wLcY

Passionate in malware analysis, vulnerability analysis and reverse engineering. My tweets are my own.

[wLcY @x9090]

@allthingsida @zeifan @reconmtl Can't agree more!

[Richard Johnson @richinseattle]

Fun write up on a malware experiment that uses local LLM models now shipped in Windows and a lua based agent loop to autonomously find and exploit a privesc vulnerability using inference for codegen.

[wLcY @x9090]

@richinseattle benefits of supporting both GGUF and MLX at the same time.

[wLcY @x9090]

@richinseattle Otherwise, can consider using llama-python. Never tried myself but it claimed that it can support multimodel.

In short, Ollama is recommended for production, serving small-to-medium size of user requests, as a LLM server.

Otherwise should go for LM Studio for the

[wLcY @x9090]

@richinseattle top of llama.cpp. Ollama has an excellent backend server with concurrent support using Golang as its backbone. Limitation: Cannot maximize the Metal GPU.

- llama.cpp - Also provide server capability with great control of tweaking the model's hyerparameters. Ollama supposed to

[wLcY @x9090]

@richinseattle Depends on your use cases:

- Self-use and local experimentation for various models, LM Studio is the best. Support both GGUF and MLX. Underhood, it is using llama.cpp to drive GGUF and mlx-explore, LM Studio's own python wrapper that drives mlx-lm. Limitation: Doesn't work great

[Sebastian Raschka @rasbt]

From GPT to MoE: I reviewed & compared the main LLMs of 2025 in terms of their architectural design from DeepSeek-V3 to Kimi 2.

Multi-head Latent Attention, sliding window attention, new Post- & Pre-Norm placements, NoPE, shared-expert MoEs, and more...
https://t.co/oEt8XzNxik

[ö @r0keb]

Good morning! I just published a blog post about a KASLR bypass that works on modern Windows 11 versions. It leverages Intel CPU cache timings to exfiltrate the base address of ntoskrnl.exe. I hope you like it!

https://t.co/jXM3uXIcHR

[Jon Hencinski @jhencinski]

How Ransomware Groups Got In: @rapid7 MDR’s Top Initial Access Vectors from Q1 2025.

Top Initial Access Vectors
- Account Compromise (No MFA)
- Vuln Exploitation (all known, patchable)
- Brute Forcing
- Exposed RDP
- SEO Poisoning

What our #MDR team saw in real-world ransomware intrusions in Q1—and what you can do to reduce risk 🧵

[🎻 ➡️ BlueSky @ericlaw]

<snort>

[Theori @theori_io]

Did you attend @hexacon_fr this year?

Check out our summarizing blog post 👀
https://t.co/8WkDMZLTOO

Take a look at the #WindowsOS privilege escalation #vulnerability
and dive a little deeper into the #exploits at the code level.

#Theori #티오리 #HEXACON #kernel #lpe

[Takahiro Haruyama @cci_forensics]

VMW Carbon Black TAU discovered 34 unique vulnerable WDF/WDM drivers (237 file hashes), including ones made by major chip/BIOS/PC makers. By exploiting the drivers, an attacker without privilege may erase/alter firmware, and/or elevate OS privileges. https://t.co/lfVpj4Lt3T

[wLcY @x9090]

@symeonp I did not attempt to instrument the KM components using TinyInst. The OOB write was first observed in the UM component and further triaging reveals that it could be triggered on the KM as well. The patch also shows that the size boundary check is implemented in UM only :)

[wLcY @x9090]

It has been a while since my last blog as I have been focusing on finding vulnerabilities on network attack surfaces. In this blog, I share my approach and shed some light on the vulnerabilities discovered along the way. https://t.co/h1our52lR4 Enjoy!

[wLcY @x9090]

Congrats Timo! All the best to your new endeavors! :)

[Timo Hirvonen @TimoHirvonen]

My plans are still a little open but it’s already clear that my next journey is going to be amazing :)! I don’t have the words to express how grateful I am to those who’ve seen enough potential in me to invite me to take my skills to the next level in their world-class teams <3

[wLcY @x9090]

@TimoHirvonen @thezdi Good luck to your demo/attempts! :)

[wLcY @x9090]

Finally got my Surface Pro awarded by @Bugcrowd and @msftsecresponse through Excellerate program as a joint effort to incentivise bug hunters. :)

[wLcY @x9090]

@aluhrs13 Thanks for confirming this. For the record, a quick workaround for this is to add "ALL APPLICATION PACKAGES" with RX permissions to TTDRecordCPU.dll. Attaching UWP app process using TTD should work after this.

[wLcY @x9090]

Does TTD recording by attaching already running UWP apps really works as per documentation? It doesn't seem the case, maybe I'm missing something @aluhrs13 https://t.co/dhCZROXkkp