Kok Koon

Log Analysis, Threat Intelligence and Incident Response

[Nitin Gavhane @NitinGavhane_]

Cybersecurity X accounts worth following (Part 2):

1. @SwiftOnSecurity — Windows security
2. @briankrebs — Cybercrime research
3. @troyhunt — Breaches & HIBP
4. @thegrugq — OPSEC & tradecraft
5. @cyb3rops — Detection engineering
6. @mikko — Malware research
7. @_JohnHammond — CTFs & malware
8. @NahamSec — Bug bounty & recon
9. @LiveOverflow — Technical hacking
10. @HackingDave — Red teaming
11. @harmj0y — Active Directory
12. @_wald0 — BloodHound & AD
13. @enigma0x3 — Windows security
14. @gentilkiwi — Mimikatz & Windows
15. @_RastaMouse — Red team tools
16. @SpecterOps — AD security
17. @TrustedSec — Red team research
18. @BishopFox — Offensive security
19. @Horizon3Attack — Exploit research
20. @Synacktiv — Offensive research
21. @TheDFIRReport — Incident reports
22. @sans_isc — Threat intelligence
23. @HuntressLabs — Threat research
24. @13CubedDFIR — DFIR training
25. @EricRZimmerman — DFIR tools
26. @Velocidex — Digital forensics
27. @SigmaHQ — Detection rules
28. @hakluke — Bug bounty tools
29. @codingo_ — Pentesting & recon
30. @EdOverflow — Security research
31. @filedescriptor — Bug hunting
32. @orange_8361 — Exploit research
33. @InsiderPhD — Security education
34. @pentest_swissky — Payloads & pentesting
35. @Hacker0x01 — Bug bounty
36. @bugcrowd — Bug bounty programs
37. @intigriti — Bug bounty programs
38. @GossiTheDog — Vulnerability analysis
39. @malwrhunterteam — Malware hunting
40. @hasherezade — Malware analysis
41. @taviso — Vulnerability research
42. @IntelTechniques — OSINT
43. @CISAgov — Security advisories
44. @MITREattack — ATT&CK framework
45. @BlackHatEvents — Security research & conferences

Save this list. Build your cybersecurity feed with signal, not noise.

#CyberSecurity #BugBounty #EthicalHacking #InfoSec #Pentesting #RedTeam #BlueTeam #DFIR #OSINT #ThreatIntel

[METR @METR_Evals]

METR & Redwood Research investigated agent behavior in the Hugging Face incident. We found agents developed a universal cheat for ExploitGym within 4 hours, then coordinated multi-day R&D efforts to trick the scorer into accepting cheats, including trying to tamper with logs.

[Trail of Bits @trailofbits]

We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times.

In its final escape, the agent found three 0-days on its own and chained them into a working exploit. https://t.co/3JRVWgPxHx

[pilvar (Philippe Dourassov) @pilvar222]

We found a way to find more vulnerabilities than Mythos (Claude Security) without burning $10k worth of tokens

TLDR: it's much better to use many agents with small models than to use a few agents with big models

Full blog post on how we did it: https://t.co/8xvHVQwMGD

[The Monday Brief @TheMondayBrief]

Attackers didn’t bypass defenses this week.
They used them.

Defender zero-days. MCP flaws. Obsidian plugin abuse.

Same pattern:
👉 Weaponizing trusted tools

🔴 Think Red: Inherit trust
🔵 Act Blue: Monitor your controls

Read the latest issue by @aboutsecurity and @fulmetalpackets:
🔗https://t.co/fNAVXYkpaj

#Cybersecurity #ThreatIntel

[Anthropic @AnthropicAI]

Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software.

It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.
https://t.co/NQ7IfEtYk7

[Joe Desimone @dez_]

We open sourced the tool used to detect the Axios supply chain compromise! I built it Friday after a red eye home from RSAC. Also, wrote up the full story, including the hectic moments after that first critical alert
https://t.co/HAm8eMr8vO

[Lenny Zeltser @lennyzeltser]

My guide for endpoint security startups is out now.

The path between competing against entrenched platforms and becoming a feature they bundle is narrow. The guide walks through the questions that founders, buyers, and investors should answer to tell the difference.

I got to know this space when leading product at Minerva Labs (now part of Rapid7), but much has changed since then.

https://t.co/ayRObxYtJR

[Tib3rius @0xTib3rius]

Huntress tracked a threat actor who installed their Managed EDR product, sparking debate online over triage limitations and user privacy. I sat down with @_JohnHammond to separate fact from misunderstanding.

Watch the full video at the link below!

[CryptoCat @_CryptoCat]

Shout-out to @ZeroDaysCTF who just open-sourced all their challenges from the 2025 CTF, along with solutions! 🔥

https://t.co/g7yLVyyv7n

[Florian Roth ⚡️ @cyb3rops]

IngressNightmare: 9.8 Critical Unauthenticated Remote Code Execution Vulnerabilities in Ingress NGINX by @wiz_io

this is bad

https://t.co/vdOC6VVt1L

[Naomi Brockwell priv/acc @naomibrockwell]

https://t.co/vpuZmTx43g

[Wiz @wiz_io]

Atomic #IOCs in Cloud Security ⚛️
Threat detection in the cloud requires new types of indicators of compromise sourced from threat intelligence.

Check out our new blog series from @amitaico and @merav_br to learn more. https://t.co/52xCthNWi8

[Wiz @wiz_io]

BOOM!💥 WIZ CODE IS HERE 🧑‍💻

After months of collaboration with hundreds of customers, our HUGE launch today extends cloud security from the first line of code to runtime... And it's a game-changer

Ready to see it in action? 🥳https://t.co/5KDA9ZAHPn

[Dr. Anton Chuvakin @anton_chuvakin]

"Where do Detections come from?" https://t.co/8h3i7mau5Y is a very fun read! (self-serving addition: it goes well with this one: https://t.co/uwTRtTTs33)

[Kok Koon @nkokkoon]

@clintgibler @hugow_vincent Thanks for sharing. This should be correct Url to the article - https://t.co/qtEAfgMu5a

[The Haag™ @M_haggis]

🚨 New Splunk Threat Research Blog🔍

Uncover the critical 'regreSSHion' vulnerability (CVE-2024-6387) in OpenSSH with Splunk! 🐧💻

Our latest blog:
🔬 Dissects technical details
💥 Explains exploit mechanics
🛡️ Provides crucial detection strategies
🔒 Offers key mitigation tips

https://t.co/Zsc5Xnzoeq

[Florian Tramèr @florian_tramer]

Some thoughts by Nicholas Carlini and me about Glaze, and how the actions of it's developers might not be in the best interest for the security of their user base: https://t.co/6GyMEKhOrb

[Jared Atkinson @jaredcatkinson]

My On Detection series is back! In this edition I explore how the same behavior (operation chain) can be implemented using several different execution modalities and the implications of this for detection engineers.
https://t.co/cel9gnwSA8