BlackHat US Call for Paper is open, and we're eagerly awaiting your submissions! I'm proud to be shepherding the Reverse Engineering track again this year and I'll be actively soliciting for cool research 😏😏😏 usa-briefings-cfp.blackhat.com

Randomly came across this downloader, which seems to want to download and built itself some kernel rootkit. The internet suggests this malware belongs to some relatively recent FnOS attack campaign on Feiniu private cloud. Tell me again Linux malware is boring.

My note taking pencil for the serious notes!

This is a phenomenal little blog post about Linux C++ binary analysis ❤️❤️❤️ oneraynyday.github.io/dev/2020/05/...

Mini blog: I promised I'd publish the binary pewpew project I created with the help of Claude, and here we are, blog with link to Github. Works-on-my-machine type of project ;) hackandcheese.com/posts/blog2_...

Ok weird stuff. I have a flat earther in my family and am genuinely puzzled. Torn between plain curiosity, screaming at them for ignoring physics, and really worried for their future. What.. does one do with these people?

Save the date! @blackhoodie.bsky.social is coming to Luxembourg! On May 6th we're partnering with #BSidesLuxembourg for a day of binary fun and joy 🥳🥳🥳

Maaaaan GCC for 32-bit Intel really didn't like push instructions huh

The cathartic effect of reverse engineering without a business objective should have its own therapy book.

😍😍😍

I've only spent a hot 5 min, but the level of obfuscation in the September version of Lockbit for Linux is marvelous

Do Windows sandboxes these days run full blown Win11? Asking for a friend; a friend who's been waiting for their Win11 VM to update and is bored out of their mind.

Wow Claude, that input was supposed to go to this API, not THAT one; that loop counter really didn't need increasing here; and this sanitization check returns a value ffs

HAPPY FRIDAY!!! Our Agenda is now live! Check it out! Check it out: www.districtcon.org/speakers

In November I joined @elykdeer.bsky.social on the @binaryninja.bsky.social podcast to chat about Linux malware reverse engineering, advances in analysis tools, and my upcoming training at RE//verse conference. Check out the recording! www.youtube.com/watch?v=R72m...

We still have seats open for @blackhoodie.bsky.social at @districtcon.bsky.social on January 23rd in Washington DC! The class will be reverse engineering their way through an integer overflow bug in libpng 🤓 blackhoodie.re/DistrictCon2...

👀

Wag The Dog wasn't supposed to be a documentary..

Squeee so excited 😍😍😍 @blackhoodie.bsky.social will be at @districtcon.bsky.social next year, on January 23rd @synapticrewrite.bsky.social and I will teach a day of Reverse Engineering for Vulnerability Discovery, registration is now open blackhoodie.re/DistrictCon2...

Wonderful little blog post about the Windows Process and Thread Environment blocks metehan-bulut.medium.com/understandin...

MIT Technology Review profiles @rondeibert.bsky.social, who understood that civil society needed digital defense long before just about anyone else and has been doing it ever since. www.technologyreview.com/2025/12/24/1...

I'm considering getting the System V calling convention tattooed on my palm cause why on earth does rdx come before rcx why WHY WHYYY

This sticker makes me really happy 🙃

Ill be teaching my 4-day Advanced Linux Malware Reverse Engineering training next March at RE//verse conference, come join if you're interested in the nifty tricks unique to Linux and what we're up against in cloud, IoT and infrastructure shop.binary.ninja/products/re-...

Squeee so excited 😍😍😍 @blackhoodie.bsky.social will be at @districtcon.bsky.social next year, on January 23rd @synapticrewrite.bsky.social and I will teach a day of Reverse Engineering for Vulnerability Discovery, registration is now open blackhoodie.re/DistrictCon2...

Hello London! 🥰

@blackhoodie.bsky.social will have its own assembly at 39c3 congress this year 🥰 events.ccc.de/congress/202...

Trail of Bits has developed constant-time coding support for LLVM 21, providing developers with compiler-level guarantees that their cryptographic implementations remain secure against branching-related timing attacks #Cryptography blog.trailofbits.com/2025/11/25/c...

This is Limburg BE, not NL - though they are pretty close. www.bsides-limburg.be/home

Save the date! @blackhoodie.bsky.social will be at BSides Limburg next year, on March 13th our dear Paula will teach a reverse engineering and binary exploitation training 🥳🥳🥳 Thanks so much for hosting y'all ❤️

Another 9 miles in Portland's Forest Park, with winter sun 🥹 and yesterday I did 5. I'm doing this for a holiday-100 challenge, but also, endorphins!!

Running 10 miles in the mud by yourself is hella cathartic. And it helps that Portland in winter looks like Jurassic wonderland.

Why on earth are malware samples these days handled like someone's intellectual property?

absolutely massive news from the EU's top court! while it doesn't force every EU country to perform same-sex marriages, it *does* require them to recognise same-sex marriages from other countries the same way they recognise other foreign marriages it's a big step! www.reuters.com/world/europe...

Cloudflare disrupted the Internet earlier this week but, kudos to them, a) they wrote a really detailed post-mortem blog.cloudflare.com/18-november-... and b) their quarterly overviews of Internet disruptions (intentional or otherwise) are really good blog.cloudflare.com/q3-2025-inte...

I chatted with @hex-rays.bsky.social about how I found my place in the security industry, how @blackhoodie.bsky.social came to be, what our goals are and why community matters so much. hex-rays.com/blog/blackho...

Squeeeee 🥳 I'll be teaching my Advanced Linux Malware Reverse Engineering class at RE//verse conference in 2026!! MORE Linux APT insides and peculiarities😍🥰🤩Pls share if you can🙃 shop.binary.ninja/products/re-...

D3 viz of Symbiote malware call graph created with @binaryninja.bsky.social. Interactive, and makes pewpew sounds. The pewpew sounds are naturally the most important analysis feature, duh. Code going public soon.

I feel you buddy, I feel you

Seattle, @blackhoodie.bsky.social is coming to town! Thanks to IOActive we're hosting 2 days of trainings for women by women on Nov 14 & 15, brought to you by @barbieauglend.bsky.social Bhavna Supriya and Hanne! blackhoodie.re/Seattle2025/

We're on a roll 😱 Thanks to IOActive we're hosting 4 trainings in Seattle Nov 14-15! Registration is now open

Y'all fantastic news! Save the date, @blackhoodie.bsky.social will be at @districtcon.bsky.social this year 😱 the fantastic crew has offered to host us for a day of Malware Reverse Engineering! @synapticrewrite.bsky.social and myself will be hosting a training for women by women on January 23rd!!

Huge thank you to @hexacon.bsky.social for hosting BlackHoodie, to our trainers Paula, @naehrdine.bsky.social and @allthingsliquid.bsky.social, and much love to Caro for pulling it all together ❤️❤️❤️ the trainings were a huge success, now have a fun conference everyone!

Wheeeee the fine folk of @bsidespdx.bsky.social will have @blackhoodie.bsky.social back this year, with a training about microarchitectural security by the one and only @barbieauglend.bsky.social blackhoodie.re/BSidesPDX2025/

Dearest folks from @bsidespdx.bsky.social are hosting @blackhoodie.bsky.social again this year! Come spend a day with me and CPU bugs :) 🐞 blackhoodie.re/BSidesPDX2025/

Bf found me a gluten free French croissant and im so smitten 🥐

Uh juicy, Lockbit has a new variant 😱😱😱 I cannot WAIT to dig into this www.trendmicro.com/en_us/resear...

Does anyone have BRICKSTORM hashes they can share, other than the two in the Mandiant blog? Or low and behold, samples? 🥹🥹🥹

Boom, the future is here. BRICKSTORM comes with Java servlets, a SOCKS proxy, Go malware, PowerShell scripts, JSP webshells, info stealers, and probs stuff I've missed. Forget Linux or Windows malware, the age of whatever-runs, wherever-it-runs malware has arrived! cloud.google.com/blog/topics/...

Lol ok the callgraph now makes pewpew when I click on a node, and Claude calls it a satisfying "pew" 😂