They have quite an operation going. www.mprnews.org/episode/2026...

I don’t think we’ve collectively paid enough attention to the fact that Annie’s is now the regent of boxed Mac and cheese Kraft got their chain snatched and now it just tastes like dog water compared to Annie’s

#100daysofYARA - day 12 VirusTotal uses CAPE sandbox to identify many malware families and determine if they can extract the malware's configuration. Since they use CAPE, we can often see their logic. Today, we'll suggest edits to a rule for AgentTesla. Rule at end. 1/10

Imagine publishing a blog on "Lazarus" in the year of our lord 2026

#100DaysofYARA - Day 11 In looking at automatic YARA generation, yarGen-Go is a must. Just released by @cyb3rops#100DaysofYARA it is a rewrite and advancement from the original yarGen. We'll look at the same malware from day 10; a targeted HavocC2 loader with decoy. rule at bottom 1/5

This scripts are deceptive as they contain 10,000 empty lines. BTW #malcat loads scripts like these better than most text editors. If I get the chance, I may revise it to see how to find ones without the matching text or if you have ideas, hmu. github.com/Squiblydo...#malcat 3/3

The rule is fairly simple but it seems that at least one DPRK team is using the same consistent message in the header. I validated this using ReversingLab's YARA scanning. A slightly different header is seen in Huntress' analysis: www.huntress.com/blo... 2/3

#100DaysofYARA - Day 9 YARA looks for the header used in a .SCPT file used by BlueNoroff (DPRK) to target MacOS systems. Script is delivered to victims disguised as a Zoom meeting launcher. e.g. a7c7d75c33aa809c231f1b22521ae680248986c980b45aa0881e19c19b7b1892 Rule at end 1/3

#100DaysofYARA - Day 8 For many years, many attackers tried to keep their binaries small. However, the others found the opposite works too: extremely large binaries can cause problems with analysis. What can be done about these large executables? Rule at end 1/6

The same people spent the last decade justifying Black folks being choked to death on camera… they’ve been practicing

congress should behave like a co equal branch impeachment defunding filing suits subpoenas writing laws hearings, hearings, hearings what else?

Today, we released new @RecordedFuture research detailing BlueDelta’s expanded credential-harvesting activity observed between February and September 2025. #BlueDelta #APT28 #FANCYBEAR #ForestBlizzard #FROZENLAKE #ITG05 #PawnStorm #Sednit #Sofacy #TA422 (1/5) www.recordedfuture.com/research/gru...

#100DaysofYARA - Day 7 @malwrhunterteam identified a suspicious file signed by "Xiamen Jialan Guang Information Technology Service Co., Ltd." While we have a pretty good idea it'll be abused, it hasn't been yet. So, lets watch for it to be abused. Rule at end 1/5

#100DaysofYARA - Day 6 In December and again in January, an unknown actor replaced the download on EmEditor's website with a malicious installer. Each time, the download was a trojan installer with a valid code-signing signature. How can we detect this? Rule at end 1/6

YARA-X can dump the certificate details of a MACHO binary. "yr dump [file]" shows the data produced by the modules We can output it to JSON and pass it to jq as like this: yr dump -o=json [file] | jq '.macho.certificates' 3/7

#100DaysofYARA - Day 4 One heavy user of code-signing certificates is Rhysida Ransomware. In June, I created a YARA rule focusing on their malware to help me find and report their certificates. To do so, I had to create a YARA rule on the Rich PE Header. Rule at end 1/7

#100DaysofYARA - day 5 The Cert Graveyard project reports and documents abuse code-signing including Apple issued certificates. When reporting a certificate, we want to ensure Apple has all the identifiers they need to investigate and act. Rule at end 1/7

I really do love|hate RegExes. This week, a short walkthrough on how to use them to find DPRK hackers. buttondown.com/readwrite/ar...

Listening to a lot of A Thousand Suns recently Not sure why, surely not some subliminal or subconscious reason

#100DaysofYARA - Day 3 This relates to obfusheader discussed by @RussianPanda95 and @c0ner0ne. If the dev is going to use hard-coded strings, lets use them to our advantage. This thread will demo Malcat's YARA features. Rule at end of thread 1/5

For making the rule, I again used #malcat. I highlighted the smaller icon and added it to the YARA rule: "right-click" > "add selection to YARA" > "New rule". Couldn't be easier. github.com/Squiblydo...#malcat.4/4

#100DaysofYARA - Day 2 YARA rule to detect the default Delphi darkmode dib icon. I've seen this icon excessively over the years. Using @unpacme 's YARA hunting tools, I saw 0 known goodware and 800 packed junk. Rule at end 1/4

If you liked this thread and would like to see more of my methodology, let me know! Also if you have any suggestions or comments on my YARA rule, I'd love to hear them. github.com/Squiblydo... 7/7

First day of #100daysOfYara This YARA rule detects a technique used in #TrashAgent malware. The malware has a hard-coded list of apps to check for on the system. This YARA looks for the way they parse the list. In the image, the list is demarcated with "nepo" rule at end 1/7

A lot of very good things happened to me personally this last year, in work and in life But the fact that I’ve only read books from The Expanse is irking me for some reason (on book 6 now, my fav so far) I really enjoy reading them but it feels… unbalanced

🚨#100DaysofYARA lives!! 2 time reigning champ Yashraj has kindly offered to take the helm for this community effort! Give the homie a follow 👊 Check the repo to contribute: github.com/100DaysofYARA And gear up for Jan 1 when #100DaysofYARA will kick off!

my demands are simple, mr. bond

Space news is the best. Like, what do you mean there's a runaway supermassive black hole 10 million times bigger than the sun moving through space at 2 million miles per hour www.space.com/astronomy/bl...

You asked for our traditional #CfP meme-guideline for #PIVOTcon26 - here it is 🥳🎉 Reminder: - one track,30m - no recording/streaming/tweeting. - No TLP:WHITE - Original content only #CTI #ThreatIntel #ThreatResearch 1/7

A maldoc with a functional CAPTCHA was the initial thread we pulled on to find these two clusters of unc1151 strikeready.com/blog/captch-...

Ongoing european government targeting from this susp ru actor. Surely others are focused on the politics of Transnistria, but not too many. strikeready.com/blog/russian...

Happy to announce I will forego getting my cyber letter of marque and instead will just skip ahead to having my teeth knocked out and my family threatened!

Chat, I’ve been wearing basically only sweats since BigRona hit. The only things that fit are lulu joggers and the tux from my wedding Seeking recs on casual (smart and business) brands Need both shirts and pants, for thick-thighed male, so stretch required Also jeans maybe??

the amount of businesses that use GoPhish as an otherwise legitimate mailer is ... concerning

Hunting For North Korean Fiber Optic Cables Before we go any further, one thing that I want to make clear is that the word assume is going to be doing some heavy lifting throughout this post. This was a rabbit hole that I recently went down and I probably have more questions than answers, but I…

A study in the evolution of SVR cyberespionage tradecraft

#ChangeMyMind #ElfOnTheShelf is a capitalist ploy to normalize a surveillance state to children.

The parts of Christianity we've invested ENTIRELY too much time in Who going with who where do they "be" putting "it" who gets to preach the sermons which method of baptism How many ethically consenting and informed "boos" you running none of which make you a better Christian

Really great cyberwarcon talk from @wylienewmark.bsky.social @activemeasures.bsky.social Learned a lot and laughed a lot

#ESETresearch discovered and analyzed a previously undocumented malicious tool for network devices that we have named #EdgeStepper, enabling China-aligned #PlushDaemon APT to perform adversary-in-the-middle to hijack updates to deliver malware. www.welivesecurity.com/en/eset-rese... 1/5

If this many wealthy people are illiterate idiots and so many in leadership roles are spineless outside of their own selfishness, perhaps there’s some flaws in our system

lol at the names BUT Idk anything about defections. What would Park Jin Hyok (or another prolific DPRK operator) have to walk out of Pyongyang with for US/SK services to not just throw dude in prison? Because CN or RU operators I feel like you jail for use later in a strategic trade.

New Iran drop from me tracking an attribution nightmare - UNK_SmudgedSerpent! A little Charming, a little Muddy, and a lot C5. Targeting policy experts with benign conversation starters, health-themed infra, OnlyOffice spoofs, and RMMs. Check out the full story www.proofpoint.com/us/blog/thre...

Threat actors are teaming up with organized crime to target truckers — stealing identities, placing fraudulent bids on freight, and making off with the cargo. Their entry point? Emails with links delivering Remote Monitoring and Management (RMM) tools. Together with @selenalarson.bsky.social :

Still testing 🤞 For those able to use #BinaryNinja projects; #BinYars can sort the files into folders based upon the #Yara-X rule metadata field, BNFolder. The folder nesting structure is determined by the number of matches that reside under each folder - check out the video below!

It's getting close to being done - #BinYars a #YARA-X #BinaryNinja plugin! Still testing, but plan on open sourcing it for all to use. Shout out to Remco Sprooten for making this tool (also shown in the video) for quickly drafting Yara rules 💪 github.com/1337-42/Simp... Video: Part 1 of 2

The tool has been released in the Proofpoint Emerging Threats public #GitHub for other defenders to leverage. Learn more about it here: brnw.ch/21wWSH0 #PDF #threatdetection #cyberthreat

Proofpoint threat researchers have designed an open-source tool—named PDF Object Hashing—to track and detect the unique characteristics of PDFs used by threat actors... similar to a digital fingerprint. 🫆 We use this tool internally to help track multiple threat actors with high confidence.

What Athens was to Ancient Greece, NJ is to America