Feng Xue

Founder of ThreatBook(CTI provider). ex Microsoft TwC, ex Amazon InfoSec.

[Feng Xue @s0what]

hhh…old times

[haroon meer @haroonmeer]

Niels Provos posting smart security stuff, Dave Aitel knows stuff he can’t share, Halvar exploring the current space, and people arguing loudly about disclosure ethics..

This could totally be 2002..

[Feng Xue @s0what]

https://t.co/h59e3W5WFK

POC by Percivalll

[Feng Xue @s0what]

Copyfail Kubernetes Cluster container escape verified. #copyfail #kubernetes #container

[Feng Xue @s0what]

Copyfail Kubernetes Cluster container escape verified. #copyfail #kubernetes #container

[Feng Xue @s0what]

+1

[Howie Xu @H0wie_Xu]

The hiring game has fundamentally changed, and most people haven't noticed.

I've been thinking about what companies are really looking for in 2026. Everyone talks about AI skills, programming abilities, or technical expertise. But after observing multiple hiring cycles, I see a different pattern emerging.

We're not just hiring specialists anymore. We're hiring mini-CEOs or founders for literally any position.

The qualities we used to demand only from startup founders - self-drive, resilience, communication skills - are now table stakes for every role. Product managers, engineers, designers, marketers. Everyone needs founder-level qualities.

This isn't theoretical. My own hiring criteria has shifted completely. When I work with recruiters, my first requirement is simple: "Show me candidates who have already founded a company."

It doesn't matter what position I'm filling. I want to see entrepreneurial experience on that resume.

Recently, I heard Ramp's CEO say exactly the same thing. He's specifically looking for people with founder backgrounds, regardless of the role they're hiring for. Rippling has 150 former YC founder types working in the company.

Why is this happening? In an AI-accelerated world, technical skills become commoditized faster than ever. What can't be replicated is the founder mindset - the ability to own problems end-to-end, push through obstacles, and communicate vision clearly.

Ten or twenty years ago, we only expected this from startup founders. Today, we need it from everyone.

The implication is profound: we're not hiring employees anymore. We're assembling teams of internal entrepreneurs who can operate with founder-level autonomy and accountability.

If you're job hunting, stop optimizing your technical resume. Start building evidence of entrepreneurial thinking and execution.

The companies that embrace this hiring philosophy first will build unbeatable teams.

#Hiring #Entrepreneurship #AI #Leadership #FutureOfWork #StartupMindset #TechCareers #Innovation #Management #TalentStrategy

[Feng Xue @s0what]

@Code4_CyberSec Another underrated CTI portal from us: https://t.co/WLxVO4vAjf

[Feng Xue @s0what]

Tencent researchers found a RCE vulnerability of Hermes agent, what’s more interesting is that they found the agent defended itself after few exploitation tries.

Inspired by this accidental emergence, the team built something deliberate: an adaptive immune system for AI agents— in just a few dozen lines of code.

For more details, read their post:
https://t.co/HeNbk81GbT

[Feng Xue @s0what]

We actually found the Lazarus breach on a MacBook before realizing that there’s a Axios poisoning

[ThreatBook @ThreatBookLabs]

#Lazarus is behind the Axios npm supply chain attack.
ThreatBook's analysis links the macOS payload to WAVESHAPER — a Lazarus backdoor disclosed by Mandiant in Feb 2026.
Full attribution report + new IOCs → https://t.co/EhB09JAKqz

[Feng Xue @s0what]

Do we still need professional bug hunters?

[Calif @calif_io]

We asked Claude to find a bug in Vim. It found an RCE. Just open a file, and you’re owned. We joked: fine, we’ll switch to Emacs. Then Claude found an RCE there too.

Full story: https://t.co/nQo9MF1Npe

[Feng Xue @s0what]

@ZackKorman For AI agent security, seems it' still vague and there a lot of overlapping concept and solutions such as GuardRails, LLM Firewall, Agent Firewall, etc.

[Feng Xue @s0what]

#Kimsuky

[ThreatBook @ThreatBookLabs]

Threat Alert:
#Kimsuky — Rapidly changing dynamic-DNS hostnames used to spin up phishing landing pages and credential harvesters.
Domains:
nodeyou[.]server-on[.]net
nodeyou[.]live-on[.]net
nodeyou[.]mydns[.]bz

ThreatBook Intelligence:
https://t.co/TCFlL31q9P

[ThreatBook @ThreatBookLabs]

Threat Alert:
#CharmingKitten: New C2 Hostname on Known Asset.
IP: 185[.]132[.]176[.]27
New C2 Hostname: videozoom[.]ddns[.]net

ThreatBook Intelligence: https://t.co/goCp3ytL2E

[ThreatBook @ThreatBookLabs]

Threat Alert:
#donot — Info TLD Domains Registered for C2 Abuse. Newly registered .info domains likely reserved for C2/backdoor control.
Domains:
uptonox[.]info
gilbertfix[.]info
uptofixbi[.]info
keeznoted[.]info
servzkeeps[.]info
ThreatBook Intelligence: https://t.co/jF2f8grOSa

[ThreatBook @ThreatBookLabs]

Threat Alert:
#SideCopy: New Malware Sample Observed. Sample uses a typosquatted C2
Hash: 5d5ae0671130f0b8232e4e426d88fb4fa42f50e86b7a016a92b89c4181528ad3
C2 Domain: windowsdns[.]com

ThreatBook Intelligence: https://t.co/ov6dsZetm0

[ThreatBook @ThreatBookLabs]

🚀 We’re excited to announce the launch of ThreatBook ATI!

With ThreatBook ATI, defenders gain tailored threat landscapes that connect adversary profiles, technical indicators, and real-world activity, helping SOC teams focus on what matters most.

https://t.co/zLtzINvoKO

[ThreatBook @ThreatBookLabs]

What if you could build a customized threat landscape report in minutes?
With ThreatBook ATI, you can.
Here’s how:

https://t.co/y6EHoT0PMs

[Feng Xue @s0what]

@sec_hub93028 For domains and IPs, try https://t.co/Miuvnm0qR9

[ThreatBook @ThreatBookLabs]

New #C2 linked to #SideCopy #APT Group:
185[.]123[.]102[.]59
https://t.co/Lm9c7dm3PM

[ThreatBook @ThreatBookLabs]

#Lazarus #APT group launched an attack using decoy documents and a #VBA loader.
One lure document is related to EDGE Group.
#C2: hiremployee[.]com
#malware: office-theme[.]com
https://t.co/ig7ydiygNW
https://t.co/8T8TRqWRo6

[ThreatBook @ThreatBookLabs]

We’re thrilled to be included in the 2025 Gartner® Magic Quadrant™ for Network Detection and Response (NDR)! ThreatBook’s edge? A global perspective on cyber threats, actionable context from deep research, and a platform designed to spot what others miss. Speak with us today!

[ThreatBook @ThreatBookLabs]

File from the #SideCopy #APT group:
#SHA256: 1d6ac9877ca79fbb85357d81a80c3ff4da90145ae4bac6c08441aaf4d3c0ec90 (National Anubhav Scheme-2025.desktop)
#IOC:
165.232.114.63
165.22.251.224
https://t.co/sdTzz5IcEe
https://t.co/DrrBDxRNhh