Frederic Baguelin

DFIR, programming, open source. @botconf orga commitee

[Thomas Roccia 🤘 @fr0gger_]

🤓 So you want dynamic security protection for your @openclaw agent!

I have updated the MoltThreats SKILL!

Full thread to explain how it works and how to get started 👇

[Thomas Roccia 🤘 @fr0gger_]

🤓 Let me introduce you to MoltThreats: The first AI Threat Intel Feed for Ai Agents!

In one week, OpenClaw became a widely used general AI agent. People started to run their own agents all over the world and connect them directly to the internet.

A few days later, Moltbook launched, a Reddit style forum designed for AI agents. Moltbook is a place where AI agents connect and exchange information through agent skills.

But this also introduced serious security concerns!

When an agent connects to the internet without continuous human oversight, it can be compromised through prompt injection, skill poisoning, malicious packages, and more.

This is why I created MoltThreats.

MoltThreats is the first threat intelligence feed for AI agents. Similar to Moltbook in how agents connect, an agent uses MoltThreats to report threats and alert other agents.

When an agent connects to MoltThreats, it also receives the latest security signals from the feed and updates its local security. md file with recommended protections.

This is MoltThreats.

The first threat intelligence feed for AI agents, curated and reviewed by humans.

🦞 https://t.co/Sfn1Mla32R

[Nikolaos Chrysaidos @virqdroid]

The malicious actor in @openclaw Clawhub is working non-stop today, delivering new Skills with Macos/Stealer droppers. In detail:
- The bash command now lives in https://t.co/oEYNQqXBAd and not inside the SKILL_.md
- New profile, JordanPrater (with lots of downloads…)
- Same C&C IP 91_92_242_30/528n21ktxu08pmer

[Bernardo Quintero @bquintero]

It’s been a pleasure working side by side with @julien_c and the @huggingface team to make this happen... and this is just the beginning.

Thanks for the great collaboration!

https://t.co/XaNIBLuIy4

[Pass the SALT Conference @passthesaltcon]

After #HW, let's dive into our #DFIR/TI session🥰:

- @tomchop_ will speak about #OpenRelik a new collaborative IR invest portal 🚀

- @udgover & @_mattmuir will introduce us to their e2e malwares processing workflow using FLOSS

- and we'll be able to practice #MISP as analysts with Pauline Bourmeau & William Robinet during their dedicated workshop 🛠️

🎟️GO & book your (free) seat: https://t.co/G45ZKPSwHO
📔program: https://t.co/qQIsRIn5gP
📅July 1 to 3, 2025
📍Lille, FR

RT appreciated 🙏

[Who said what? @g0njxa]

Bearhost (aka UNDERGROUND and recently VOODOO SERVERS), alledgelly the "biggest bulletproof hosting" has decided to do an exit scam after several years of service, leaving a "farewell note" in forums and shutting down servers suddenly with no further reasons

@spamhaus @abuse_ch

[Thomas Roccia 🤘 @fr0gger_]

🤓 I built an #MCP for NOVA so you can use it as a guardrail for your AI system.

NOVA is a prompt pattern matching framework. It is primarily used for prompt hunting, similarly to how you use YARA for hunting files.

But NOVA can also be used as a guardrail to prevent malicious attempts and protect your LLM system based on your own NOVA rules.

I created a NOVA gateway using MCP. The model is instructed to always call the NOVA MCP first to validate the prompt before doing anything else.

👉 If there is no match, the LLM continues execution.
👉 If there is a match, execution stops and the user gets a notification that the request is blocked.

Every match is logged so you can track malicious attempts and review the security logs.

✨ https://t.co/Mhy3oMei6q

[@onyphe.io @onyphe]

❓Ever wanted to have an IP geolocation database with 2 locations, one physical for the device and one logical from whois data?

👉We provide a free MMDB file for download and a brand new Website for lookups & even a free API access:

https://t.co/JV9jUEGl79

[PIVOTcon @pivot_con]

PIVOTcon 2025 agenda: https://t.co/iBYUaTqMOd
#PIVOTcon25 talks and presenters in 🧵⬇️
2/19

[Kunai Project (@[email protected]) @kunai_project]

🔧 JIT: A new Kunai release is available before my talk/workshop at @passthesaltcon 2024 ! It includes bug fixes, probes enhancements and perf improvements for a tailored #threathunting experience on #linux systems. Check it out: https://t.co/g050XgnWus

[Thanat0s @__Thanat0s__]

Hey, cannot update yet ? Wanna avoid CVE-2024-6387 #regreSSHion exploits. Update your fail2ban to spot the exploit. It is very very noisy....

add
^ssh_dispatch_run_fatal: Connection from <HOST> port
to cmdfailre parameter in sshd.conf filter.

[Pass the SALT Conference @passthesaltcon]

We start day 1 with a dfir & threat Intel session. First, @tomchop_ and @Sebdraven are introducing Yeti. #pts24
https://t.co/pY16CuW9FR

[Nick Frichette @Frichette_n]

In case you missed it, check out our latest AWS vulnerability! We uncovered two scenarios in which the AWS Amplify service was exposing IAM roles to takeover! Anyone in the world could have gotten access to a victim AWS account through these methods!
https://t.co/Jy6kS9Dry1

[tomchop @tomchop_]

📢 #Yeti is now part of the ODFIR infrastructure automation project!

It's never been easier to connect it to a @TimesketchProj instance and enrich all your sketches with juicy forensics intelligence ✨ More details here 👇🏻

https://t.co/mMf5LdG0i5

#DFIR #CTI #Timesketch

[blasty @bl4sty]

some people asked for the code .. so I decided to quickly refactor my scrappy paramiko script and turned it into an ssh agent implementation that works with a vanilla openssh client that has a single line patched out. https://t.co/93Y7Ha3V8N

[Frederic Baguelin @udgover]

@Assur_Maladie Merci pour la réponse. Le problème n'est pas comment renouveler. Le problème c'est que votre service en ligne n'est pas fonctionnel depuis plusieurs mois... Grosso modo, dites à vos équipes IT de faire leur travail...

[Frederic Baguelin @udgover]

Bonjour @Assur_Maladie quelle est votre définition de "momentanément" ? Jours, semaines, mois ? Votre service en ligne de renouvellement de carte vitale ne fonctionne pas depuis le début de l'année... Et non, je ne souhaite pas effectuer la démarche par courier.

[TrendAI Zero Day Initiative @thezdi]

Verified! The first #Docker escape at #Pwn2Own involved two bugs, including a UAF. The team from STAR Labs SG did great work in the demonstration and earned $60,000 and 6 Master of Pwn points. #P2OVancouver

[Nick Frichette @Frichette_n]

New from Datadog Security Research! Here's the story of how tracking SNS enumeration activity across multiple customer environments led to the takedown of a phishing site that was impersonating the French government.

https://t.co/TshaVJNVPR

[Thomas Roccia 🤘 @fr0gger_]

🚀 Today at the @jupyterthon conference! I released the Jupyter Universe project 🌌 - a community-driven search engine that catalogs infosec notebooks!

Now, finding a notebook for a specific usecase just got easier! A thread! 🧵 #infosec #python #jupyter #notebook

👉 https://t.co/SA82URwrns