razaborg

Tweets are my own. Un jour j'irai vivre en théorie, parce qu'en théorie, tout se passe bien.

[CR1337 @CR1337]

Statement from Mullvad Co-Founder regarding the issues with exit IP's as fingerprinting vector:

"As for mitigation, we are already testing a patch of the unintended behavior on a subset of our infrastructure."

[tmctmt @tmctmt]

Mullvad exit IPs are surprisingly identifying
https://t.co/JJzrTTG7Uc

[Brian in Pittsburgh @arekfurt]

Huh.
Am I the only one who didn't know that Microsoft makes a tool called EventLogExpert that is supposed to be an improved version of event viewer for IT/helpdesk people?

https://t.co/HzSzG1zSO0

[Elastic Security Labs @elasticseclabs]

LLMs have gotten good enough at reverse engineering to recover source code from obfuscated binaries with real accuracy.

So we asked the obvious next question: how fast and cheap is it to use one to build obfuscation specifically designed to beat it?

We benchmarked Claude Opus 4.6 against the Tigress obfuscator across 20 targets first, to map its strengths and failure modes. 40% solve rate. Phase 3 multi-layer combos hit 0%, with cost explosions that killed the runs.

Then we ran a dev/test/refine loop to build 3 purpose-built obfuscation variants targeting the same crackme, iterating directly against the model's known weaknesses.

The finding: LLM-targeted obfuscation is fast and cheap to develop. Context windows, budget caps, and shortcut biases are all exploitable attack surfaces.

The arms race just shifted.

[Mandiant (part of Google Cloud) @Mandiant]

For the first time, Mandiant Academy is bringing our Practical Threat Hunting course to you in person.

Join us onsite at the Google Reston office from May 19-21 to master CTI application, the A4 framework, and repeatable hunt methodologies.

https://t.co/CsDdA7jhPG

[Josh Stroschein | The Cyber Yeti @jstrosch]

📢 The FLARE team has launched the FLARE Learning Hub - a free resource to hone your malware analysis and reverse engineering skills!

🛠️ https://t.co/PUHq3IQqV4

The initial launch brings with it:
- An in-depth introduction to time-travel debugging (TTD)
- A comprehensive Go language reference
- An assembly crash course

[Moritz @m_r_tz]

The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at https://t.co/bGCIjBfD3C. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD

[Boris Larin @oct0xor]

Full analysis: https://t.co/yPmKxQGhWt

[NK @Nikaiw]

meet VMkatz, https://t.co/eza4AXRuFT

[Mehmet Ergene @Cyb3rMonk]

This could be quite interesting and useful for #DFIR, locally on your PC.

Maybe Defender timeline downloader + this? 🤔

https://t.co/Xl16rxKLuF

[PIVOTcon @pivot_con]

📣#PIVOTcon26 Agenda is here 🤟 We are thrilled to announce the lineup for this year's speaker lineup.
2⃣days and 19 talks from leading #ThreatResearch experts.
The agenda link is in the first comment👇, and the talks and speakers are in the thread.🧵
#CTI #ThreatResearch
1/15

[Cloudflare Developers @CloudflareDev]

Introducing the new /crawl endpoint - one API call and an entire site crawled.

No scripts. No browser management. Just the content in HTML, Markdown, or JSON.

[TracketPacer @TracketPacer]

manual DHCP

[Kostas @Kostastsale]

This is awesome! Incredibly useful for IR and beats my handmade notes 😆

Thank you to the folks that made this guide public 🙏 🙏

Get the PDF directly from here 🔗 https://t.co/tXu3Y8oTSJ

[Oleg Shakirov @shakirov2036]

Kaspersky recently produced a podcast on Operation Triangulation, basically a story of the investigation

Things that I haven't seen mentioned elsewhere:
— Triangulation malware existed for >10 years
— Some technical details similar to the Equation Group

https://t.co/rH5jer5aI3

[nad @Nadsec11]

Reverse-engineered Coruna - a nation-state iOS exploit kit - from raw JavaScript. 28 modules, 500+ XOR strings decoded, 6,596-line teardown. PAC bypass, JIT cage escape, PACDB hash forgery.
https://t.co/3nTEVTSXHX
https://t.co/KjqGcKMlMe
(technical analysis more interesting, read coruna blog post first, technical analysis looks better on github, link on-site)

[blackorbird @blackorbird]

Coruna: a powerful iOS exploit kit containing 23 exploits across five full exploit chains targeting iPhones running iOS 13 through 17.2.1.

The Exploit Kit and implant leave behind plenty of traces. #signature
https://t.co/Th5Fk8e32U

[Andy Greenberg (@agreenberg at the other places) @a_greenberg]

A full iOS exploit toolkit, "Coruna," has been found in the wild, hacking iPhones that visited infected websites, used by Russian spies targeting Ukrainians and thieves targeting Chinese crypto holders. And it may have been created for the US government. https://t.co/59rIUoevNS

[Renzon @r3nzsec]

DFIR analysts who use macOS as their daily driver deserve free and native forensic tooling. So I built one. 🍎

Introducing 𝗜𝗥𝗙𝗹𝗼𝘄 𝗧𝗶𝗺𝗲𝗹𝗶𝗻𝗲 — a timeline analysis app built from the ground up for Mac-based DFIR folks, forensic investigators, or SOC analysts. Built in appreciation of, and inspired by, Eric Zimmerman’s Timeline Explorer.

Every feature in this tool was shaped by real IR casework. Handling massive timelines, parsing artifacts here and there, and pivoting across logs during active investigations. I built IRFlow Timeline to be the native macOS timeline analyzer that actually keeps up with a live case. Every button and view is intentional; if it’s in the app, it’s because I needed it mid-case and realized the standard tools fell short.

No dependencies. Zero setup. Just drag, drop, and analyze.

#dfir #incidentresponse #timeline #macos #threathunitng #digitalforensics

[Tom Dörr @tom_doerr]

Log analysis tool for forensics and threat hunting

https://t.co/9ZRh1JUTOv