Statement from Mullvad Co-Founder regarding the issues with exit IP's as fingerprinting vector:
"As for mitigation, we are already testing a patch of the unintended behavior on a subset of our infrastructure."
Huh.
Am I the only one who didn't know that Microsoft makes a tool called EventLogExpert that is supposed to be an improved version of event viewer for IT/helpdesk people?
https://t.co/HzSzG1zSO0
LLMs have gotten good enough at reverse engineering to recover source code from obfuscated binaries with real accuracy.
So we asked the obvious next question: how fast and cheap is it to use one to build obfuscation specifically designed to beat it?
We benchmarked Claude Opus 4.6 against the Tigress obfuscator across 20 targets first, to map its strengths and failure modes. 40% solve rate. Phase 3 multi-layer combos hit 0%, with cost explosions that killed the runs.
Then we ran a dev/test/refine loop to build 3 purpose-built obfuscation variants targeting the same crackme, iterating directly against the model's known weaknesses.
The finding: LLM-targeted obfuscation is fast and cheap to develop. Context windows, budget caps, and shortcut biases are all exploitable attack surfaces.
The arms race just shifted.
For the first time, Mandiant Academy is bringing our Practical Threat Hunting course to you in person.
Join us onsite at the Google Reston office from May 19-21 to master CTI application, the A4 framework, and repeatable hunt methodologies.
https://t.co/CsDdA7jhPG
📢 The FLARE team has launched the FLARE Learning Hub - a free resource to hone your malware analysis and reverse engineering skills!
🛠️ https://t.co/PUHq3IQqV4
The initial launch brings with it:
- An in-depth introduction to time-travel debugging (TTD)
- A comprehensive Go language reference
- An assembly crash course
The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at https://t.co/bGCIjBfD3C. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD
📣#PIVOTcon26 Agenda is here 🤟 We are thrilled to announce the lineup for this year's speaker lineup.
2⃣days and 19 talks from leading #ThreatResearch experts.
The agenda link is in the first comment👇, and the talks and speakers are in the thread.🧵
#CTI#ThreatResearch
1/15
Introducing the new /crawl endpoint - one API call and an entire site crawled.
No scripts. No browser management. Just the content in HTML, Markdown, or JSON.
This is awesome! Incredibly useful for IR and beats my handmade notes 😆
Thank you to the folks that made this guide public 🙏 🙏
Get the PDF directly from here 🔗 https://t.co/tXu3Y8oTSJ
Kaspersky recently produced a podcast on Operation Triangulation, basically a story of the investigation
Things that I haven't seen mentioned elsewhere:
— Triangulation malware existed for >10 years
— Some technical details similar to the Equation Group
https://t.co/rH5jer5aI3
Coruna: a powerful iOS exploit kit containing 23 exploits across five full exploit chains targeting iPhones running iOS 13 through 17.2.1.
The Exploit Kit and implant leave behind plenty of traces. #signature
https://t.co/Th5Fk8e32U
A full iOS exploit toolkit, "Coruna," has been found in the wild, hacking iPhones that visited infected websites, used by Russian spies targeting Ukrainians and thieves targeting Chinese crypto holders. And it may have been created for the US government. https://t.co/59rIUoevNS
DFIR analysts who use macOS as their daily driver deserve free and native forensic tooling. So I built one. 🍎
Introducing 𝗜𝗥𝗙𝗹𝗼𝘄 𝗧𝗶𝗺𝗲𝗹𝗶𝗻𝗲 — a timeline analysis app built from the ground up for Mac-based DFIR folks, forensic investigators, or SOC analysts. Built in appreciation of, and inspired by, Eric Zimmerman’s Timeline Explorer.
Every feature in this tool was shaped by real IR casework. Handling massive timelines, parsing artifacts here and there, and pivoting across logs during active investigations. I built IRFlow Timeline to be the native macOS timeline analyzer that actually keeps up with a live case. Every button and view is intentional; if it’s in the app, it’s because I needed it mid-case and realized the standard tools fell short.
No dependencies. Zero setup. Just drag, drop, and analyze.
#dfir #incidentresponse #timeline #macos #threathunitng #digitalforensics