Danijel Grah

wanna be balanced hacker and unlearner of all the things | SOC | Security | Professionally injured athlete | The cat is alive | Tweets are my own.

[Lukasz Olejnik @lukOlejnik]

A 2005 state-designed worm designed to corrupt physics simulations sat undetected on VirusTotal for nearly a decade. Fast16, intercepted executable files at the kernel level and silently rewrote floating-point calculations to make them produce slightly wrong answers. Targets: high-precision engineering suites used for structural analysis, crash simulations, and physical process modeling, including LS-DYNA, a tool cited in reports on Iran's nuclear weapons research. The sabotage vector relied on deployment of the driver across a network via worm, corrupting calculations on every machine, and eliminating the possibility of cross-checking results against a clean system. Stuxnet got the documentary. Fast16 got twenty years of nothing. https://t.co/3qfJMziXVd

[Elias Al @iam_elias1]

Two economists just published a mathematical proof that AI will destroy the economy.

Not might. Not could. Will — if nothing changes.

The paper is called "The AI Layoff Trap." Published March 2, 2026. Wharton School, University of Pennsylvania. Boston University. Peer reviewed. Mathematically modeled.
The conclusion is one sentence.
"At the limit, firms automate their way to boundless productivity and zero demand."

An economy that produces everything. And sells it to nobody.
Here is how you get there.
A company fires 500 workers and replaces them with AI. A competitor fires 700 to keep up. Another fires 1,000. Every company is behaving rationally. Every company is following the incentives correctly. And every company is building a trap for itself.

Because the workers who were fired were also customers.
When they lose their jobs faster than the economy can absorb them, they stop spending. Consumer demand falls. Companies respond by cutting costs — which means automating more workers — which means less spending — which means more falling demand — which means more automation.

The loop has no natural exit.
The researchers tested every proposed solution. Universal basic income. Capital income taxes. Worker equity participation. Upskilling programs. Corporate coordination agreements.
Every single one failed in the model.
The only intervention that worked: a Pigouvian automation tax — a per-task levy charged every time a company replaces a human with AI, forcing them to price in the demand they are destroying before they pull the trigger.

No government has implemented this. No major economy is seriously discussing it.
Meanwhile the numbers are already tracking the curve. 100,000 tech workers laid off in 2025. 92,000 more in the first months of 2026. Jack Dorsey fired half of Block's workforce and said publicly: "Within the next year, the majority of companies will reach the same conclusion."
Nobody is doing anything wrong. Companies are following their incentives perfectly. That is exactly the problem.

Rational behavior. At scale. Simultaneously. With no mechanism to stop it.
Two economists built the math. The math leads to one place.

Source: Falk & Tsoukalas · Wharton School + Boston University ·
https://t.co/4m8E9jQNYm

[MagicSword @magicswordio]

Attackers don’t need stolen certificates. They only need 8 bytes. By flipping 4 bytes in the PE checksum and 4 in the certificate padding, they generate 2⁶⁴ unique driver hashes while keeping Microsoft’s digital signature valid.

Why it matters:
- Those 8 bytes sit outside the region Windows verifies.
- Every variant looks “signed and trusted.”
- Hash-based blocking becomes useless overnight.

That’s how TrueSightKiller evolved into 2,500+ signed variants. All trusted by Windows, all capable of killing EDRs in seconds.

Check out: https://t.co/8ldbtHVJBa

[Danijel Grah @r4shimo]

And the POC: https://t.co/Pl5mnhOWwg

[Danijel Grah @r4shimo]

I wrote a short post on AI and offensive security. I looked at how AI is starting to impact pentesting, red teaming, and offensive tooling. What’s real today and what might be coming next.

👉 https://t.co/KMQkaNYo3R

#AI #Cybersecurity #OffensiveSecurity #Infosec

[Danijel Grah @r4shimo]

@seanhn @seanhn here is also a nice study https://t.co/DC5pW9dhNd which complements your research.

[Danijel Grah @r4shimo]

@k1nd0ne great blog post https://t.co/F0S9TYhIrm. Do you also plan to add support for Windows 11 24H2 ?

[Hossam @0xHossam]

New Blog Post: PowerShell Exploits – Modern APTs and Their Malicious Scripting Tactics

I’ve just published a new blog where I explore how PowerShell is used in red team operations, especially by advanced persistent threats (APTs), with a focus on evasion.

In the blog, you’ll find:
- A detailed explanation of AMSI (Antimalware Scan Interface) and how to bypass it with PowerShell
- How we can abuse .NET to run PowerShell commands without PowerShell and without getting detected, and how this works
- Methods of AMSI memory patching in C with many practical examples and effective public tools like Invoke-Obfuscation
- How APTs create their own methods to avoid detection by security tools with practical, effective demonstrations
- Practical examples of underused techniques like CLSID hijacking and exploiting lesser-known LOLBins
- Introducing PowerLoad3r: An advanced, evasive malicious PowerShell script loader.

Read it from here -> https://t.co/wG8qzPhswm
"All the techniques and tests are done against Kaspersky EDR, so you’ll get real-world demos :)"

A special shoutout to @0xNinjaCyclone for inspiration.

#redteam #evasion

[nyxgeek @nyxgeek]

"This is our world now... the world of the electron and the switch, the beauty of the baud."

From the Hacker's Manifesto, aka The Conscience of a Hacker, by The Mentor. First published in Phrack Issue 7, 1986.

Loved seeing this in the movie Hackers.

https://t.co/LFnOwSEYlz

[Florian Roth ⚡️ @cyb3rops]

We can also use a regular expression to search for *.rdp files in the temporary folders that Outlook uses to detect traces of #MidnightBlizzard / #Nobelium activity 🔍

A short form would be:
\\Content\.Outlook\\[A-Z0-9]{8}\\[^\\]{1,255}\.rdp$

Or as string contains combo:
\AppData\Local\Microsoft\Windows\
\Content.Outlook\
.rdp

✨ a match means that the file has been opened right from the email attachments

I have added that filename IOC to THOR Lite's signature database
https://t.co/0djFuGufrQ

[International Cyber Digest @IntCyberDigest]

🚨 Updated list by @IntelBrokerBF of the companies affected by @Cisco breach:

https://t.co/A94BfFgzQu

[Danijel Grah @r4shimo]

@H4ckManac Hmmm. Hmmm

[Hackmanac @H4ckmanac]

🚨Data Breach Alert ‼️

IntelBroker, in collaboration with EnergyWeaponUser and zjj, claims to be selling data from a recent Cisco breach.

The compromised data reportedly includes GitHub and GitLab projects, SonarQube projects, source code, hardcoded credentials, certificates, customer SRCs, confidential Cisco documents, Jira tickets, API tokens, AWS private buckets, Cisco technology SRCs, Docker builds, Azure storage buckets, private and public keys, SSL certificates, and Cisco premium products.

Several high-profile companies, including Verizon, AT&T, Bank of America, Barclays, British Telecom, Microsoft, Vodafone, and Chevron, are allegedly impacted.

Samples have been provided.

[LaurieWired @lauriewired]

With all the linux RCE drama, it's a good time to bring up a neat scoring system that you (may) not have heard of.

EPSS is the cool younger brother of CVSS.

Patching just 3.5% of all known vulnerabilities covers 67.8% of what is exploited in the wild.

Assuming you don't have infinite resources, it theoretically lets you focus on the CVEs that are more actionable.

[🅰🅳🅼 @securityfreax]

A security feature that was long overdue - it protects browser cookies with TPM, making them strictly device bound.

Device Bound Session Credentials

https://t.co/l6ylzrklVi

#Gamechanger

[J̵o̵h̶n̵n̷y̶ ̵W̸i̶t̵h̴a̴d̵ @w1th4d]

We finally published JarPlant (Java Archive Implantat Toolkit) on GitHub! It's still a work in progress, but it works (mostly).

It's a red team tool for injecting malicious code into Java apps and libraries. Use responsibility.

https://t.co/Uj2tvw6M0P

[SEKTOR7 Institute @SEKTOR7net]

Tunneling TCP via a file, by Fidel Perez-Smith

#redteam #maldev

https://t.co/mc3SOTYSv9

[Nathan McNulty @NathanMcNulty]

Needed to test something... and I still can't believe this Defender AV / Tamper Protection bypass works :(

Sure, you need admin rights to install another AV, but Tamper Protection is supposed to prevent even admins from disabling Defender, right?

[Nicolas Krassas @Dinosn]

How Hackers Extracted the ‘Keys to the Kingdom’ to Clone HID Keycards https://t.co/hlcjv5yFXN

[Nicolas Krassas @Dinosn]

BYOVDLL: New Exploit Bypasses Microsoft’s LSASS Defenses https://t.co/fyeCioUrgq