malware detection and analysis, hunting and gathering, threat research. Views are my own. https://xitter.cf/t.co/efJDIXnaLi
United States
Joined August 2012
- Tweets2.5K
- Following561
- Followers258
- Likes7K
Drew retweeted
Spent the last few days wishing that DnSpy had an MCP with debugger support, and turns out LLM's can just build that in ~20 minutes if you give it the github repo and a decent spec on what you want.
Opus was largely able to one shot the entire mod, and GLM5.3 was able to drive it almost instantly without needing to add any skills.
The whole concept of vibe modding an existing tool never really crossed my mind before, but now i'm all here for it.
Drew retweeted
The latest episode of Behind the Binary is live!
We’re diving into everyone's favorite topic—binary similarity—joined by Jonas Wagner and Endre Bangerter from @threatray.
🎧 open.spotify.com/episode/2nm…
Drew retweeted
In addition to dropping long form deep research on threats or highlighting novel attack chains/campaigns I think its important to remember that threat actors are regularly leveraging known tools. As such its easy to lose sight that an intrusion set doesn't have to be comprised of novel/sophisticated elements to be worth monitoring and proactively protecting your org from.
That is part of what inspired the Threat Overview series. Previously I've dropped primers on AsyncRAT, Remcos, and others. Today's drop is about Mythic C2.
censys.com/blog/mythic-c2/
Check it out!
Drew retweeted
This is important. This isn't just distillation. This is fraud. @Kimi_Moonshot (aka GTG-16002)
Great info here from @craiu !
Wrote a short post on my experience running GLM-5.3-Flash, DeepSeek 4 Flash, and Qwen-3.8-Next locally.
Which is the best all-around local model for CTI workflows?
medium.com/@costin.raiu/top-…
Drew retweeted
Wrote a short post on my experience running GLM-5.3-Flash, DeepSeek 4 Flash, and Qwen-3.8-Next locally.
Which is the best all-around local model for CTI workflows?
medium.com/@costin.raiu/top-…
Drew retweeted
Do you like local AI models? The model that is best for Joe may not be the best for you. My totally unscientific top 10 based on evaluating the quorum on cyber threat intel workflows from last week between various models.
Drew retweeted
The recording of "Deobfuscation in the Age of Agentic Reverse Engineering" is now public:
youtube.com/watch?v=3-gJ6EUF…
We (CC @nicolodev) show how to use agents to break protections found in anti-cheats, DRM systems & commercial protectors.
Slides: synthesis.to/presentations/r…
Drew retweeted
We just put out some new research on #PackClient, a #RAT framework that's being marketed to Chinese-speaking threat actors and is being used by at least one of the Chinese-speaking actors we track. 😎
Proofpoint has observed a Chinese-speaking threat actor (TA4922) using a command and control (C2) framework called PackClient.
The framework enables data theft, surveillance, and downloading of additional plugins and payloads.
Blog: proofpoint.com/us/blog/threa…
#phishing #emailrisk
ALT TA4922 phishing email impersonating the Shandong Provincial Tax Bureau using a tax inspection notice lure.
Drew retweeted
The timer for #flareon13 started on flare-on.com
I will likely participate, but not sure I will try to speed-solve it like previous years.
Last year was already somewhat pay-to-win. I expect this year to be worse. I don't see any fun in competing against unlimited AI
Drew retweeted
If you have a malicious sample in front of you during an active intrusion, spend 20-30 minutes on it.
I know the pull to dodge it - the timeline is on fire, EDR is throwing process trees at you, and grabbing the hash and outbound connections feels like enough.
But even where it recorded cleanly, process data only shows what ran on that host, at that moment, under those conditions.
The binary tells you what to go look for on disk, and half the time it's still sitting there (trust).
Thirty minutes of triage and the pieces start fitting together:
- Backup C2s that were never contacted because the primary was still up
- Drop paths and artifacts the sample writes that never generated an alert, but are still on the host if you know the filename
- Config strings and beacon patterns that tie this intrusion to prior activity
- Sandbox checks that explain why your detonation came back clean
- Conditional persistence
Drew retweeted
One of the coolest Reverse Engineering TTPs. Analyzing APT29's recurring phishing methodologies and provides practical, technical demonstration on how reverse engineers extracts and reverse engineered Commercial C2 to uncover its operational security flaws. Re by @ippsec
Drew retweeted
This is an interesting trend worth mentioning. People are processing threat intelligence blogs using AI and republishing summaries and often improved analysis with additional IOCs and YARA rules. These are not always good. 🧵
Drew retweeted
Is reverse proxy phishing slowly dying? 💀🎣
This is what I've been trying to find out during the past several months.
Major websites have caught up and vastly improved their security, successfully detecting malicious traffic originating from reverse-proxy phishing servers.
The attackers have changed their tactics and begun utilising a new method that involves using a real web browser to sign in on the phished user's behalf.
In the video I've just released, I am demonstrating a live demo of a modern phishing attack using the Credential Relay Phishing technique, which evades all current anti-phishing measures deployed against reverse-proxy phishing.
To simulate a phishing attack against a Google account secured with FIDO MFA, I am using the latest features of Evilginx Pro to downgrade the FIDO MFA to less secure & phishable MFA alternatives.
Additionally, the attack simulation employs a Browser-in-the-Browser social engineering technique to spoof the phishing URL in the address bar of the fake pop-up window, displaying the sign-in page.
Everything you see in the video is ready to use in the latest beta version of Evilginx Pro, available exclusively to vetted cybersecurity professionals working within cybersecurity companies or internal red teams.
Evilginx Pro's latest features include:
Phishlets 2.0: A complete rewrite of the old phishlets format now allows for modification of every part of HTTP traffic going through the reverse proxy server. The new format allows hosting of static website content utilising external modules such as Evilpuppet to simulate Credential Relay Phishing attacks.
Downgrading FIDO MFA: With the most recent implementation of Evilpuppet, it is now possible to control a separate background browser session and sign in on behalf of the phished user, allowing the attacker to be the one responsible for choosing which MFA method the user should authenticate with.
Browser-in-the-Browser: It is now possible to embed any phishing page within a fake browser pop-up window, rendered with JavaScript and stylised for the OS on which the page is displayed. This enables the construction of extremely convincing social engineering attacks, as the URL in the pop-up window can be spoofed to any value using legitimate hostnames.
If you want to use these features in your next red team engagement or assess your company's readiness against modern phishing attacks, make sure to give Evilginx Pro a try.
Hope you enjoy the video! 💗
Happy phishing! 🪝🐟
Kuba
Drew retweeted
The next episode of Behind the Binary is here! Jae Young Kim from FLARE/@Google joins me to discuss reversing modern languages.
open.spotify.com/episode/4BL…
We'll also chat about languages to keep on eye on, a deep dive into Go, and the role of LLMs.
Drew retweeted
Proofpoint has identified OAuth client ID spoofing emerging as a stealthy account enumeration technique targeting Microsoft Entra ID.
Attackers can validate usernames and infer credential validity, all without generating a successful sign-in event. proofpoint.com/us/blog/threa…
Drew retweeted
Anthropic to restore Claude Fable access on Wednesday
bleepingcomputer.com/news/ar…
bleepingcomputer.com/news/ar…
