I am honored to share the 2026 Pulitzer Prize for Best International Reporting with Dake Kang, Byron Tau, Aniruddha Ghosal and Garance Burke for our reporting revealing how Silicon Valley largely designed and built China's surveillance state and enabled human rights abuses.

On this day 35 years ago, HEIR TO THE EMPIRE was released

Dodgers broadcast was discussing the science behind the perception of time between children and adults. After hearing the explanation, the color commentator pauses and asks, "Am I gonna feel any better?" Andy Pages then smashes a dinger into space, thus ending the existential crisis on commentary.

So @xorhex.bsky.social asked (in our YARA keybase chat) how one might only iterate through the last 10 matches of a string in YARA. I took a shot at answering it by logging the last 10 locations of a match in descending order: for all i in (0..10): (console.log(@a[#a - i]))

After 11 years of silence at Black Hat, I am delivering a speech today. In memory of a legendary APT Hunter, Mr Sergey Mineev, who passed away 40 days ago. If you cannot attend, here is the write-up: www.sentinelone.com/labs/fast16-...

After 11 years, I'm returning to the Black Hat stage. The last time, in 2015, I gave a joint talk with INTERPOL - their first-ever appearance at Black Hat. If you're around, come support me tomorrow - I promise the talk goes well beyond what you'll find in the abstract.

PEMDAS, but for the correct order to eat fruit snacks

Easter dinner was a movie (a delicious Dune knock off)

#binjaextras has been updated to allow for type information to be applied to both struct members and global variables. Local instance of OALab's hashdb has been added as well - see setup info here: github.com/xorhex/binja... Install/update binjaextras via the plugin manager! #BinaryNinja

This is what happens when I take time off, I actually write silly length blog posts and deep dive things blog.zsec.uk/bullyingllms/ the post dives into a MCP pipeline I've put together for autonomous 0day hunts.

RationalEdge #REDS new release: Maliciousness #Score, #AI Assisted Full Sample Analysis, and a new #Behaviour Panel. rationaledge.io/blog/malicio... @rationaledge.bsky.social #ThreatResearch #ThreatIntel #CTI #Malware #MalwareAnalysis #ReverseEngineering 1/4

Proofpoint has directly observed a targeted email campaign that delivers DarkSword RCE, and we attribute the messages to Russian FSB threat actor TA446 with high confidence. 🧵

I’m not interested in skinny propaganda in any form I was on board when Oprah was built up like a Baltimore row house

Them Europeans cannot be your standard for beauty… they almost died because they wouldn’t wash their hands

Bam Adebayo is doing WHAT right now???

📣 #PIVOTcon26 Agenda is here 🤟 We are thrilled to announce the lineup for this year's edition! 2⃣ days and 19 talks from leading #ThreatResearch experts. The agenda link is in the first comment👇, and the talks and speakers are in the thread.🧵 #CTI #ThreatIntel 1/15

Can someone smarter than me tell me if the cyber strategy for america from the regime means anything for me personally?

Christopher Kempczinski bit into that burger like it was the first time he'd every tasted a McDonalds burger AND... This is actually a case study on how American companies no longer promote within

Since things are #rough out here right now, I figured I’d share a fun story Back in the early 00’s, my uncle worked at some manufacturer that sponsored a bunch of NASCAR cars and would regularly get tickets to the events

Staying off socials to keep my mentals in order but had to come in here to say that I’m certain Bad Bunny had more yards from scrimmage than the Pats in that first half

#BREAKING #ESETresearch identified the wiper #DynoWiper used in an attempted disruptive cyberattack against the Polish energy sector on Dec 29, 2025. At this point, no successful disruption is known, but the malware’s design clearly indicates destructive intent. 1/5

You fear innovation

"A superpower is choosing to self-immolate and torch its remaining global trust and friendships, including and especially NATO...at the precise moment when it had been reinvigorated and renewed...in the wake of Russia’s large-scale invasion of Ukraine in 2022" - by @vermontgmg.bsky.social

They have quite an operation going. www.mprnews.org/episode/2026...

I don’t think we’ve collectively paid enough attention to the fact that Annie’s is now the regent of boxed Mac and cheese Kraft got their chain snatched and now it just tastes like dog water compared to Annie’s

#100daysofYARA - day 12 VirusTotal uses CAPE sandbox to identify many malware families and determine if they can extract the malware's configuration. Since they use CAPE, we can often see their logic. Today, we'll suggest edits to a rule for AgentTesla. Rule at end. 1/10

Imagine publishing a blog on "Lazarus" in the year of our lord 2026

#100DaysofYARA - Day 11 In looking at automatic YARA generation, yarGen-Go is a must. Just released by @cyb3rops#100DaysofYARA it is a rewrite and advancement from the original yarGen. We'll look at the same malware from day 10; a targeted HavocC2 loader with decoy. rule at bottom 1/5

This scripts are deceptive as they contain 10,000 empty lines. BTW #malcat loads scripts like these better than most text editors. If I get the chance, I may revise it to see how to find ones without the matching text or if you have ideas, hmu. github.com/Squiblydo...#malcat 3/3

The rule is fairly simple but it seems that at least one DPRK team is using the same consistent message in the header. I validated this using ReversingLab's YARA scanning. A slightly different header is seen in Huntress' analysis: www.huntress.com/blo... 2/3

#100DaysofYARA - Day 9 YARA looks for the header used in a .SCPT file used by BlueNoroff (DPRK) to target MacOS systems. Script is delivered to victims disguised as a Zoom meeting launcher. e.g. a7c7d75c33aa809c231f1b22521ae680248986c980b45aa0881e19c19b7b1892 Rule at end 1/3

#100DaysofYARA - Day 8 For many years, many attackers tried to keep their binaries small. However, the others found the opposite works too: extremely large binaries can cause problems with analysis. What can be done about these large executables? Rule at end 1/6

The same people spent the last decade justifying Black folks being choked to death on camera… they’ve been practicing

congress should behave like a co equal branch impeachment defunding filing suits subpoenas writing laws hearings, hearings, hearings what else?

Today, we released new @RecordedFuture research detailing BlueDelta’s expanded credential-harvesting activity observed between February and September 2025. #BlueDelta #APT28 #FANCYBEAR #ForestBlizzard #FROZENLAKE #ITG05 #PawnStorm #Sednit #Sofacy #TA422 (1/5) www.recordedfuture.com/research/gru...

#100DaysofYARA - Day 7 @malwrhunterteam identified a suspicious file signed by "Xiamen Jialan Guang Information Technology Service Co., Ltd." While we have a pretty good idea it'll be abused, it hasn't been yet. So, lets watch for it to be abused. Rule at end 1/5

#100DaysofYARA - Day 6 In December and again in January, an unknown actor replaced the download on EmEditor's website with a malicious installer. Each time, the download was a trojan installer with a valid code-signing signature. How can we detect this? Rule at end 1/6

YARA-X can dump the certificate details of a MACHO binary. "yr dump [file]" shows the data produced by the modules We can output it to JSON and pass it to jq as like this: yr dump -o=json [file] | jq '.macho.certificates' 3/7

#100DaysofYARA - Day 4 One heavy user of code-signing certificates is Rhysida Ransomware. In June, I created a YARA rule focusing on their malware to help me find and report their certificates. To do so, I had to create a YARA rule on the Rich PE Header. Rule at end 1/7

#100DaysofYARA - day 5 The Cert Graveyard project reports and documents abuse code-signing including Apple issued certificates. When reporting a certificate, we want to ensure Apple has all the identifiers they need to investigate and act. Rule at end 1/7

I really do love|hate RegExes. This week, a short walkthrough on how to use them to find DPRK hackers. buttondown.com/readwrite/ar...

Listening to a lot of A Thousand Suns recently Not sure why, surely not some subliminal or subconscious reason

#100DaysofYARA - Day 3 This relates to obfusheader discussed by @RussianPanda95 and @c0ner0ne. If the dev is going to use hard-coded strings, lets use them to our advantage. This thread will demo Malcat's YARA features. Rule at end of thread 1/5

For making the rule, I again used #malcat. I highlighted the smaller icon and added it to the YARA rule: "right-click" > "add selection to YARA" > "New rule". Couldn't be easier. github.com/Squiblydo...#malcat.4/4

#100DaysofYARA - Day 2 YARA rule to detect the default Delphi darkmode dib icon. I've seen this icon excessively over the years. Using @unpacme 's YARA hunting tools, I saw 0 known goodware and 800 packed junk. Rule at end 1/4

If you liked this thread and would like to see more of my methodology, let me know! Also if you have any suggestions or comments on my YARA rule, I'd love to hear them. github.com/Squiblydo... 7/7

First day of #100daysOfYara This YARA rule detects a technique used in #TrashAgent malware. The malware has a hard-coded list of apps to check for on the system. This YARA looks for the way they parse the list. In the image, the list is demarcated with "nepo" rule at end 1/7

A lot of very good things happened to me personally this last year, in work and in life But the fact that I’ve only read books from The Expanse is irking me for some reason (on book 6 now, my fav so far) I really enjoy reading them but it feels… unbalanced

🚨#100DaysofYARA lives!! 2 time reigning champ Yashraj has kindly offered to take the helm for this community effort! Give the homie a follow 👊 Check the repo to contribute: github.com/100DaysofYARA And gear up for Jan 1 when #100DaysofYARA will kick off!

my demands are simple, mr. bond