Security Researcher, Creating and Sharing Educational Content.
Australia
Joined July 2022
- Tweets1.2K
- Following1.8K
- Followers14.7K
- Likes3.2K
Pinned Tweet
A Beginners Guide to Tracking Malware Infrastructure
New post with 11 Examples (Including Cobalt Strike and Qakbot) that you can use to query and track C2’s, Open Directories and More🔥
(Special thanks to @censysio 🥳)
censys.com/a-beginners-guide…
#threatintel #malware
Average day working with "Frontier" LLM's...
Summarising a technical blog (that itself looked AI written) is apparently a no-no now 😅
Testing out more vibe coded mods to URLScan to see how helpful a local LLM can be for augmenting threat research.
Goals: keep it local, keep it helpful, and keep it reasonably not annoying or intrusive to use.
These are some mods that have worked so far and currently functional.
Summarise search results.
Reviews search results, including the individual scans and provides a summary, with highlights and colouring to steer towards "interesting" and "live" results (eg away from Cloudflare errors and otherwise "dead" responses).
Review and summarise contacted files.
Once an individual scan result is opened, mod auto reviews all contacted files and bubbles up "interesting" results worth further review. Saves you manually going through 50+ filenames.
- Same concept for links and redirects tab. Summarises, filters, bubbles up anything spicy.
Hover menus for everything
Reviews pages without you needing to click on them. Most results come back in a few seconds and show entirely in the hover menu.
Filenames - Hover over specific filenames to kick off a review in the background. Checks the files prevalence and determines how it relates to the context of your scan result.
Scan Results - Hover over a scan result to see a screenshot and a basic review. Similar concept, hovering kicks off api calls in the background and returns a summary for you. Takes context into account.
Natural Language Chat
Very early prototype, lets you skip query languages entirely and interact completely through natural language. Chats go through a strands harness connected to skills, urlscan API and a local LLM. All analysis, reviews and pivots go through natural language.
Side Notes
All of this is a bit funky and far from perfect, though the idea that you can vibe this into a fairly functional state is pretty wild. Connectors and code were mostly written by Claude/Fable, then handed off to a spark running GLM5.3 for execution. Analysis and writing skills alongside a few context reduction techniques (one urlscan scan result can be ~40K tokens) have been built manually so far.
Still plenty of work to do but the concept is promising.
Indicators borrowed from recent posts by @Malwarehunterr
The GLM setup i'm using is from this site, with special thanks to @MiaAI_lab for the recipe and @ashxhart for his work on tensorfold.
This is by far the best local model i've used, both in speed and intelligence. Feels roughly in line with Opus ~4.6/4.8.
mia-ai.net/models/GLM-5.3-Fl…
Spent the last few days wishing that DnSpy had an MCP with debugger support, and turns out LLM's can just build that in ~20 minutes if you give it the github repo and a decent spec on what you want.
Opus was largely able to one shot the entire mod, and GLM5.3 was able to drive it almost instantly without needing to add any skills.
The whole concept of vibe modding an existing tool never really crossed my mind before, but now i'm all here for it.
Matthew retweeted
If you're into malware analysis, reverse engineering or threat intelligence, bookmark this.
@embee_research has built an incredible FREE archive of practical security research covering:
• Ghidra + x64dbg
• Malware unpacking + shellcode
• Cobalt Strike analysis
• API hashing + string decryption
• PE-bear + Dumpulator
• .NET malware + dnSpy
• CyberChef + Python deobfuscation
• YARA + Sigma
• Qakbot, IcedID, AgentTesla, DarkGate + more
• Passive DNS + infrastructure hunting
• Censys / FOFA pivots
• APT infrastructure tracking
• URL hunting
• Module stomping + API hash evasion
A lot of this is hands-on research using real malware samples, not just theory.
Also includes deep dives into campaigns like SideWinder and Gamaredon infrastructure hunting.
Main site:
embeeresearch.io/
Full archive:
embeeresearch.io/index/
Huge credit to fellow Australian @embee_research / Matthew for making this research publicly available.
#MalwareAnalysis #ReverseEngineering #ThreatIntel
First time experimenting with entirely local LLM's and reverse engineering work, and fairly impressed with the initial results.
Qwen3.8-Flash-Next (@MiaAI_lab's recent Tensorfold recipe) and the @malcat4ever MCP made short work (~2 minutes on a DGX spark) of an old CS shellcode without any skills or specific prompting.
The sample is admittedly simple, and frontier models handle it with ease, though seeing this all driven entirely locally is a cool experience.
More to come as I work out which harnesses, model recipes and MCP's work best for this kind of thing.
Threw in a slightly bigger (though still simple) CS sample and it blitzed through. C2 lines up with the one shown in VT. It worked out to use x64dbg and sogen to validate it's findings.
I haven't validated everything and i'm sure there's an error in there, though i'm still very impressed with this coming from an open model on consumer hardware (Single DGX Spark).
Both speed and intelligence feel in line with that of Opus from ~6 months ago.
Matthew retweeted
Using Ghidra in malware analysis.
Manual identification, decryption and fixing of encrypted strings of Vidar Malware sample.
A post by Matthew (@embee_research).
Source: embeeresearch.io/ghidra-basi…
#redteam #blueteam
Matthew retweeted
I want to share a quick thought for people in cyber security. This will be my longest tweet ever.
I’ve spoken to many lately who are having an existential crisis from the constant posts about “the end of cybersecurity jobs.”
Yes, things are changing quickly. This is a significant moment for the tech industry. Change can be uncomfortable. But we’ve seen cycles like this before.
• When GitHub and open source took off, people said software engineers would disappear because code was free.
• When AWS and cloud computing emerged, people said infrastructure jobs would vanish.
• When fuzzing and SAST tools improved, people said vulnerability research would disappear.
• Virtualization would eliminate infrastructure jobs.
• Mobile computing was going to end desktop dev.
• Exploit mitigations would end exploitability. It didn't.
Each time automation improved, the amount of software grew faster than the automation. It does feel "different" this time as it's explosive.
Some roles will shrink:
• repetitive pentesting
• basic vulnerability scanning
• tier-1 SOC monitoring
But other areas are expanding rapidly:
• AI system security
• supply chain security
• identity architecture
• autonomous agent security
• critical infrastructure protection
Historically, every time we eliminate one class of bugs, new classes emerge. Right now people are vibe-coding entire systems, giving AI access to their machines, crossing trust boundaries, and deploying autonomous agents with excessive permissions. The legal and regulatory world is nowhere close to ready.
There will absolutely be new failure modes. Humans are amazing and always adapt, finding new ways to do things.
The worst thing you can do right now is fall into a doom loop.
...and I’ll be honest, I too have felt the "psychological paralysis" a few times thinking, “Is this time different?” It's especially impactful when it comes from someone I respect in the community. There are certainly unknowns, in an industry where we've become accustomed to predictability.
But... the majority of those reactions are usually driven by social media, not reality. Platforms like X reward engagement, and sensational doom posts spread faster than measured thinking.
If you see something like:
“Holy #$%^! Opus 66.6 just found every bug in Chrome and replaced 50 startups!”
…mute it and move on.
Instead:
Stay curious.
Learn the new technology.
Adapt your skillsets.
Build things.
We’ll get through this transition the same way we always have. If I'm wrong then Sam Altman better be right about UBI! :) I'm sure that if this tweet gets any engagement that I'll get some heat for it, but a good friend of mine reminds me often to focus on what you have control over. I'll revisit this tweet at DEF CON 40!
Matthew retweeted
New blog: Using LLMs the right way for malware analysis
💡Tips for building an autonomous AI analysis lab on a 12 yo laptop and getting stuff done faster without loss of accuracy.
blog.gdatasoftware.com/2026/…
Matthew retweeted
For those looking to learn more about malware analysis / RE, here's a great guide for analyzing shellcode via Ghidra:
"How to Use Ghidra to Analyse Shellcode and Extract Cobalt Strike Command & Control Servers" embeeresearch.io/ghidra-basi…
#MalwareAnalysis #ReverseEngineering
Decoding a basic obfuscated script with #Cyberchef 😁
This time we're using a register and capture group to automate a find/replace, ultimately base64 decoding the result to find #malware/downloader code.
Matthew retweeted
WTF, wow, @washi_dev and @elektrokilldev are cooking 💙💙💙🙏🙌
Lot of improvements in #dnSpyEx #dnSpy. The newly added feature showing searchable string references in module is insane good and cool 👍💪
Its soooo cooool 😍 #dotnet #reversing
github.com/dnSpyEx/dnSpy
Quick walkthrough using CyberChef to decode a short .hta script from Malware Bazaar.
1. Extract encoded text using capture groups
2. Remove whitespace added by Cyberchef
3. Base64 decode the results
Sample: bazaar.abuse.ch/sample/198aa…
#malware #cyberchef
Matthew retweeted
Ever lost track of short-lived malware processes?
Use ProcMon Process Tree to catch even exited Processes + cmdline.
1. Start capture
2. Run sample
3. Hit Ctrl+T -> full tree, even the gone ones
🚀 Bonus: Right-click root -> "Add Process & Children to Include" to cut noise.
ALT ProcMon Sysinternal tool for malware analysis
ALT ProcMon Sysinternal tool for malware analysis