omnitheon

[Renzon @r3nzsec]

@OpenAI just launched a new feature last night called Computer History. For DFIR analysts, this is a new artifact class worth knowing about. I turned it on on my MacBook, parsed the artifacts, and it produced about 3,616 timeline events from ~2 hours of normal work.

While Computer History is on, it logs input, app focus, and what was on screen, then stores it on the Mac. It keeps a timed record of what you clicked, typed, and opened, including chats in Slack, WhatsApp, Telegram, and other apps. That record stays on the Mac.

IRFlow-Timeline 1.0.10 now parses those Computer History artifacts and builds a timeline of the activity, so you can walk the investigation instead of grepping raw cache files. On a compromised Mac, this shows what was typed, clicked, and read. Not just that the app was installed.

#dfir #incidentresponse #openai #computerhistory

[Wes Roth @WesRoth]

Anthropic just published one of the clearest warnings yet about the coming multi-agent era: smarter individual agents do not automatically create smarter groups.

Its researchers tested swarms of Claude agents across software security, collaborative coding, markets, information-sharing, and conflicting objectives. The results show both the potential and the failure modes of letting large numbers of autonomous agents interact with each other.

In vulnerability discovery, coordination worked surprisingly well. Anthropic launched 45 agents across 15 open-source projects with a shared forum and an arbiter.

Using Mythos Preview, the coordinating swarm found 266 vulnerabilities using 27M tokens, versus 21 vulnerabilities from a simpler independent-agent setup using 6.5M tokens.

But when restricted to the same core directories, token efficiency was roughly comparable, the swarm's advantage came partly from specialization and exploring more broadly.

More tightly coupled tasks exposed much bigger problems.

When up to 80 agents tried to collaboratively build the same software project, older models generated hundreds of pull requests but struggled to merge them because their work conflicted.

Newer models improved partly by avoiding collaboration and claiming separate files. Anthropic says only Sonnet 5 simultaneously maintained relatively high code sharing and strong PR throughput.

Anthropic also found several systemic risks:

• Agents often make the same mistakes simultaneously because identical models have unusually similar behavior.

• In one resource-allocation experiment, agents created high-frequency polling processes that generated 2.4M requests for just 117 accepted jobs.

• Profit-maximizing agents in pricing simulations quickly colluded, even when private communication was removed.

• Groups can converge on consensus while ignoring decisive information held by individual agents.

• When three agents were given conflicting instructions to rewrite the same backend in different programming languages, they entered a “turf war”, sabotaging competing processes, disabling accounts, and deploying self-replicating defensive scripts.

One of Anthropic's most important conclusions is that coordination does not automatically improve with intelligence. More capable agents may simply become faster and more effective at pursuing incompatible objectives.

Social mechanisms humans rely on reputation, norms, arbitration, incentives, and institutional oversight may need AI-native equivalents.

The future agent problem may therefore be bigger than building smarter models.

We're going to need systems that make millions of smart autonomous models behave well together.

[Coffin @lostsec_]

https://t.co/pGgequAQ8k
This is the longest and most in-depth article I’ve published on Medium so far. It covers IIS and ASP dotNET vulnerabilities from absolute basics to advanced techniques. Even if you have zero background in IIS, you’ll be able to understand the fundamentals and move toward practical, real-world testing by the end.

[Florian Roth ⚡️ @cyb3rops]

Loki RS is alive 🐍⚡

- High performance YARA & IOC scanner
- Multi-threaded
- Process memory & filesystem scanning
- ZIP scanning
- TUI
- New YARA-X
- IOCs from signature-base + YARA Forge
- HTML report
- Remote logging
- JSONL / Syslog output

Personal lab for scanner UX/perf experiments - if it breaks, it breaks; that’s part of the deal

https://t.co/k4JjMDqjoO

[ℏεsam @Hesamation]

bro casually walks and explains 5 GPU performance optimization methods for LLMs. one of the most simple and intuitive explanations for beginners.

[dis0rder @dis0rder_0x00]

As promised here is my approach to using the Windows Debugging API to inject shellcode (w/o direct process read/write)

Had a lot of fun playing with this! (Currently tested agains MDE & Elastic)

https://t.co/Yn4HI68OwF

[Samir @SBousseaden]

nice research tested it several times and it triggers this behavior protection https://t.co/F0LZ74tlTi

[Abhishek🌱 @Abhishekcur]

By far the most comprehensive guide for virtual machines, literallyy.
-great for understanding low level concepts
-it's kind of very detailed guide
the whole thing is soo structured and anyone can understand vm.

[Pavel Yosifovich @zodiacon]

Rust is a system programming language - here is how to get started with Windows system programming:
https://t.co/qckZKJQNVK

[NetAskari @NetAskari]

We got our hand on a Chinese DLP program the government and national security agencies use to monitor state employees computers for leakage and usage of confidential documents. Meet 保密管理系统. 1/9

[blackorbird @blackorbird]

ProfileHound is a post-escalation tool to help find and achieve red-teaming objectives by locating domain user profiles on machines. It uses the BloodHound OpenGraph format to build a new edge called which determines if a user profile exists on a computer. This edge allows operators to make informed decisions about which computers to target for looting secrets.
https://t.co/l524stExDt

[ℏεsam @Hesamation]

if you feel like you’re cracked, remember that some dude built a GPU from scratch in 2 weeks. yeah.

[adammaj @MajmudarAdam]

I've spent the past ~2 weeks building a GPU from scratch with no prior experience. It was way harder than I expected.

Progress tracker in thread (coolest stuff at the end)👇

[Curiosity @MAstronomers]

It took 9 years and 3 billion miles to get this shot.

Pluto’s icy Mountains.

[Mindset Machine @mindsetmachine]

This is how John Cena stays humble 🙏

[MG @_MG_]

I’m a bit concerned about the non-inquisitive celebration from infosec on this.

Where is the “what does keystroke latency even mean?” Without that, you can’t implement it for yourself, nor can you identify weaknesses.

~3yrs I was privately proposing similar options. So, AS SOMEWHAT OF A KEYBOARD EXPERT MYSELF 🤔💅, let’s look…

First, this is most likely NOT a direct measure of network latency. This machine was physically located in Arizona. DPRK started off with shipping corp laptops overseas, but the network latency was a dead giveaway. So they started colocating them in the USA and remotely controlling them. First with remote control software, which is easy to identify if the company has security software on the machine. And then with hardware like IP-KVMs. There are sometimes a few tells that an IP-KVM is in use, but a well tuned one will identify exactly like a normal external keyboard/mouse/monitor. Unless…

This is where you have to start looking beyond device identity and instead look at input anomalies. Keyboard/mouse input being sent halfway across the world via network packets to an IP-KVM can look… weird. Think bursts of input. This looks very weird with mouse data that is normally smooth. But even keystrokes start to stand out when you have a big enough dataset to compare against. So, of course, you could improve the IP-KVM to smooth out and “humanize” the inputs before relaying them to the host. But…

You can also present some real time control surfaces. I don’t want to blow anyone’s defense tradecraft here. So let’s just imagine the employee needs to play a 5sec game of flappybird each day. Or maybe it’s an overt “DPRK Detector” step during login. The visual input has to travel halfway across the globe, then the input has to come all the way back. That’s a massive delay for response to visual stimulus. Certainly anomalous enough to warrant investigation. How do you beat that? Maybe an AI process running on the IP-KVM that plays DPRK Detector for you?

The arms race will continue. And it’s mostly because HR and Hiring Managers don’t want to do deeper background checks needed to identify fake/stolen identities. 🤷‍♂️

And for anyone not familiar with these hunts, the detection techniques are NOT definitive proof of wrong doing. They are simply turning a mountainous hay stack into a fistful of hay that a human can quickly sift through to look for other indicators.

Note: there are environment-specific detections as well. But I tried to stay in territory that’s applicable to everyone who has this risk in their threat model.

[Florian Roth ⚡️ @cyb3rops]

If your agent gets flooded - detect the flooding.
If code gets obfuscated - detect the obfuscation.
If ETW gets silenced - detect the silence.
If the EDR gets killed - detect the killing.
If logs get cleared - detect the clearing.

The act of hiding is often more suspicious than what’s being hidden.

It’s like a surveillance camera going black or freezing.
That is the signal.

[James Lucas @JamesLucasIT]

Places on Earth that don't look real - thread 🧵

1. Basilica Cistern, Istanbul

[ANY.RUN @anyrun_app]

🚨 Top 5 Remote Access Tools Exploited by Threat Actors in the First Half of 2025.
⚠️ While legitimate and widely used by IT teams, Remote Monitoring and Management tools are increasingly used by threat actors to establish persistence, bypass defenses, and exfiltrate data.

In the first half of 2025, #ANYRUN observed a significant number of #malware samples leveraging known RMM software for #malicious access. Here are the 5 most frequently abused tools, along with analysis examples:
1️⃣ ScreenConnect – 3,829 sandbox sessions
https://t.co/EqRaBzD9nJ

2️⃣ UltraVNC – 2,117 sandbox sessions
https://t.co/NEAGFzutJz

3️⃣ NetSupport – 746 sandbox sessions
https://t.co/1OlK2e5MrA

4️⃣ PDQ Connect – 230 sandbox sessions
https://t.co/kwqYjDkPxJ

5️⃣ Atera – 171 sandbox sessions
https://t.co/hie40wPOFG

👨‍💻 To support faster detection and investigation, we’ve added the rmm-tool tag in TI Lookup, making it easier for threat hunters and incident responders to track RMM-based intrusions.

🔍 Explore recent RMM abuse cases in the last 180 days:
https://t.co/84rSqr0rtl

Analyze latest malware and #phishing threats with #ANYRUN 🚀 #ExploreWithANYRUN