Zr4l0cK

Security Researcher

[Zr4l0cK @zr4l0ck]

@MSNightmare2000 @MicrosoftLearn 🤣

[Virus Bulletin @virusbtn]

Many congratulations to Edoardo Giuggioloni, Christiaan Beek and Jindrich Karasek of Rapid7 Labs, who are the winners of this year's Péter Szőr Award for "BPFdoor in Telecom Networks: Sleeper Cells in the Backbone".

[Zr4l0cK @zr4l0ck]

Is reverse engineering just dead?

[Zr4l0cK @zr4l0ck]

@_xeroxz So the outcome is that AI is still not able to devirtualize such stuff or that with proper tooling even such obfuscation is useless

[Zr4l0cK @zr4l0ck]

@eliasbchlny @radareorg good job!

[Zr4l0cK @zr4l0ck]

@ShadowOpCode @JAMESWT_WT @skocherhan @reecdeep @tobersotski @AndreaDraghetti @marsomx_ @NguynQu14458611 @ffforward @g0njxa does it have any FPs? good job btw

[ShadowOpCode @ShadowOpCode]

Just uploaded 203 #RGBLoader samples to MalwareBazaar, all discovered through hunting with my custom #YARA rule! 🔬

The samples are now available to the malware research community under the RGBLoader tag.

🔗 https://t.co/k8IZ5lJ8q0

#MalwareAnalysis #ThreatHunting

[Dark Web Informer @DarkWebInformer]

‼️🇬🇧 Deloitte has been named by The Gentlemen ransomware.

🇬🇧 Deloitte - A global professional services organization providing audit and assurance, consulting, financial advisory, risk advisory, tax, legal, technology, and cybersecurity services.

[Abdelhamid Naceri @MSNightmare2000]

I believe Microsoft silently patched ShieldCrash without releasing an advisory or CVE, recent changes in mpengine.dll shows how the vulnerability was patched.
I think a patch was released long before this Tuesday since Defender doesn't have to follow the patching schedule.

[📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中 @MalwareBibleJP]

『ハッカー集団「Qilin」は〜取材に対し、「定型業務はAIに委託している」とコメントし、サイバー攻撃に独自開発したAIを常に利用していると明らかにしました。』昨年アサヒビールを攻撃した国際ハッカー集団「Qilin」が取材に対し、AIを利用することで攻撃対象を毎週数百社へと増やしたと主張した。定型作業の自動化やデータ分析の高速化によって攻撃にかかる時間を短縮したとしており、交渉に応じない企業に対しては特定した機密情報を速やかに送り付ける手法も示唆している。

【独自】国際ハッカー集団Qilin「AI利用で攻撃対象を毎週数百社へ増加」を明らかに／時間短縮し機密情報も速やかに送信か／個人情報大量流出
https://t.co/UiPvJCXL5T

[Josh Stroschein | The Cyber Yeti @jstrosch]

New episode of Behind the Binary is live!

🎙️Joined by @L0Psec to break down macOS security, ClickFix social engineering, InfoStealers (AMOS/MacSync), DPRK developer targeting, and the evolution of obfuscation.

Plus, we talk about how AI is shifting reverse engineering and the inevitable future state...

🎧 https://t.co/8SlDtgWs55

[Squiblydoo @SquiblydooBlog]

h/t @malwrhunterteam

Signed EtherRAT dropping signed StealC:
EtherRAT: 1b61b95a61996b44322e9841af2fa2b63fcdd18a569f16fa8acd30eb8d8ac854
Signer: "KARA-TASH I KO, OSOO"

StealC: 37d7a8c504227f9c1986619fd8148f1737cf94e56ac91687f8ba33be7e945f5e
Signer: "AirTiki ApS"

C2: presanis[.]com
Stealer Download: csg-soft[.]com / 45.135.180[.]185
StealC C2: glamour-studio[.]com / 194.11.226[.]153

[L0Psec @L0Psec]

Appreciate @jstrosch for the invite on the podcast! macOS malware is at an interesting place. Also, getting to talk about how reverse engineering workflows are changing with AI was fun/therapeutic. I wasn’t crying I promise. 😂

[Zr4l0cK @zr4l0ck]

@MSNightmare2000 do you have any write up?

[Zr4l0cK @zr4l0ck]

@eversinc33 lol :D

[Zr4l0cK @zr4l0ck]

@iamaachum https://t.co/jaKKQVM4h0

[Zr4l0cK @zr4l0ck]

@DarkWebInformer wow

[Zr4l0cK @zr4l0ck]

@ShadowOpCode @skocherhan @tobersotski @guelfoweb @AndreaDraghetti nice

[Zr4l0cK @zr4l0ck]

@Dinosn cool