol5

#infosec

[Igor Kozlov @iekozlov]

Amazing work by the NVIDIA-CrowdStrike team.

In a nutshell, it's a proof of concept demonstrating a closed-loop detection-engineering agent pipeline tuned in a purple-team agentic exercise.

What it does:

- It deploys a red-team agent with the goal of executing an attack from a selected scenario family.
- It records EDR telemetry and the ground-truth attack trace, then passes them to a blue-team agent to generate detection rules.
- It runs each candidate through a validation loop that addresses common LLM failure modes (hallucinated syntax, invalid queries, environment-specific indicators, rules that fail against recorded telemetry, detections that lack behavioral grounding).
- It tests generalization by running new, independently seeded attacks from the same preselected scenario family.

The results are promising: the optimized open-model pipeline - including Nemotron orchestration and a post-trained detection-writing model - produced detections that generalized more reliably to new attacks from the same preselected family.

What does this mean?

- The authors correctly warn that this does not prove cross-scenario generalization. It is a "directional system-level case study, not a general benchmark".
- It shows how a purple-team agentic exercise in a lab can provide provide enough data for detection pipeline tuning. Scaling this kind of data generation remains an important challenge, which reinforces a design choice behind our Cyber Defense Benchmark RL gym: combining synthetic scenario generation with real attack telemetry recorded in emulated environments to scale post-training while retaining grounded signals.
- More broadly, it supports the idea that small, specialized models can be trained for bounded cybersecurity tasks. Cisco Antares demonstrates a related pattern for vulnerability localization - although vulnerability localization (cyber offense) and detection engineering (cyber defense) are distinct capabilities and require different evaluations. This distinction is visible when comparing model performance on the offensive CyberGym (vulnerability finding) and the defensive Cyber Defense Benchmark (threat hunting).

Congratulations again to the team and @Cyb3rWard0g on a meaningful step toward adaptive cyber-defense agents.

Cyber Defense Benchmark:
https://t.co/n06rjUjcY5

Cisco Antares:
https://t.co/h4IsP5PIxi

NVIDIA original source:
https://t.co/nZlAB4cABW

[INFINITE NIGHTMARE @MSNightmare2000]

FalconFlank : Crowdstrike Falcon 0day LPE is now public
https://t.co/J0oBnyVkH5

[苏乐 @ai_suxiaole]

Android 逆向最折腾的不是反编译

是反编译完以后

还得自己从一堆混淆代码里找接口

这个 android-reverse-engineering-skill 可以直接交给 Claude Code 做

把 APK，XAPK，JAR，AAR 丢进去

它会自动反编译，再把 Retrofit，OkHttp，Ktor，GraphQL 这些网络请求找出来

接口地址，认证方式，请求签名这些也能一起整理

碰到 R8 混淆

还能从 Kotlin metadata 里恢复一部分原始类名

继续顺着 Activity，ViewModel，Repository 往下追到真正的网络请求

平时做安全研究，协议分析

或者想快速看懂一个 Android App 怎么请求接口的

这个 Skill 可以装上

GitHub：https://t.co/9oWiDtywAv

[blackorbird @blackorbird]

A lightweight (~12 KB) custom Windows backdoor, nicknamed “KB-Backdoor,” was discovered masquerading as a legitimate Realtek audio component.

It achieves persistence through a scheduled WMI event that runs once a day and hides its command-and-control domain inside ordinary whitespace characters of a desktop.ini file.

The implant beacons via ICMP and HTTP, supports basic remote command execution and file drop, and was observed remaining active long after its C2 domain had expired.

The most notable aspect is the unconventional, low-profile method used to store the C2 address, making both static analysis and casual inspection ineffective.

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: Security researchers have uncovered all of those who fell victim to the LiteLLM supply chain attack by obtaining its archive: 153GB holding 433,909 files from 2,488 organisations.

According to Hudson Rock and CloudSEK, victims include Nvidia, AWS, Samsung, Boeing, Intel and more.

This is one of the biggest hits by TeamPCP yet.

The archive contains 118,829 CI/CD runner dumps attributed to corporate domains, with signing secrets and AI provider API keys sitting in plaintext.

If you ran LiteLLM 1.82.7 or 1.82.8, assume every secret in that environment is burned.

[0x0さん @LxlxIxlxlxL]

Windows kernel pool internals are a goldmine for vulnerability researchers.

Large pool allocations have page-aligned addresses and can land adjacent in memory, a powerful primitive when combined with an off-by-one.

A great CTF/write-up on exploiting a Windows 10 paged-pool off-by-one:

https://t.co/ukSDen38pW

[0x12 Dark Development @Salsa12__]

AMSI Write Raid, a perfect alternative to classic AMSI patching

- Resolve the remote AmsiScanBuffer address
- Allocate and write a return stub
- Locate SMA.dll
- Enumerate writable PE sections
- Scan for a pointer to AmsiScanBuffer
- Overwrite the pointer with the stub address

[Smukx.E @5mukx]

In this research, I turn Chrome Remote Desktop into a complete red team scenario that can be used for monitoring and even leads to spying.. I explain different use cases how to make it possible and operate without triggering security solutions..

Link :- https://t.co/6ZeFjVAUVF

[Nick Carr @ItsReallyNick]

Russian threat actor Midnight Blizzard is conducting widespread traffic manipulation attacks at hotels worldwide. Result: delivering malware or redirecting auth flows at their discretion, globally.

Since early May 2026, we saw this subcluster manipulate DNS and HTTP traffic from networks served by captive portals to redirect user traffic through actor-controlled infrastructure. We’re calling the campaign CaptiveCrunch.
“We have observed notable commonalities in the equipment and management systems used across multiple affected networks.”

We break down the malware & techniques, but the most important part is how dynamic all of it is: Midnight Blizzard is using AI to support a significant portion of these operations. They are moving and changing quickly.

Feedback welcome on the suggested mitigations: https://t.co/cVGbdQEpXQ
Help spread the word to VIPs in governments, diplomatic entities, non-governmental organizations (NGOs) in the US and Europe (probably also those traveling to Black Hat)

[Mike Felch (Stay Ready) @ustayready]

Insane teardown of CrowdStrike Falcon. Full reverse of the sensor.. kernel callbacks, WFP, minifilter, detection engine.. with blind spots ☠️ 🔥 https://t.co/RzlNjEWPKO

[cr3ghost @cr3ghost]

Every malware analyst and reverse engineer has used x64dbg. Most have no idea what else the creator has been building.

RiscY Business breaks down the practical engineering of building a low-footprint RISC-V virtual machine interpreter for code obfuscation. If you have ever sat in front of a VM-protected sample wondering how the obfuscator was designed, this is the post that answers it. Understanding how these VMs are built is how you learn to tear them apart. Red teamers and implant developers have already been adopting this approach to protect payloads from static analysis, so expect to see more of it in the wild.

Striga lifts x86 to LLVM IR with Python for binary deobfuscation, the same approach used to analyze obfuscation like LummaC2. Bootkitting Windows Sandbox covers UEFI bootkit internals.

TitanHide bypasses anti-debug protections including VMProtect 3.9.4. Dumpulator emulates memory dumps for malware config extraction and unpacking without executing the sample.

He teaches two courses. LLVM IR and Binary Lifting for malware analysts and reverse engineers who need to deobfuscate protected binaries. Payload Obfuscation for Red Teams covering VM-based payload protection, compiling C payloads to RISC-V shellcode, opcode shuffling, instruction encryption, interpreter hardening, and C2 integration.

The attack and the defense. From the same person.

Started reversing in 2009. 100+ open source projects. All free.

https://t.co/eik5o7JF88
https://t.co/dxU1uvAGXv
https://t.co/IhZE9QJWPr
YouTube: https://t.co/124tFru7I7
Blog: https://t.co/0gO1pV7TuH
GitHub: https://t.co/HJV3aU0NbH

Author: @mrexodia

#ReverseEngineering #MalwareAnalysis #InfoSec

[Moshe Siman Tov Bustan @MosheTov]

🚨 NPM Malware-slop Alert!🚨

We detected and reported a malware-slop package to npm - the malware uses it's OWN PRIVATE GitHub token, which is EMBEDDED INSIDE the malware itself - to read sensitive information and upload it to the threat actor's GitHub repository.

The malware is still live on npm - https://t.co/uH8mU1a4dw

The threat actor's GitHub page was opened 5h ago -
https://t.co/WhqZ6BaLRM

Detailed report will be published tomorrow.

[Moshe Siman Tov Bustan @MosheTov]

We identified a new DPRK North Korea linked malware in npm - terminal-logger-utils.

The username that uploaded the malware has uploaded a similarly named terminal-logger npm package last month which was classified as a DPRK malware.

The malware downloads a 2nd stage payload according to the current OS, which contains a Node packaged executable with JavaScript code inside, which contains a full RAT behaviour, information stealing logic, targeting crypto, cloud, environment variables, SSH keys and anything it can get its hands on.

The malware has also 3 dependant packages that import it which causes direct execution on the machine.
- pretty-logger-utils
- ts-logger-pack
- pinno-loggers

Read the full research:
https://t.co/92NronLKYf

[Moshe Siman Tov Bustan @MosheTov]

TeamPCP: Attack of the Clones

We detected the first ever out in the wild Shai-Hulud clone copying from the TeamPCP leaked source code last week.

The Shai-Hulud variant is a part of a family of 4 different malwares by the same actor, including credential stealing logic, and also exfiltration of personal information (IP, Location, Hostname) AND a DDoS botnet server designed to attack servers directly from the victim's machine!

The malwares are still live on npm, targeting developers via typo-squatting and Axios impersonation.

For more details, and a full technical breakdown of all the four malicious packages:
https://t.co/Ske6Bnynh7