Creative minds breaking your Apps. Our team of security experts will plan and execute controlled attacks and help you improve the security of your applications.
USA
Joined January 2011
- Tweets243
- Following200
- Followers212
- Likes167
¡Visítanos en nuestro booth para participar del desafío! Además, estaremos entregando stickers (que siempre son furor en la Eko 🐉✨) y otras sorpresas…
📍 Stand 31, Ekoparty Argentina
🗓️ ¿Estarás en la conferencia? Envíanos un DM y comencemos la conversación.
Acompáñanos para conversar sobre pentesting y, además, podrás llevarte nuestros stickers 🐉 y (spoiler) un preview gratuito de iPentest, nuestra herramienta de testing con IA, entre otras sorpresas…
🗓️ ¿Estarás en Buenos Aires la semana próxima? Envíanos un DM y conversemos.
The process involved bootloader analysis, runtime memory patching, Secure Boot bypass, and custom kernel image injection. None of these steps required chip-off, JTAG, or soldering beyond the UART connection itself.
👉 Dive into the full research: blog.kulkan.com/u-boot-as-an…
From that starting point, Nahuel analyzed thousands of packages from PyPi, NPM, and Rust Crates at scale, uncovering how this attack class works and reporting several vulnerabilities along the way.
👉 Dive into the full research: blog.kulkan.com/analyzing-gi…
Our team will be in Vegas connecting with security leaders and practitioners from the US and beyond, and of course, handing out free stickers to anyone lucky enough to cross our path! 🐉✨
Are you attending? Send us a DM and let's connect.
About Kulkan: kulkan.com/?utm_source=X&utm…
The article walks through the actual vulnerability, the class of bug it belongs to, and builds a reproducible PoC that recovers the contents of small files by brute force, without ever attacking the password.
👉 Dive into the full research: blog.kulkan.com/cve-2026-447…
Matias walked through capturing the signal with an RTL-SDR, decoding the protocol, and crafting arbitrary frames with a HackRF One.
Want to see how you can inject arbitrary readings with just an SDR, and a bit of patience bruteforcing the Device ID?
👉 medium.com/@kulkan-security/…
Announcing our second talk at @ekoparty Miami! 🎙️🛡️
@veryhumansortof will break down how a single misplaced operator silently broke encryption in a library recommended by frontier LLMs, and why every SAST tool missed it.
🗓️ May 22, 1:40 PM
📍 Sponsor Track
Let's connect! 💪
Kulkan takes the stage at @ekoparty Miami! 🎙️🛡️
Matias Fumega will be diving into hardware security and showing how smart devices in your home are more vulnerable than you think, using nothing but cheap tools and open-source software.
Learn more. 👇
🤖 Made with AI
The challenge is officially closed. 🔒
We want to congratulate everyone who cracked it, and thank all those who had the honor of meeting Eliza!
Soon we'll be announcing the winners for the conference tickets for @ekoparty Miami. 🎟️
Stay tuned!
The leading LATAM cybersecurity conference is writing a new chapter, heading to the U.S. for the first time. 🚀🇺🇸
And guess what? Kulkan is bringing the offensive security expertise with it, participating as an official sponsor. 🛡️
@ekoparty
Kulkan is sponsoring Ekoparty Miami 🛡️🇺🇸 and we're giving away free tickets for the conference.
Guess which AI model is running our modernized ELIZA, and you could be joining us! 🎟️
Winners will be contacted by email.
How to start participating? 👇
What started as a curiosity exercise ended with full device impersonation over MQTT.
The target: a Govee H8630 smart display sitting on your desk.
Here's how Matias Fumega (Security Consultant at Kulkan) got there.
Opening thread. 👇
🤖 Made with AI
Want to learn how a curiosity exercise turned into a full device impersonation primitive?
👉 Dive into the full research: blog.kulkan.com/breaking-int…
💡 Start validating your infrastructure with the latest industry standards. Check out the full technical breakdown and the open-source tool by Serafin Cepeda here: blog.kulkan.com/mxchecksec-v…
Email security is often a "set and forget" task until a security incident takes place. 🛡️📧
Serafin Cepeda has developed MxCheckSec to simplify the validation of SPF, DKIM, and DMARC records to ensure a secure email setup.
How does it work? 👇🧵
💡 The research focuses on how AitM attacks work, how Evilginx tries to stay hidden, and how we can detect and disrupt these campaigns in the wild.
👉 Read the full article here: blog.kulkan.com/see-no-evil-…
Ready to run Cisco’s latest security model on your own hardware? 🚀
💡 Check out the full technical breakdown and the DIY guide to running Foundation-sec-8B-Reasoning in Ollama here: blog.kulkan.com/how-to-run-c…
