Suspicious domain ms365update[.]com was registered through MonoVM on 6/22/26 using juliarhorton@onionmail[.]org (H/t @domaintools.bsky.social). Today the domain began using Cloudflare and its subdomain www.ms365update[.]com now redirects to Google DNS.

Google Threat Intelligence Group has conducted an in-depth analysis of a .NET backdoor, tracked as STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla cloud.google.com/blog/topics/... @googlecloud

github.com/VirusTotal/y... This fixes an issue with certain header constraints that you really should update for. There are other nice bug fixes and features too, but the header constraints is a big one.

The slides from our @reconmtl.bsky.social talk with @nicolo.dev on agentic deobfuscation are now online. Topics: commercial VMs, anti-cheat, DRM systems, malware, and anti-agentic obfuscation. Slides: synthesis.to/presentation...

My name is Daniel Gordon and I am writing to let you know that you have a serious problem. Next week I will be speaking at FirstCon about The Art of Notification. Distilled lessons learned from hundreds of victim notifications I’ve done over the years. www.first.org/conference/2...

Iranian and Russian shadow fleet vessels, along with multiple sanctions evasion networks (SENs), are using online infrastructure likely designed to facilitate sanctions evasion. Recorded Future www.recordedfuture.com/research/cyb... @recorded-future.bsky.social

@volexity.com has published details from an incident response engagement in September 2025 involving multiple #BRICKSTORM variants deployed by a threat actor that Volexity tracks as VerdantBamboo. [1/4]

See you at RustConf! :D

Operation Dragon Weave: Uncovering a China-Linked Campaign Targeting Czech Republic and Taiwan Using Azure Cloud C2 Seqrite APT Team www.seqrite.com/blog/operati... @seqrite.bsky.social

#PIVOTcon26 edition is over! Time to #pivot to #PIVOTcon27 Big thanks to our sponsors for making this happen! @silentpush.bsky.social @vertexproject.bsky.social @censys.bsky.social @urlscan-bot.bsky.social #validin @talosintelligence.com (continued...) 🔽 1/3

Very excited to present at RustConf this year! :D

Its been two weeks since (my workshop at) @botconf.infosec.exchange.ap.brid.gy 2026, and last weekend I found some time to write about my experience: maxkersten.nl/2026/04/27/m...

The debugger got some real love in our latest update. Hardware breakpoints and conditional breakpoints have both landed, and the new debug adapters make things faster and more reliable across a range of workflows. Read more from the latest blog: binary.ninja/2026/04/13/b...

CertGraveyard's PKI Lab is available now. Want to better understand code-signing certificates? The site allows you to extract and view certificates. The Cert Inspection tool parses out all of the bits and flags anomalies. 1/2

So @xorhex.bsky.social asked (in our YARA keybase chat) how one might only iterate through the last 10 matches of a string in YARA. I took a shot at answering it by logging the last 10 locations of a match in descending order: for all i in (0..10): (console.log(@a[#a - i]))

MalChela 3.2: More Cowbell? More Intel! One of the things I value most about the open-source community is that the best improvements to a tool often don’t come from inside it — they come from outside conversations.  A short while back, the author of mlget, xorhex,  reached out and suggested I add…

For the few people using #BinYars, it has been updated to support #BinaryNinja 5.3 and now targets YARA-X 1.15.0 Update via Binja's plugin manager to get the latest. github.com/xorhex/BinYa... #YARA #YARAX

JSAC 2026 videos: www.youtube.com/playlist?lis... NDSS 2026 videos: www.youtube.com/@NDSSSymposi...

Binary Ninja 5.3 (Jotunheim) is released: binary.ninja/2026/04/13/b... Major updates: NDS32 support, AArch64 ILP32 ABI, new Universal MachO UI, way more containers, command palette upgrade, type library helpers, ghidra gzf export, updated IDB import, HW and conditional breakpoints, and much more!

REWorkshop - Axios supply chain attack retrospective 🔔 twitch.tv/azakasekai 🔔 youtube.com/live/RxeAPsO...

It’s trite but this marks the dawn of a new era of hacking. This is Pandora’s box and we just have to hope that some of the defender benefits outweigh the bad. These are the technical details of the hack of the government of Mexico using AI. cdn.prod.website-files.com/69944dd945f2...

📣 Our own @cxiao.net will be speaking at @rustconf.com this year, with the talk "Reverse Engineering Rust Malware in 2026"! sched.co/2KHt7 Rust is now a popular language not only for writing legitimate software, but also for writing malware. How are malware reversers dealing with this? #RustConf

#binjaextras has been updated to allow for type information to be applied to both struct members and global variables. Local instance of OALab's hashdb has been added as well - see setup info here: github.com/xorhex/binja... Install/update binjaextras via the plugin manager! #BinaryNinja

The history of BumbleBee's relationship with certificates can be viewed a few ways with CertGraveyard. You can review via a table, a graph, or download the whole database to transform the data yourself. 4/4

Two for one today! Added support for console.log(offset, length) to the console module in YARA-X, per the suggestion of a user. Makes it nicer to work with arbitrary sequences of bytes. Hopefully it makes it in the next release!

New: Group member labels, a way to describe yourself or your role in a group chat, only visible to that group chat. Label yourself the “Goalie” to your soccer team or “Favorite Child” to your family to stir some drama. Available on Android, Desktop & iOS signal.org/blog/group-m...

Get your tickets (and CFPs) now! This conference is always a great time and you learn a lot.

Your UEFI firmware can drop a binary into Windows on every boot via Windows Platform Binary Table. OEMs use it for bloatware persistence. Attackers use it the same way. One reg key kills it: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v DisableWpbtExecution /d 1 /t REG_DWORD /f

RE//verse 2026 talks are live on YouTube! Want to revisit a talk or catch the ones you missed? The full playlist is now available: youtube.com/playlist?lis...

My @REverseConf talk about reverse engineering #AoE2 is now available on YouTube: www.youtube.com/watch?v=Dp-I... check it out and hear about some reverse engineering techniques and a code pattern matching tool I released: github.com/ZetaTwo/bnil...

Looking for #RustLang samples to practice your reverse engineering skills on? Just since January, we've added samples from 8 different #malware families to the Rust Malware Sample Gallery: github.com/decoderloop/... 1) KCVY OSLOCK Ransomware 2) An unnamed Rust DDoS botnet 3) FunkSec Ransomware 🧵

RationalEdge REDS now supports #APK analysis for #Android #malware, along with LLM-assisted code explainability. If you're looking for a malware repository/analysis platform, reach at rationaledge.io MoRE to come @rationaledge.bsky.social #ThreatResearch #ThreatIntel #CTI #ReverseEngineering 1/3

The dark money group’s democracyunmuted[.]org domain is almost certainly administered using the same Cloudflare account as demfluencers[.]com. The latter—originally registered in June 2025 and operational in the Nov/Dec timeframe—claims to provide paid opportunities and access for influencers.

📣 #PIVOTcon26 Agenda is here 🤟 We are thrilled to announce the lineup for this year's edition! 2⃣ days and 19 talks from leading #ThreatResearch experts. The agenda link is in the first comment👇, and the talks and speakers are in the thread.🧵 #CTI #ThreatIntel 1/15

Victor just released v1.14.0 - improvements in macho module, tighter code generation in the compiler and the new “deps” command. Congratulations to everyone involved! github.com/VirusTotal/y...

We are still finalising the agenda and the updated website, so the #PIVOTcon26 lineup announcement will be made early next week. #CTI #ThreatIntel #ThreatResearch #StayTuned

never ask a researcher for their config parser code because it's gonna be the most spaghetti thing you've ever seen

Reverse engineers often spend significant time deciphering third-party libraries within firmware. My talk, scheduled for Friday at 5 PM at Reverse, introduces SightHouse, an open-source initiative aimed at automatically identifying third-party functions to enhance analysis efficiency.

@re-verse.io has lighting talks 🤔 Wonder if I can dust the cobwebs off of this deob-CFF project and get it working prior to Saturday. Chances are low but going to try 😅 re-verse.io

PlugX is a long-running Remote Access Trojan (RAT) that has been consistently linked to multiple China-aligned threat actors and espionage operations worldwide. Lab 52 | S2 Grupo lab52.io/blog/plugx-m...

Without exaggeration, one of the most epic DPRK reports ever about.gitlab.com/blog/gitlab-...

RationalEdge's #REDS Platform now supports 🍎 Mach-O 🍏( #iOS + #macOS) and Universal (FAT) binary formats. We now cover: - #PE, #ELF, #MachO - x86/64, ARM/AArch64, MIPS, PowerPC, RISC-V (32/64) @rationaledge.bsky.social rationaledge.io #ThreatResearch #ThreatIntel #CTI #Malware #OT #Embedded 1/3

1/ Today, Insikt Group is publishing on GrayCharlie, a threat actor active since mid-2023 that overlaps with SmartApeSG. GrayCharlie compromises WordPress sites and turns them into malware delivery hubs: www.recordedfuture.com/research/gra...

We've uploaded our stream from last Thursday where we analyzed the Avalon Linux bot with IDA Pro. Throughout this stream we reversed its persistence, C2 functionality, encryption and command dispatcher. Enjoy! www.youtube.com/watch?v=IaWU...

Decrypted/decoded a payload/binary using the Transform API in #BinaryNinja, but need a place to put it: use this to save it to your current project: current_project.create_file(decoded_bytes, name="extracted.bin", folder=None, description="Extracted from: <insert hash of current file>")

Scoop: A report published last week outlined what Palo Alto researchers believed was a China-linked hacking campaign. But after an intervention from execs, the report's language was changed to refer more vaguely to "a state-aligned group that operates out of Asia." www.reuters.com/world/china/...

Nice to see my #BinaryNinja plugins getting some use

🏋️ 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝟮𝟬𝟮𝟲 𝗙𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻𝘀/𝗧𝗿𝗮𝗶𝗻𝗶𝗻𝗴𝘀 (5/12): "Deconstructing Rust Binaries" 𝗽𝗮𝗿/𝗯𝘆 Cindy Xiao 📅 Dates: May 11, 12 and 13, 2026 (3 days) 📊 Difficulty: Medium 🖥️ Mode: Hybrid (on-site & remote) 🔗 Training details: nsec.io/training/202... #NorthSec #cybersecurity #malwareanalysis #reverseengineering

github.com/VirusTotal/y... - Once again, new release with some good bug fixes and nice improvements.

How can we detect malicious documents exploiting CVE-2026-21509, the recent 0-day vulnerability in MS Office ? I designed a YARA rule for this, which detects all the malicious files that have been reported. To get the YARA rule and all the explanations: decalage.info/CVE-2026-215...