So remember last week when we said we hadn’t see TA488/Laundry Bear/Void since Feb? Well... We kinda lied Day before the release, we found em throwing a half click against Outlook to install one of the coolest implants we’ve ever examined: OWAReaper www.proofpoint.com/us/blog/thre...

Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit | Proofpoint US

Threat Research would like to thank the Proofpoint Cloudmark Authority team for their collaboration. Key Findings On 22 July 2026, one day prior to Proofpoint’s recent joint release

proofpoint.com

Most exciting @threatinsight.proofpoint.com drop yet - in collaboration with NSA - and the product of @greg-l.bsky.social's blood, sweat, and tears. Research into two Russian actors throwing half-click exploits against mailservers. Part 1 on TA488 / Void Blizzard www.proofpoint.com/us/blog/thre...

TA488 Targets Zimbra Mailservers with Half-Click Exploits | Proofpoint US

Proofpoint is releasing this report in coordination with NSA and FBI’s JSAC reporting about TA488/Void Blizzard, which can be found here. This is part 1 of a 2-part blog series Proofpoint is

proofpoint.com

I am honored to share the 2026 Pulitzer Prize for Best International Reporting with Dake Kang, Byron Tau, Aniruddha Ghosal and Garance Burke for our reporting revealing how Silicon Valley largely designed and built China's surveillance state and enabled human rights abuses.

On this day 35 years ago, HEIR TO THE EMPIRE was released

Dodgers broadcast was discussing the science behind the perception of time between children and adults. After hearing the explanation, the color commentator pauses and asks, "Am I gonna feel any better?" Andy Pages then smashes a dinger into space, thus ending the existential crisis on commentary.

So @xorhex.bsky.social asked (in our YARA keybase chat) how one might only iterate through the last 10 matches of a string in YARA. I took a shot at answering it by logging the last 10 locations of a match in descending order: for all i in (0..10): (console.log(@a[#a - i]))

After 11 years of silence at Black Hat, I am delivering a speech today. In memory of a legendary APT Hunter, Mr Sergey Mineev, who passed away 40 days ago. If you cannot attend, here is the write-up: www.sentinelone.com/labs/fast16-...

fast16 | Mystery ShadowBrokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet

A previously unknown 2005 cyber sabotage framework patches high-precision calculation software in memory to silently corrupt results.

sentinelone.com

After 11 years, I'm returning to the Black Hat stage. The last time, in 2015, I gave a joint talk with INTERPOL - their first-ever appearance at Black Hat. If you're around, come support me tomorrow - I promise the talk goes well beyond what you'll find in the abstract.

PEMDAS, but for the correct order to eat fruit snacks

Easter dinner was a movie (a delicious Dune knock off)

#binjaextras has been updated to allow for type information to be applied to both struct members and global variables. Local instance of OALab's hashdb has been added as well - see setup info here: github.com/xorhex/binja... Install/update binjaextras via the plugin manager! #BinaryNinja

This is what happens when I take time off, I actually write silly length blog posts and deep dive things blog.zsec.uk/bullyingllms/ the post dives into a MCP pipeline I've put together for autonomous 0day hunts.

Autonomous Vulnerability Hunting with MCP

Alt title: Bullying LLMs into submission to find 0days at scale

blog.zsec.uk

RationalEdge #REDS new release: Maliciousness #Score, #AI Assisted Full Sample Analysis, and a new #Behaviour Panel. rationaledge.io/blog/malicio... @rationaledge.bsky.social #ThreatResearch #ThreatIntel #CTI #Malware #MalwareAnalysis #ReverseEngineering 1/4

Proofpoint has directly observed a targeted email campaign that delivers DarkSword RCE, and we attribute the messages to Russian FSB threat actor TA446 with high confidence. 🧵

I’m not interested in skinny propaganda in any form I was on board when Oprah was built up like a Baltimore row house

Them Europeans cannot be your standard for beauty… they almost died because they wouldn’t wash their hands

Bam Adebayo is doing WHAT right now???

📣 #PIVOTcon26 Agenda is here 🤟 We are thrilled to announce the lineup for this year's edition! 2⃣ days and 19 talks from leading #ThreatResearch experts. The agenda link is in the first comment👇, and the talks and speakers are in the thread.🧵 #CTI #ThreatIntel 1/15

Can someone smarter than me tell me if the cyber strategy for america from the regime means anything for me personally?

Christopher Kempczinski bit into that burger like it was the first time he'd every tasted a McDonalds burger AND... This is actually a case study on how American companies no longer promote within

Since things are #rough out here right now, I figured I’d share a fun story Back in the early 00’s, my uncle worked at some manufacturer that sponsored a bunch of NASCAR cars and would regularly get tickets to the events

a race car is driving down a track with spike written on the bottom of the screen

ALT: a race car is driving down a track with spike written on the bottom of the screen

media.tenor.com

Staying off socials to keep my mentals in order but had to come in here to say that I’m certain Bad Bunny had more yards from scrimmage than the Pats in that first half

#BREAKING #ESETresearch identified the wiper #DynoWiper used in an attempted disruptive cyberattack against the Polish energy sector on Dec 29, 2025. At this point, no successful disruption is known, but the malware’s design clearly indicates destructive intent. 1/5

You fear innovation

Lord Baldemort@solochills.blacksky.app · 7mo ago

Ok but I'm still not trusting The Horny

"A superpower is choosing to self-immolate and torch its remaining global trust and friendships, including and especially NATO...at the precise moment when it had been reinvigorated and renewed...in the wake of Russia’s large-scale invasion of Ukraine in 2022" - by @vermontgmg.bsky.social

We Are Witnessing the Self-Immolation of a Superpower

With Donald Trump’s actions in Greenland, Minneapolis, and Venezuela, a foreign enemy could not invent a better chain of events to wreck the standing of the United States.

wired.com

They have quite an operation going. www.mprnews.org/episode/2026...

Minneapolis church has delivered more than 12,000 boxes of groceries to families in hiding

DHH church has hundreds of volunteers packing and delivering groceries to families who have been too scared to leave their homes during the immigration operation.

mprnews.org

I don’t think we’ve collectively paid enough attention to the fact that Annie’s is now the regent of boxed Mac and cheese Kraft got their chain snatched and now it just tastes like dog water compared to Annie’s

#100daysofYARA - day 12 VirusTotal uses CAPE sandbox to identify many malware families and determine if they can extract the malware's configuration. Since they use CAPE, we can often see their logic. Today, we'll suggest edits to a rule for AgentTesla. Rule at end. 1/10

Imagine publishing a blog on "Lazarus" in the year of our lord 2026

#100DaysofYARA - Day 11 In looking at automatic YARA generation, yarGen-Go is a must. Just released by @cyb3rops, it is a rewrite and advancement from the original yarGen. We'll look at the same malware from day 10; a targeted HavocC2 loader with decoy. rule at bottom 1/5