And #FlareOn12 Task 8: wp.me/p2mVNF-2Qf

Long overdue, but here’s my writeup for #FlareOn12 Task 9: hshrzd.wordpress.com/2025/11/20/f...

Heeey, ncurses/terminfo has a small virtual machine! And if there's a VM, there are CTF challenges :) hackarcana.com/public-exerc... hackarcana.com/public-exerc... (third one coming next week, will be a bit harder)

The 13th annual @volatility #PluginContest is OPEN for submissions until 31 Dec 2025! This contest is designed to encourage research & development in the field of #memoryanalysis. Every year, contributions from all around the world continue to help build the next generation of #memoryforensics.

-iOS 26 change deletes clues of old spyware infections -Starlink disables 2.5k scam compound terminals -Caribbean hospital still down 5 months after ransomware attack -Poland charges officials in Pegasus scandal Newsletter: news.risky.biz/risky-bullet... Podcast: risky.biz/RBNEWS495/

Today I'm launching my new app, Hacktivate. It teaches real-world computer science skills through 240 "capture the flag" challenges, and works on iPhone, iPad, and Mac with one purchase. I've poured a ton of love into it, and I'd love to hear what you think 🙌 apps.apple.com/gb/app/hackt...

I used PE-bear for the first time to dump an embedded binary. Its intuitive UI made extraction effortless. Because malware often embeds payloads with the form A in B to evade detection, pulling out the inner binary was crucial for deeper analysis and IoCs hunting.

Finally done with #FlareOn12. What a ride! I am looking forward to read other people’s solutions, especially of those who did the 9th task quickly.

#FTSCon Speaker Spotlight: Aleksandra Doniec (@hasherezade.bsky.social) is presenting “Uncovering Malware's Secrets with TinyTracer” in the MAKER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

My intermediate level malware analysis course is there. 60% off for the next two weeks. malwareanalysis-for-hedgehogs.learnworlds.com/course/inter...

Beyond good ol’ Run key, Part 148 www.hexacorn.com/blog/2025/07...

New #TinyTracer (v3.0) is out - with many cool features: github.com/hasherezade/... - check them out!

1. Pause thread midway in exploit races (even ⓪). 2. Or block entire CPU core. Kernel APCs run at APC_LEVEL (🤯), so thread scheduling kinda disabled (think priority == ∞). 3. Or build upon @hasherezade.bsky.social work & generalize #WaitingThreadHijacking — making it, in fact, Waitless.

Heard of #ContextJail? It's a nasty new technique: puts target thread into ⓪ deadloop, for as long as you can afford. Requires THREAD_GET_CONTEXT right. The gist? Just spam NtGetContextThread(tgt).😸 Target will be jailed, running nt!PspGetSetContextSpecialApc 🔁. Src & binary in [ALT]. Usecases: ⤵️

My new blog for CPR: introducing Waiting Thread Hijacking - a remote process injection technique targeting waiting threads: research.checkpoint.com/2025/waiting... #ProcessInjection

Zscaler has published a technical report on HijackLoader (IDAT Loader, GhostPulse) and its recent changes, such as its new call stack spoofing module, anti-VM module, and support for scheduled task persistence www.zscaler.com/blogs/securi...

Abolish April Fool’s day. Society has moved past the need for April Fool’s day

KELA has published a profile on Rey and Pryx, the two main individuals behind the Hellcat hacking group, responsible for several breaches over the past months, such as Schneider Electric, Telefónica, and Orange Romania. www.kelacyber.com/blog/hellcat...

We all knew this day would arrive when the DNA samples you willingly provided 23andMe would be up for sale. Company now says it's seeking a buyer as it files for bankruptcy. 23andMe says any buyer will have to adhere to privacy laws for customer DNA/data they acquire. people.com/23andme-file...

Clevo Boot Guard Keys Leaked in Update Package www.binarly.io/blog/clevo-b...

Someone has done an excellent job collecting RATs and documenting them by version. They also included images. A+ work. This is amazing (we're going to ingest this eventually) github.com/Cryakl/Ultim...

A small demo/tutorial on unpacking executables with #PEsieve and #TinyTracer: hshrzd.wordpress.com/2025/03/22/u... - automatic OEP finding, reconstructing IAT, avoiding antidebugs and fixing imports broken by shims

Would you look at that, it's tmp.0ut Volume 4! Happy Friday, hope you enjoy this latest issue! tmpout.sh/4/

Did anyone find the secret art page? 👀

Next RE//verse video released! Andrew's Day 2 keynote was the next most requested video. It starts with an aside from neuroscience, ends with a challenge to all tool developers and has a fantastic journey between:

whoever made this one, it is perfect for IT work or life in general.

Prodaft has published a technical analysis of Anubis, a new Python-based backdoor linked to Savage Ladybug (FIN7) operations catalyst.prodaft.com/public/repor...

The BlackBasta ransomware gang developed and used its own custom tool to brute-force enterprise firewalls and VPN remote-access products. Named Bruted, the tool was written in PHP and could brute-force the following products (see image) blog.eclecticiq.com/inside-brute...

The Blind Eagle APT group has compromised over 1,600 victims inside Colombian institutions and government agencies. The campaign took place in November & December of last year and used an exploit similar to a zero-day exploited by Russian hackers in Ukraine. research.checkpoint.com/2025/blind-e...

[DEMO] Searching for #AceLdr in memory, with #PEsieve/#HollowsHunter threads scan: www.youtube.com/watch?v=RQf2... ; read more: github.com/hasherezade/...

#PEbear (github.com/hasherezade/...) is now available via WinGet (learn.microsoft.com/en-us/window...)! You can install it easier than ever - just type: `winget install pe-bear` from Powershell.

meanwhile in Australia 😂

Released part III of my anti anti rootkit series recently. I showcase a way to implement a 'threadless' rootkit by using a spin on the .data pointer hijacking technique known from kernel game cheats. This part concludes the trilogy, but theres more to come ;) eversinc33.com/posts/anti-a...

Good Exports are real www.hexacorn.com/blog/2025/02...

New release: #IDA_IFL (Interactive Functions List) plugin v1.5 - works for IDA 9. Shout-out to my new contributor, @mahmoudimus.bsky.social who added the support! github.com/hasherezade/...

⌛ This series will take you through installing WinDbg and configuring Binary Ninja to use the WinDbg engine to create and use TTD traces. It will also show you how to capture TTD traces and replay them in Binary Ninja 👇

Soft deadline for Paged Out! #6 is upon us – 1 Feb 2025 – pagedout.institute?page=cfp.php

Today, January 27, is Holocaust Remembrance Day—a time to reflect on the six million Jews murdered in the Holocaust, including members of my family. Six family names lost to history serve as a painful reminder of the deep, personal connections many of us have to this tragedy. 1/4

In case if you wonder what broke #ProcessHollowing on Windows 11 24H2, I have something for you: hshrzd.wordpress.com/2025/01/27/p...

The schedule of RE//verse is out now and contains some pretty interesting talks on reverse engineering and code (de)obfuscation! I'll also give my deobfuscation training there: shop.binary.ninja/products/re-...

For Maths fans, 2025 is a square. 45² = 45 x 45 = 2025 Also, 9² x 5² = 2025 40² + 20² + 5² = 2025 My favourite? 1³+2³+3³+4³+5³+6³+7³+8³+9³ = 2025 #Mathematics #teaching #education

New #PEsieve & #HollowsHunter (v0.4.0) are released: github.com/hasherezade/... & github.com/hasherezade/... - A lot has changed in the new version, check it out!

Hello all, thank you for all the new follows! 💁‍♀️

Talks from the VirusBulletin 2024 security conference, which took place in early October, are available on YouTube www.youtube.com/playlist?lis...

BluehatIL 2025 CFP is open! It's a great stage and a fun conference. Probably the best Israel has to offer Go submit😺 www.microsoftrnd.co.il/bluehatil/co... #cfp #cybersecurity #infosec

Smokeloader keeps crawling its way back into the limelight. If you want a primer on it, I gave a public talk on it 2 years ago www.youtube.com/watch?v=O69e...