I'm happy to share that LIEF 0.17.0 is out: lief.re/blog/2025-09...

#ESETresearch has discovered #HybridPetya ransomware on VirusTotal: a UEFI-compatible copycat of the infamous Petya/NotPetya malware. HybridPetya is capable of bypassing UEFI Secure Boot on outdated systems. www.welivesecurity.com/en/eset-rese... 1/8

#ESETResearch has discovered the first known AI-powered ransomware, which we named #PromptLock. The PromptLock malware uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts on the fly, which it then executes 1/7

This explanation of Passkeys and FIDO2 is really good 👍 michaelwaterman.nl/2025/04/02/h...

Even though I've been away from the field for years, it's great to see that a simple tool that I initially launched in 2018 and with great collaborators (Artur Marzano, Corey Forman and Christian Clauss) has been used by so many professionals. www.helpnetsecurity.com/2025/03/26/m... #malware

Merci @gabrielthierry.bsky.social de revenir sur l'histoire incroyable des #ShadowBrokers en plusieurs parties #MustRead Partie 1 open.substack.com/pub/pwned/p/... Partie 2 open.substack.com/pub/pwned/p/... Partie 3 open.substack.com/pub/pwned/p/...

Do you know examples of polyglot files that have been used in real-life to hide malware from detection/analysis tools? There is at least this PDF/MHT: blogs.jpcert.or.jp/en/2023/08/m... Do you know other real malware cases?

I made a Doom source port that runs within a PDF file. PDFs support Javascript, so Emscripten is used to compile Doom to asm.js, which is then run within the PDF engine. Input/output is done by manipulating text input fields. doompdf.pages.dev/doom.pdf github.com/ading2210/do...

The nineth article (38 pages) of the Malware Analysis Series (MAS) is available on: exploitreversing.com/2025/01/08/m... Even though I haven't been on this subject for years, I promised I would write a series of ten articles, and the last one will be released next week (JAN/15). #malware

New DCOM lateral movement technique discovered that bypasses traditional defenses. Unlike previous attacks relying on IDispatch interfaces, this method exploits undocumented COM interfaces within MSI, specifically targeting IMsiServer and IMsiCustomAction interfaces. 1/7