www.zscaler.com/blogs/securi... - Nice writeup by zscaler on some COLDRIVER malware. I'm talking about this stuff at #FTSCon in a few weeks and will have lots more details there.

The first album by Lucid Planet was an instant like. A great progressive rock album that is insanely well produced. When the second album came out I liked it but it took a few full listens to really come into its own - I had to really embrace the electronica inspirations but definitely great album.

The whole “wxs is a robot” meme has officially gone too far. See you in October!

yara-x 1.7.0 is out. Some good bug fixes in there! Congrats to Victor and all the contributors! github.com/VirusTotal/y...

Spotify algorithm is on some serious drugs. What the deuce is this?

I’ll be giving a talk at FTS this year. Not going to lie, I’m doing it just so I can heckle Sir Tom of The House of Lancaster (@tlansec.bsky.social) in person. volatilityfoundation.org/from-the-sou...

Almost a month ago I had to have emergency surgery to have my gallbladder removed (not fun, do not recommend). It does mean I just got to use the sentence: "unnecessary organs will be removed for efficiency" - and for that I am happy.

Patrick doing good work and with classy emoji usage in the <whatever the equivalent to a tweet is>.

YARA-X 1.5.0 is out. Nice new features (including a crx module) and bug fixes. Congratulations to Victor and all the contributors! github.com/VirusTotal/y...

I’ve said this and a corollary to this for years. It’s all just bytes but “why is that particular sequence interesting” and “what do those bytes mean in the context of this malware” are the more interesting questions. Many decades ago I discovered something new to me that illustrates this…

First question: Will I be fired for only referring to you as Sir Tom of The House of Lancaster? Seriously though, if you’re looking this is one of the teams I would consider.

I took inspiration from the always classy @jacoblatonis.me recently and added support for underscores in integer and float literals in YARA. It makes reading large integers (in any supported base) much easier. github.com/VirusTotal/y...

We (@gabagool.ing - AKA gabbot) and I updated this with some more recent tomfoolery from this group. They continued the ASP campaign with evidence they responded to our initial publication. They were doing some sneaky calendar stuff that lead to adding a device to the target's O365 tenant.

The view from my driveway this year. Happy 4th of July!

I know I've been slacking on contributing to YARA-X, but I've been busy elsewhere. I do run a small keybase group where developers and users hang out. Ideas, features and bugs are discussed there. If you think you would benefit from being part of the discussion just hit me up for an invite.

So @gabagool.ing (who will henceforth be referred to as "gabbot") and I wrote some stuff on some ASP phishing campaigns: cloud.google.com/blog/topics/... Citizen Lab worked closely with one of the targets and shared their work on it also: citizenlab.ca/2025/06/russ...

Apparently my lightning talk at @cyberwarcon.bsky.social last year was released. Go watch it for a quick overview. COLDRIVER is still active, and still evolving to this day. The critical question is do I want to use emojis when I post about them?

New YARA-X release! In fact, Victor released 1.0.0. Lots of hard work by Victor and others to make this happen, congratulations to everyone involved! github.com/VirusTotal/y...

Despite the emoji count getting out of control, this is good work!

Me: I've got a few minutes to kill while this thing runs, what's going on in the world of linkedin? Linkedin:

New release by Victor! Includes a bug fix, support for “includes” and module invocation directly in python. Congrats to all involved! github.com/VirusTotal/y...

Merged into main, will try and get go bindings up next.

You can technically do this already in the python bindings, but it is less than ideal; it is basically the equivalent to my old -D trick with a dummy rule. I just put up a PR that directly exposes the modules to the python bindings: yara_x.Module('pe').invoke(data) # :) github.com/VirusTotal/y...

I wrote some details on LOSTKEYS: malware which we directly attribute to COLDRIVER. They don't deploy it often, but we have seen it a few times and want to make people aware of it. cloud.google.com/blog/topics/...

Have you ever found yourself in need of an ASCII art donkey on a waffle? Fear not, because past wxs has got you covered: people.freebsd.org/~wxs/donkey-... Just don't ask why I found that again.

You would think I would learn how to easily handle PKCS7 padding manually by now, but no. I decrypt something that is PKCS7 padded and I manually add a "[:-N]" (for the correct value of N) at the end of my code because ain't nobody got time to do it right.

New release of yara-x by Victor. Some nice fixes and features, so go update! Congrats to Victor and the contributors! github.com/VirusTotal/y...

Today marks 3 years since I joined TAG (now part of GTIG). A lot of things have happened in those 3 years, but the constants are what keep me here: the people and the work. Earning the respect of those that I respect while doing interesting and meaningful work is all I ask for.

First thing that popped into my brain when they were joking about praying to the spaceship gods was the ancient aliens guy. But the truth is PARC was so far ahead of its time it might as well have been aliens.

This is really interesting and good work by Volexity. I'm not sure how many places are looking for this kind of abuse or have outright prevented it. As a provider finding this kind of abuse has got to be difficult too.

Proposed linter on tags (and an API change that makes it so we can now get multiple linter errors in a single pass): github.com/VirusTotal/y...

Tag linting is in the works. It isn't right yet: it currently stops linting at the first invalid tag. Should be fixable with some thought and maybe some API changes though.

I watched this talk when it came out. It has only got better with age. If you have kids, are a technologist or just generally interested in being a decent human being this is mandatory viewing. This is a talk I hope to watch every couple of years, to help kick me in the ass from time to time.

YARA-X 0.13.0 is out: github.com/VirusTotal/y... As always, Victor and the contributors are cranking out quality improvements! In particular, check out the docs on how to use the formatter and linter and open issues (or tell me somehow) if you hit bugs or have things you want to see.

Happy #100DaysOfYARA - My linting work, with significant improvements from Victor, was merged into main, and will be in the next release of YARA-X: github.com/VirusTotal/y... One of the things I loved about contributing to YARA all these years was the care with which things were designed...

After many, many hours trying to debug why my python interpreter is getting SIGKILL'ed just by trying to initialize some wasm code inside it it turns out the answer is just yeeting my laptop out the window like it was baby Simba.

"The popular definition of 'simple' among programmers has moved from 'few moving parts' to 'short invocation' (easy) and this is a problem." Not my quote but I stand by it. Another good one: "Layers of abstraction become boundaries of competence" That one is Travis Goodspeed I think.

If you like to use python and are interested in YARA rule linting:

When people talk about rust as a safer language they are usually talking about memory safety, but one of the things I like about it is the Result and Option enums. Sure, you can build something similar in other languages, and I would argue the ones that provide similar abstractions by default…

If you want to test out my YARA rule linting work use this PR: github.com/VirusTotal/y... If you want to get the basic gist of it, this config file change has documentation on it: github.com/VirusTotal/y... Just set it in your config file and use "yr check" for now. Happy #100DaysOfYARA. ;)

Do you like to have a standard way to name your YARA rules? My work will now warn you if your rule name doesn't match a regex of your choosing.

I've gone through multiple iterations on how I want to implement linting. Had it working with a custom Linter struct but getting nice reporting out of it was proving to be rather difficult. Now I've implemented it directly into the compiler and get nice reporting mostly for free (see screenshot).

Now that I have it working I realized mixing a formatter with a linter is not the right approach. So I am moving all this to a new cmd “yr lint” - should have the branch up soon.

On the "yr fmt" improvements: Still have some work to do to plumb errors back up and display them nicely, fix up some test cases and add some quality of life ideas, but the gist is now there thanks to @jacoblatonis.me - he helped me with some basic rust knowledge I just don't have yet. A thread...

Spent a bit of time adding some new features to “yr fmt” that I suspect will be well liked and very useful if you write a lot of rules and like consistency. I have the gist of it but am stumbling over some rust intricacies for the first time. Maybe by the end of the year I’ll have it done.

New release. Little changes over time lead to big things!

I've used the phrase "open source middle finger" for when someone says (or implies) "patches welcome" as a way to mean "yeah, this is a problem but I'm not going to fix it." Now I have just used the term "open source FOH" which is when someone says "works for me" as a way to say "FOH with that."

While I don’t necessarily disagree I think a lot of the NIH syndrome comes from the fact that they have built decades of engineering foundations and often shoe-horning outside tech to work with it is a lot of work and a maintenance nightmare. It’s more about intertia than hubris.

Because I don't think Victor is on here (yet?) to post this himself. This is a significant milestone. Congrats to everyone who has contributed along the way!

Had to take all my piercings out for the first time in more than half my life. It’s weird seeing myself in the mirror without them or not hearing the rattle when I turn my head quickly.