Bam Adebayo is doing WHAT right now???

📣 #PIVOTcon26 Agenda is here 🤟 We are thrilled to announce the lineup for this year's edition! 2⃣ days and 19 talks from leading #ThreatResearch experts. The agenda link is in the first comment👇, and the talks and speakers are in the thread.🧵 #CTI #ThreatIntel 1/15

Can someone smarter than me tell me if the cyber strategy for america from the regime means anything for me personally?

Christopher Kempczinski bit into that burger like it was the first time he'd every tasted a McDonalds burger AND... This is actually a case study on how American companies no longer promote within

Since things are #rough out here right now, I figured I’d share a fun story Back in the early 00’s, my uncle worked at some manufacturer that sponsored a bunch of NASCAR cars and would regularly get tickets to the events

Staying off socials to keep my mentals in order but had to come in here to say that I’m certain Bad Bunny had more yards from scrimmage than the Pats in that first half

#BREAKING #ESETresearch identified the wiper #DynoWiper used in an attempted disruptive cyberattack against the Polish energy sector on Dec 29, 2025. At this point, no successful disruption is known, but the malware’s design clearly indicates destructive intent. 1/5

You fear innovation

"A superpower is choosing to self-immolate and torch its remaining global trust and friendships, including and especially NATO...at the precise moment when it had been reinvigorated and renewed...in the wake of Russia’s large-scale invasion of Ukraine in 2022" - by @vermontgmg.bsky.social

They have quite an operation going. www.mprnews.org/episode/2026...

I don’t think we’ve collectively paid enough attention to the fact that Annie’s is now the regent of boxed Mac and cheese Kraft got their chain snatched and now it just tastes like dog water compared to Annie’s

#100daysofYARA - day 12 VirusTotal uses CAPE sandbox to identify many malware families and determine if they can extract the malware's configuration. Since they use CAPE, we can often see their logic. Today, we'll suggest edits to a rule for AgentTesla. Rule at end. 1/10

Imagine publishing a blog on "Lazarus" in the year of our lord 2026

#100DaysofYARA - Day 11 In looking at automatic YARA generation, yarGen-Go is a must. Just released by @cyb3rops#100DaysofYARA it is a rewrite and advancement from the original yarGen. We'll look at the same malware from day 10; a targeted HavocC2 loader with decoy. rule at bottom 1/5

This scripts are deceptive as they contain 10,000 empty lines. BTW #malcat loads scripts like these better than most text editors. If I get the chance, I may revise it to see how to find ones without the matching text or if you have ideas, hmu. github.com/Squiblydo...#malcat 3/3

The rule is fairly simple but it seems that at least one DPRK team is using the same consistent message in the header. I validated this using ReversingLab's YARA scanning. A slightly different header is seen in Huntress' analysis: www.huntress.com/blo... 2/3

#100DaysofYARA - Day 9 YARA looks for the header used in a .SCPT file used by BlueNoroff (DPRK) to target MacOS systems. Script is delivered to victims disguised as a Zoom meeting launcher. e.g. a7c7d75c33aa809c231f1b22521ae680248986c980b45aa0881e19c19b7b1892 Rule at end 1/3

#100DaysofYARA - Day 8 For many years, many attackers tried to keep their binaries small. However, the others found the opposite works too: extremely large binaries can cause problems with analysis. What can be done about these large executables? Rule at end 1/6

The same people spent the last decade justifying Black folks being choked to death on camera… they’ve been practicing

congress should behave like a co equal branch impeachment defunding filing suits subpoenas writing laws hearings, hearings, hearings what else?

Today, we released new @RecordedFuture research detailing BlueDelta’s expanded credential-harvesting activity observed between February and September 2025. #BlueDelta #APT28 #FANCYBEAR #ForestBlizzard #FROZENLAKE #ITG05 #PawnStorm #Sednit #Sofacy #TA422 (1/5) www.recordedfuture.com/research/gru...

#100DaysofYARA - Day 7 @malwrhunterteam identified a suspicious file signed by "Xiamen Jialan Guang Information Technology Service Co., Ltd." While we have a pretty good idea it'll be abused, it hasn't been yet. So, lets watch for it to be abused. Rule at end 1/5

#100DaysofYARA - Day 6 In December and again in January, an unknown actor replaced the download on EmEditor's website with a malicious installer. Each time, the download was a trojan installer with a valid code-signing signature. How can we detect this? Rule at end 1/6

YARA-X can dump the certificate details of a MACHO binary. "yr dump [file]" shows the data produced by the modules We can output it to JSON and pass it to jq as like this: yr dump -o=json [file] | jq '.macho.certificates' 3/7

#100DaysofYARA - Day 4 One heavy user of code-signing certificates is Rhysida Ransomware. In June, I created a YARA rule focusing on their malware to help me find and report their certificates. To do so, I had to create a YARA rule on the Rich PE Header. Rule at end 1/7

#100DaysofYARA - day 5 The Cert Graveyard project reports and documents abuse code-signing including Apple issued certificates. When reporting a certificate, we want to ensure Apple has all the identifiers they need to investigate and act. Rule at end 1/7

I really do love|hate RegExes. This week, a short walkthrough on how to use them to find DPRK hackers. buttondown.com/readwrite/ar...

Listening to a lot of A Thousand Suns recently Not sure why, surely not some subliminal or subconscious reason

#100DaysofYARA - Day 3 This relates to obfusheader discussed by @RussianPanda95 and @c0ner0ne. If the dev is going to use hard-coded strings, lets use them to our advantage. This thread will demo Malcat's YARA features. Rule at end of thread 1/5

For making the rule, I again used #malcat. I highlighted the smaller icon and added it to the YARA rule: "right-click" > "add selection to YARA" > "New rule". Couldn't be easier. github.com/Squiblydo...#malcat.4/4

#100DaysofYARA - Day 2 YARA rule to detect the default Delphi darkmode dib icon. I've seen this icon excessively over the years. Using @unpacme 's YARA hunting tools, I saw 0 known goodware and 800 packed junk. Rule at end 1/4

If you liked this thread and would like to see more of my methodology, let me know! Also if you have any suggestions or comments on my YARA rule, I'd love to hear them. github.com/Squiblydo... 7/7

First day of #100daysOfYara This YARA rule detects a technique used in #TrashAgent malware. The malware has a hard-coded list of apps to check for on the system. This YARA looks for the way they parse the list. In the image, the list is demarcated with "nepo" rule at end 1/7

A lot of very good things happened to me personally this last year, in work and in life But the fact that I’ve only read books from The Expanse is irking me for some reason (on book 6 now, my fav so far) I really enjoy reading them but it feels… unbalanced

🚨#100DaysofYARA lives!! 2 time reigning champ Yashraj has kindly offered to take the helm for this community effort! Give the homie a follow 👊 Check the repo to contribute: github.com/100DaysofYARA And gear up for Jan 1 when #100DaysofYARA will kick off!

my demands are simple, mr. bond

Space news is the best. Like, what do you mean there's a runaway supermassive black hole 10 million times bigger than the sun moving through space at 2 million miles per hour www.space.com/astronomy/bl...

You asked for our traditional #CfP meme-guideline for #PIVOTcon26 - here it is 🥳🎉 Reminder: - one track,30m - no recording/streaming/tweeting. - No TLP:WHITE - Original content only #CTI #ThreatIntel #ThreatResearch 1/7

A maldoc with a functional CAPTCHA was the initial thread we pulled on to find these two clusters of unc1151 strikeready.com/blog/captch-...

Ongoing european government targeting from this susp ru actor. Surely others are focused on the politics of Transnistria, but not too many. strikeready.com/blog/russian...

Happy to announce I will forego getting my cyber letter of marque and instead will just skip ahead to having my teeth knocked out and my family threatened!

Chat, I’ve been wearing basically only sweats since BigRona hit. The only things that fit are lulu joggers and the tux from my wedding Seeking recs on casual (smart and business) brands Need both shirts and pants, for thick-thighed male, so stretch required Also jeans maybe??

the amount of businesses that use GoPhish as an otherwise legitimate mailer is ... concerning

Hunting For North Korean Fiber Optic Cables Before we go any further, one thing that I want to make clear is that the word assume is going to be doing some heavy lifting throughout this post. This was a rabbit hole that I recently went down and I probably have more questions than answers, but I…

A study in the evolution of SVR cyberespionage tradecraft

#ChangeMyMind #ElfOnTheShelf is a capitalist ploy to normalize a surveillance state to children.

The parts of Christianity we've invested ENTIRELY too much time in Who going with who where do they "be" putting "it" who gets to preach the sermons which method of baptism How many ethically consenting and informed "boos" you running none of which make you a better Christian

Really great cyberwarcon talk from @wylienewmark.bsky.social @activemeasures.bsky.social Learned a lot and laughed a lot

#ESETresearch discovered and analyzed a previously undocumented malicious tool for network devices that we have named #EdgeStepper, enabling China-aligned #PlushDaemon APT to perform adversary-in-the-middle to hijack updates to deliver malware. www.welivesecurity.com/en/eset-rese... 1/5

If this many wealthy people are illiterate idiots and so many in leadership roles are spineless outside of their own selfishness, perhaps there’s some flaws in our system