📣 #PIVOTcon26 Agenda is here 🤟 We are thrilled to announce the lineup for this year's edition! 2⃣ days and 19 talks from leading #ThreatResearch experts. The agenda link is in the first comment👇, and the talks and speakers are in the thread.🧵 #CTI #ThreatIntel 1/15

Victor just released v1.14.0 - improvements in macho module, tighter code generation in the compiler and the new “deps” command. Congratulations to everyone involved! github.com/VirusTotal/y...

We are still finalising the agenda and the updated website, so the #PIVOTcon26 lineup announcement will be made early next week. #CTI #ThreatIntel #ThreatResearch #StayTuned

never ask a researcher for their config parser code because it's gonna be the most spaghetti thing you've ever seen

Reverse engineers often spend significant time deciphering third-party libraries within firmware. My talk, scheduled for Friday at 5 PM at Reverse, introduces SightHouse, an open-source initiative aimed at automatically identifying third-party functions to enhance analysis efficiency.

@re-verse.io has lighting talks 🤔 Wonder if I can dust the cobwebs off of this deob-CFF project and get it working prior to Saturday. Chances are low but going to try 😅 re-verse.io

PlugX is a long-running Remote Access Trojan (RAT) that has been consistently linked to multiple China-aligned threat actors and espionage operations worldwide. Lab 52 | S2 Grupo lab52.io/blog/plugx-m...

Without exaggeration, one of the most epic DPRK reports ever about.gitlab.com/blog/gitlab-...

RationalEdge's #REDS Platform now supports 🍎 Mach-O 🍏( #iOS + #macOS) and Universal (FAT) binary formats. We now cover: - #PE, #ELF, #MachO - x86/64, ARM/AArch64, MIPS, PowerPC, RISC-V (32/64) @rationaledge.bsky.social rationaledge.io #ThreatResearch #ThreatIntel #CTI #Malware #OT #Embedded 1/3

1/ Today, Insikt Group is publishing on GrayCharlie, a threat actor active since mid-2023 that overlaps with SmartApeSG. GrayCharlie compromises WordPress sites and turns them into malware delivery hubs: www.recordedfuture.com/research/gra...

We've uploaded our stream from last Thursday where we analyzed the Avalon Linux bot with IDA Pro. Throughout this stream we reversed its persistence, C2 functionality, encryption and command dispatcher. Enjoy! www.youtube.com/watch?v=IaWU...

Decrypted/decoded a payload/binary using the Transform API in #BinaryNinja, but need a place to put it: use this to save it to your current project: current_project.create_file(decoded_bytes, name="extracted.bin", folder=None, description="Extracted from: <insert hash of current file>")

Scoop: A report published last week outlined what Palo Alto researchers believed was a China-linked hacking campaign. But after an intervention from execs, the report's language was changed to refer more vaguely to "a state-aligned group that operates out of Asia." www.reuters.com/world/china/...

Nice to see my #BinaryNinja plugins getting some use

🏋️ 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝟮𝟬𝟮𝟲 𝗙𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻𝘀/𝗧𝗿𝗮𝗶𝗻𝗶𝗻𝗴𝘀 (5/12): "Deconstructing Rust Binaries" 𝗽𝗮𝗿/𝗯𝘆 Cindy Xiao 📅 Dates: May 11, 12 and 13, 2026 (3 days) 📊 Difficulty: Medium 🖥️ Mode: Hybrid (on-site & remote) 🔗 Training details: nsec.io/training/202... #NorthSec #cybersecurity #malwareanalysis #reverseengineering

github.com/VirusTotal/y... - Once again, new release with some good bug fixes and nice improvements.

How can we detect malicious documents exploiting CVE-2026-21509, the recent 0-day vulnerability in MS Office ? I designed a YARA rule for this, which detects all the malicious files that have been reported. To get the YARA rule and all the explanations: decalage.info/CVE-2026-215...

"State-backed #phishing attacks targeting military officials and journalists on Signal" by Zeljka Zorz, Editor-in-Chief, Help Net Security February 6, 2026 www.helpnetsecurity.com/2026/02/06/s...

Great to collaborate with old friend Duy-Phuc Pham at Trellix on this recent APT28 cluster strikeready.com/blog/apt28s-... www.trellix.com/blogs/resear...

Join us today from 3-5pm ET to learn to recognize and apply types to decompiled C++ that's using virtual functions, inheritance, and vtables. We'll recover missing parameters, apply types, clean up decompilation, and everything else you need to get started reversing C++! youtube.com/live/QmsUmvH...

The CertGraveyard is now being leveraged by MagicSword. MagicSword makes use of certificates we report and blocks them within your environment. I was really amazed by the work they do to block RMM and bad drivers. Now this further enables orgs to block malicious signers. x.com/magicswordio/s...

New blog post is live! Xusheng tears apart a tiny Linux binary that really does not want to be reversed. Malformed ELF headers, segment tricks, layered XOR and RC4, plus a bunch of Binary Ninja tricks along the way. Read it here: binary.ninja/2026/01/23/r...

🦔 📹 New Video: Can office files be malicious without Macros? ➡️ VSTO Add-Ins ➡️ External Templates ➡️ Checklist for Office analysis #MalwareAnalysisForHedgehogs www.youtube.com/watch?v=RtHH...

#BREAKING #ESETresearch identified the wiper #DynoWiper used in an attempted disruptive cyberattack against the Polish energy sector on Dec 29, 2025. At this point, no successful disruption is known, but the malware’s design clearly indicates destructive intent. 1/5

Great work by Kim and ESET to get this story out there. The cyber threat has been off the front pages with everything else going on, but is still very real.

New Children's Health Defense site registered on 1/9/26 and currently in development: covidjustice[.]org covidjustice[.]metalteam[.]dev (69.16.249[.]248, dev site)

We are less than a month away from #PIVOTcon26 #CfP deadline,come present your best research in a trusted,vetted environment attended by some of the best researchers. We created such an environment so that we can feel safe to exchange beyond the blogposts #CTI #ThreatResearch #ThreatIntel #MemeGuide

Carl Svensson is bringing Age of Empires II Definitive Edition to RE//verse 2026 as a playground for tooling. This talk walks through Binary Ninja automation to decrypt and deobfuscate...

github.com/VirusTotal/y... - 1.11.0 is out! Lots of new features, modules and bug fixes. Read the release notes and congrats to Victor and the contributors!

🚨#100DaysofYARA lives!! 2 time reigning champ Yashraj has kindly offered to take the helm for this community effort! Give the homie a follow 👊 Check the repo to contribute: github.com/100DaysofYARA And gear up for Jan 1 when #100DaysofYARA will kick off!

You asked for our traditional #CfP meme-guideline for #PIVOTcon26 - here it is 🥳🎉 Reminder: - one track,30m - no recording/streaming/tweeting. - No TLP:WHITE - Original content only #CTI #ThreatIntel #ThreatResearch 1/7

📣🦀 Announcing: TWO 2026 sessions for our Rust reverse engineering course, Deconstructing Rust Binaries! 1) Ringzer0 COUNTERMEASURE, March 23-26, Remote: ringzer0.training/countermeasu... 2) NorthSec (@nsec.io), May 11-13, Montréal & Remote: nsec.io/training/202... #malware #infosec #rustlang

Excited to bring Deconstructing Rust Binaries to NorthSec in March! Chat with me here or at @decoderloop.com if you have questions about the training. Take advantage of the early bird rate for the onsite option! Pricing is in CAD, take advantage of the exchange rate (: nsec.io/training/202...

Targeting of Lithuania's government today cc @lithuaniaineu.bsky.social 0c6ba3f0ab6f48c84175db68eb4f0d19

I spent a couple months arguing with Claude and Copilot while building FrostyGoop variants for DNP3 (and Modbus), keeping detailed notes on what worked and what didn't. At S4, I’ll share my honest assessment of these tools and how they might lower barriers to ICS malware dev. See you in Miami!

Proud to share new research by Amazon Threat Intelligence detailing recent activity by Sandworm/APT44 🇷🇺 targeting US and European energy, critical infrastructure, and managed security provider networks via vulnerable and misconfigured network edge devices. #threatintel aws.amazon.com/blogs/securi...

Ongoing european government targeting from this susp ru actor. Surely others are focused on the politics of Transnistria, but not too many. strikeready.com/blog/russian...

🦀 Looking for Rust malware samples to practice analyzing? Our Rust Malware Sample Gallery just received a major update, with 20 new families added! github.com/decoderloop/... #rust #rustlang #malware #infosec #ReverseEngineering #MalwareAnalysis #reversing

I'm hiring a senior threat researcher! If you want to help me build out a team to track the most advanced actors targeting cloud environments, this is the job for you. This job is open to remote, but us-bases only. Feel free to reach out with questions. www.wiz.io/careers/job/...

Just posted my thoughts on maldev academy! Apologies if it’s a little messy, it’s reporting week at work so it’s all text editing all day right now. www.winterknight.net/maldev-acade...

Quality of life improvement for yara-x: I realized the functions that output hash values do not have constraints on them like the hash module functions do. See virustotal.github.io/yara-x/blog/... for details on why this is useful to extend everywhere. PR that fixes it: github.com/VirusTotal/y...

#BinYars (write #YARA-X rules inside of #BinaryNinja) is now available in Binja's plugin manager! I want to give a special shout out to @cxiao.net (Thank You 🙏) who provided valuable feedback making the plugin experience better. Happy rule writing! Learn more @ github.com/xorhex/BinYars

the amount of businesses that use GoPhish as an otherwise legitimate mailer is ... concerning

A new blog this evening from Amazon Threat Intelligence detailing ongoing China-nexus cyber actors leveraging React2Shell (CVE-2025-55182): aws.amazon.com/blogs/securi...

1/ Today we release a new report exposing previously undisclosed entities connected to the wider #Intellexa ecosystem as well as newly identified activity clusters in Iraq and indications of activity in Pakistan: www.recordedfuture.com/research/int...

Videos and papers from this year's @virusbtn.bsky.social in Berlin are now available online. Amazing conference and looking forward to the next one: www.youtube.com/@virusbtn

And #FlareOn12 Task 8: wp.me/p2mVNF-2Qf

#PIVOTcon26 #CfP is open and you can submit your proposals till 6 FEB 2026 CfP rules and submissions here: pretalx.com/pivotcon26/cfp #ThreatIntel #ThreatResearch #CTI

As tempting as it might be, don’t use recursion when writing a #binaryninja workflow.

I'm offering a rare public Applied #CTI training course for cyber threat intelligence in evening North America/morning Australia/Asia in January - register your interest soon if you would like to attend mission-focused #ThreatIntel training! forms.gle/i3n4srD6hWzf...