So remember last week when we said we hadn’t see TA488/Laundry Bear/Void since Feb? Well... We kinda lied Day before the release, we found em throwing a half click against Outlook to install one of the coolest implants we’ve ever examined: OWAReaper www.proofpoint.com/us/blog/thre...

Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit | Proofpoint US

Threat Research would like to thank the Proofpoint Cloudmark Authority team for their collaboration. Key Findings On 22 July 2026, one day prior to Proofpoint’s recent joint release

proofpoint.com

1/ Today @milenkowski.bsky.social from @sentinellabs.bsky.social and I are publishing a project we've been working on over the past few months. We found suspected China- and India-linked espionage actors independently targeting the same victim: #Balochistan Police in #Pakistan. s1.ai/spy2flags

I'll be teaching an online edition of my Advanced Linux Malware Reverse Engineering training across 6 days July 20th-22nd, and 27th-29th, and have a small contingent of seats still available - more info and registration here: docs.google.com/forms/d/e/1F...

Colleagues of mine at Insikt Group just released new research on the Iran-nexus cluster #TAG-182, deploying #MarkiRAT, a malware family previously observed in use by #FerociousKitten, for internal and external surveillance: www.recordedfuture.com/research/nex...

Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool

Discover how Iranian-nexus threat cluster TAG-182 uses MarkiRAT malware and fake VPN/media apps to conduct cyber surveillance operations against domestic targets.

recordedfuture.com

Suspicious domain ms365update[.]com was registered through MonoVM on 6/22/26 using juliarhorton@onionmail[.]org (H/t @domaintools.bsky.social). Today the domain began using Cloudflare and its subdomain www.ms365update[.]com now redirects to Google DNS.

github.com/VirusTotal/y... This fixes an issue with certain header constraints that you really should update for. There are other nice bug fixes and features too, but the header constraints is a big one.

Release v1.19.0 · VirusTotal/yara-x

Add missing machine architecture types to pe module (#687). Add warning for single-byte patterns (71baa67). Add warning for duplicate patterns in a rule (9061803). Small optimization when generatin...

github.com

The slides from our @reconmtl.bsky.social talk with @nicolo.dev on agentic deobfuscation are now online. Topics: commercial VMs, anti-cheat, DRM systems, malware, and anti-agentic obfuscation. Slides: synthesis.to/presentation...

My name is Daniel Gordon and I am writing to let you know that you have a serious problem. Next week I will be speaking at FirstCon about The Art of Notification. Distilled lessons learned from hundreds of victim notifications I’ve done over the years. www.first.org/conference/2...

38th Annual FIRST Conference: DENVER (US), June 14-19, 2026

38th Annual FIRST Conference - Denver (US), June 14-19, 2026.

first.org

@volexity.com has published details from an incident response engagement in September 2025 involving multiple #BRICKSTORM variants deployed by a threat actor that Volexity tracks as VerdantBamboo. [1/4]

VerdantBamboo: Just Another BRICKSTORM in the Firewall

In September 2025, Volexity conducted an incident response engagement that began after suspicious network traffic was observed from a Linux-based virtual machine appliance on a customer’s network. The...

volexity.com

See you at RustConf! :D

RustConf@rustconf.com · 2mo ago

Speaker Spotlight: Cindy Xiao, Security Researcher @ DecoderLoop Rust malware is rising & reverse engineers are scrambling. On Sept 9, Cindy surveys the '26 landscape: techniques, tooling gaps, & how to teach RE in a Rust world. Schedule: sched.co/2KHt7 Register: bit.ly/4eUTQ1g #rustconf

#PIVOTcon26 edition is over! Time to #pivot to #PIVOTcon27 Big thanks to our sponsors for making this happen! @silentpush.bsky.social @vertexproject.bsky.social @censys.bsky.social @urlscan-bot.bsky.social #validin @talosintelligence.com (continued...) 🔽 1/3

Very excited to present at RustConf this year! :D

RustConf@rustconf.com · 3mo ago

The growth of Rust has led to an increase in legit software targets to examine for vulnerabilities AND an explosion in malware written in Rust. @cxiao.net will be exploring this in “Reverse Engineering Rust Malware in 2026” @ #rustconf. View on schedule: sched.co/2KHt7 Register: bit.ly/4uB95Ru

Its been two weeks since (my workshop at) @botconf.infosec.exchange.ap.brid.gy 2026, and last weekend I found some time to write about my experience: maxkersten.nl/2026/04/27/m...

The debugger got some real love in our latest update. Hardware breakpoints and conditional breakpoints have both landed, and the new debug adapters make things faster and more reliable across a range of workflows. Read more from the latest blog: binary.ninja/2026/04/13/b...

CertGraveyard's PKI Lab is available now. Want to better understand code-signing certificates? The site allows you to extract and view certificates. The Cert Inspection tool parses out all of the bits and flags anomalies. 1/2

So @xorhex.bsky.social asked (in our YARA keybase chat) how one might only iterate through the last 10 matches of a string in YARA. I took a shot at answering it by logging the last 10 locations of a match in descending order: for all i in (0..10): (console.log(@a[#a - i]))

MalChela 3.2: More Cowbell? More Intel! One of the things I value most about the open-source community is that the best improvements to a tool often don’t come from inside it — they come from outside conversations.  A short while back, the author of mlget, xorhex,  reached out and suggested I add…

MalChela 3.2: More Cowbell? More Intel!

One of the things I value most about the open-source community is that the best improvements to a tool often don’t come from inside it — they come from outside conversations.  A short while back, the author of mlget, xorhex,  reached out and suggested I add more malware retrieval sources to FOSSOR, one of my earlier tools for pulling down samples from threat intel repositories.  

bakerstreetforensics.com

For the few people using #BinYars, it has been updated to support #BinaryNinja 5.3 and now targets YARA-X 1.15.0 Update via Binja's plugin manager to get the latest. github.com/xorhex/BinYa... #YARA #YARAX

GitHub - xorhex/BinYars-SideWidget

Contribute to xorhex/BinYars-SideWidget development by creating an account on GitHub.

github.com

Binary Ninja@binary.ninja · 4mo ago

Binary Ninja 5.3 (Jotunheim) is released: binary.ninja/2026/04/13/b... Major updates: NDS32 support, AArch64 ILP32 ABI, new Universal MachO UI, way more containers, command palette upgrade, type library helpers, ghidra gzf export, updated IDB import, HW and conditional breakpoints, and much more!

JSAC 2026 videos: www.youtube.com/playlist?lis... NDSS 2026 videos: www.youtube.com/@NDSSSymposi...

Binary Ninja 5.3 (Jotunheim) is released: binary.ninja/2026/04/13/b... Major updates: NDS32 support, AArch64 ILP32 ABI, new Universal MachO UI, way more containers, command palette upgrade, type library helpers, ghidra gzf export, updated IDB import, HW and conditional breakpoints, and much more!

Binary Ninja - Binary Ninja 5.3 (Jotunheim)

Binary Ninja is a modern reverse engineering platform with a scriptable and extensible decompiler.

binary.ninja

REWorkshop - Axios supply chain attack retrospective 🔔 twitch.tv/azakasekai 🔔 youtube.com/live/RxeAPsO...

It’s trite but this marks the dawn of a new era of hacking. This is Pandora’s box and we just have to hope that some of the defender benefits outweigh the bad. These are the technical details of the hack of the government of Mexico using AI. cdn.prod.website-files.com/69944dd945f2...

📣 Our own @cxiao.net will be speaking at @rustconf.com this year, with the talk "Reverse Engineering Rust Malware in 2026"! sched.co/2KHt7 Rust is now a popular language not only for writing legitimate software, but also for writing malware. How are malware reversers dealing with this? #RustConf

#binjaextras has been updated to allow for type information to be applied to both struct members and global variables. Local instance of OALab's hashdb has been added as well - see setup info here: github.com/xorhex/binja... Install/update binjaextras via the plugin manager! #BinaryNinja

The history of BumbleBee's relationship with certificates can be viewed a few ways with CertGraveyard. You can review via a table, a graph, or download the whole database to transform the data yourself. 4/4

Two for one today! Added support for console.log(offset, length) to the console module in YARA-X, per the suggestion of a user. Makes it nicer to work with arbitrary sequences of bytes. Hopefully it makes it in the next release!

two men are standing next to each other and one of them is wearing a shirt that says nuts

ALT: two men are standing next to each other and one of them is wearing a shirt that says nuts

media.tenor.com

New: Group member labels, a way to describe yourself or your role in a group chat, only visible to that group chat. Label yourself the “Goalie” to your soccer team or “Favorite Child” to your family to stir some drama. Available on Android, Desktop & iOS signal.org/blog/group-m...

Label yourself

We all take on different roles in relation to our friends, neighbors, family members, and colleagues. Keep those different roles clear in your many Signal group chats by using group member labels, now...

signal.org