Hot on the heels of the researched published by @huntress.com, hunting for Zoom-themed lures from DPRK's #BlueNoroff 💥Learn hunting techniques 💥Leverage new Validin features and data 💥Full, unredacted indicator list (domains, IPs, hashes) www.validin.com/blog/zooming...

Zooming through BlueNoroff Indicators with Validin | Validin

Pivoting through recently-reported indicators to find BlueNoroff-associated domains

validin.com

excited bc today @huntress.com is releasing our analysis of a gnarly intrusion into a web3 company by the DPRK's BlueNoroff!! 🤠 we've observed 8 new pieces of macOS malware from implants to infostealers! and they're actually good (for once)! www.huntress.com/blog/inside-...

Inside the BlueNoroff Web3 macOS Intrusion Analysis | Huntress

Learn how DPRK's BlueNoroff group executed a Web3 macOS intrusion. Explore the attack chain, malware, and techniques in our detailed technical report.

huntress.com

finally got around to rewriting the copy as yara binja plugin! 🥰 has a few quality of life improvements (new formats) and address wildcarding is fixed for ARM! (sorry bout that mac homies) ❤️ it's also now available in the plugin repository! 🔥 github.com/ald3ns/copy-...

CVE-2025-2825 or CVE-2025-31161: A vulnerability by any other name is still a threat 😇: We've updated the blog to reflect some new attacker tradecraft observed yesterday cc @huntress.com @re.wtf @johnhammond.bsky.social #DFIR #vuln #CVE www.huntress.com/blog/crushft...

pwning my FTP server is a weird way to say you have a Crush on me but okay 🥰 anyways check out our analysis of some CrushFTP CVE-2025-31161 post exploitation activity! www.huntress.com/blog/crushft...

Published some new research on how RMMs are taking over as a first-stage payload www.proofpoint.com/us/blog/thre...

Remote Monitoring and Management (RMM) Tooling Increasingly an Attacker’s First Choice | Proofpoint US

Key findings    More threat actors are using legitimate remote monitoring and management (RMM) tools as a first-stage payload in email campaigns.  RMMs can be used for

proofpoint.com

nightmare blunt rotation

BREAKING: DOGE has uncovered that the CIA spent $10,000,000 on zyns and has been feeding them to analysts to increase productivity! 😱

our network has raised hundreds of dollars to give firefighters the zyn they need to keep protecting LA from the fires. Thank you!!

reminder to say happy new years to the russian espionage groups in ur network 🥰🇷🇺 @nosecurething.bsky.social, @laughingmantis.bsky.social, and I just dropped a new blog detailing a series of redcurl intrusions across several huntress customer environments 😳 www.huntress.com/blog/the-hun...

Hunt for RedCurl | Huntress

Huntress discovered RedCurl activity across several organizations in Canada going back to 2023. Learn more about how this APT operates and how they aim to remain undetected while exfiltrating sensitiv...

huntress.com

#100DaysofYARA day 1 - the Amos stealer is regularly evolving and updating its obfuscation techniques You know what isn't changing? the dylibs it depends on and the entitlements it requests from the OS. Combined, they give us excellent signal github.com/100DaysofYAR...

Binary diff'ing is hard. But it's super powerful to apply markup from previous reverse engineering efforts to a new binary. Binary Ninja is switching up how they match function signatures with WARP. www.seandeaton.com/binary-ninja... #binaryninja #reverseengineering #ghidra #ida #decompiler

Trying Out Binary Ninja's new WARP Signatures with IPSW Diff'ing

Binary diff'ing is pretty complex, but being able to apply markup from one binary to another is quite powerful. Binary Ninja's new WARP extends previous efforts, using SigKit, to quickly identify libr...

seandeaton.com

i gotta step up my whitepaper game smh, my dad is doin numbers

Craig Schmidt@craigschmidt.com · 2y ago

I really enjoyed #EMNLP2024. It was an honor to present our tokenization paper aclanthology.org/2024.emnlp-m.... I’m planning to post about some of my favorite papers soon, but here is a nice write up.

Our talk from @objective-see.bsky.social is now available online. Check out @re.wtf and I yap about macOS infostealers. www.youtube.com/watch?v=Hv6A...

#OBTS v7.0: "Stealer Crossing: New Horizons" - Alden Schmidt & Stuart Ashenbrenner

YouTube video by Objective-See Foundation

youtube.com

since I'm cold and missing #OBTS I wanted to reflect on what @jacoblatonis.me and Tomas have gifted us with the YARA-X Macho module the OG YARA macho parsing left a lot to be desired, and the new YARA-X ver has all sorts of goodies

this holiday season

following the recent cleo ITW exploitation, @huntress.com has released our analysis of the full post exploitation chain 🚀 the final java based implant framework is really neat and includes a custom C2 protocol 🔥 huntress.com/blog/cleo-soft…

hotties only want one thing and its the operation triangulation exploit chain

aaron@aaron.cat.gf · 2y ago

blunt versus beauty

Yesterday I got to present with the 🐐 @re.wtf. Such a blast talking thru infostealers and the telenovela that they’ve become. #OBTS really is the best, chillest conference out there. Excited for a second day of talks 🤓🍎

🍎🤝🔥

Jacob Latonis@jacoblatonis.me · 2y ago

@re.wtf 🐐 @stuartjash.bsky.social 🐐

we cookin' for #100DaysofYARA 🤝🔥

Steve YARA Synapse Miller@stvemillertime.bsky.social · 2y ago

Binary Ninja plugin for copy and pasting bytes into YARA friendly format, courtesy of @re.wtf github.com/ald3ns/copy-... Rumor has it there's a next-generation version in the works that will probably blow your mind.

How does the new iOS inactivity reboot work? What does it protect from? I reverse engineered the kernel extension and the secure enclave processor, where this feature is implemented. naehrdine.blogspot.com/2024/11/reve...

Reverse Engineering iOS 18 Inactivity Reboot

Wireless and firmware hacking, PhD life, Technology

naehrdine.blogspot.com

🧵Today’s blogpost focuses on a newer ransomware variant named SafePay. Needless to say, ransomware sucks. When this new variant appeared, it gained our attention. 👀 Let’s dig into what happened and what makes it tick ⬇️:

I wrote a post on the realities of cloud & webserver ransomware. Check it out to see some of the toolsets & frameworks that can be used for these attacks.

Phil Stokes ⫍🐠⫎@philofishal.bsky.social · 2y ago

🔥 In a report on the state of cloud ransomware, @alex.leetnoob.com has identified several tools designed to target web servers with ransomware or to leverage cloud services to upload files before encrypting local files on an endpoint. s1.ai/cloud-rw

some huntress homies cooked a blog on a new ransom group called safepay RE was fun until we realized it was ripped lockbit code 💀😭 imagine not being able to write your own ransomware, true skill issue smh some funny opsec fails too, watch ya status www.huntress.com/blog/its-not...