We are less than a month away from #PIVOTcon26 #CfP deadline,come present your best research in a trusted,vetted environment attended by some of the best researchers. We created such an environment so that we can feel safe to exchange beyond the blogposts #CTI #ThreatResearch #ThreatIntel #MemeGuide

Carl Svensson is bringing Age of Empires II Definitive Edition to RE//verse 2026 as a playground for tooling. This talk walks through Binary Ninja automation to decrypt and deobfuscate...

github.com/VirusTotal/y... - 1.11.0 is out! Lots of new features, modules and bug fixes. Read the release notes and congrats to Victor and the contributors!

🚨#100DaysofYARA lives!! 2 time reigning champ Yashraj has kindly offered to take the helm for this community effort! Give the homie a follow 👊 Check the repo to contribute: github.com/100DaysofYARA And gear up for Jan 1 when #100DaysofYARA will kick off!

You asked for our traditional #CfP meme-guideline for #PIVOTcon26 - here it is 🥳🎉 Reminder: - one track,30m - no recording/streaming/tweeting. - No TLP:WHITE - Original content only #CTI #ThreatIntel #ThreatResearch 1/7

📣🦀 Announcing: TWO 2026 sessions for our Rust reverse engineering course, Deconstructing Rust Binaries! 1) Ringzer0 COUNTERMEASURE, March 23-26, Remote: ringzer0.training/countermeasu... 2) NorthSec (@nsec.io), May 11-13, Montréal & Remote: nsec.io/training/202... #malware #infosec #rustlang

Excited to bring Deconstructing Rust Binaries to NorthSec in March! Chat with me here or at @decoderloop.com if you have questions about the training. Take advantage of the early bird rate for the onsite option! Pricing is in CAD, take advantage of the exchange rate (: nsec.io/training/202...

Targeting of Lithuania's government today cc @lithuaniaineu.bsky.social 0c6ba3f0ab6f48c84175db68eb4f0d19

I spent a couple months arguing with Claude and Copilot while building FrostyGoop variants for DNP3 (and Modbus), keeping detailed notes on what worked and what didn't. At S4, I’ll share my honest assessment of these tools and how they might lower barriers to ICS malware dev. See you in Miami!

Proud to share new research by Amazon Threat Intelligence detailing recent activity by Sandworm/APT44 🇷🇺 targeting US and European energy, critical infrastructure, and managed security provider networks via vulnerable and misconfigured network edge devices. #threatintel aws.amazon.com/blogs/securi...

Ongoing european government targeting from this susp ru actor. Surely others are focused on the politics of Transnistria, but not too many. strikeready.com/blog/russian...

🦀 Looking for Rust malware samples to practice analyzing? Our Rust Malware Sample Gallery just received a major update, with 20 new families added! github.com/decoderloop/... #rust #rustlang #malware #infosec #ReverseEngineering #MalwareAnalysis #reversing

I'm hiring a senior threat researcher! If you want to help me build out a team to track the most advanced actors targeting cloud environments, this is the job for you. This job is open to remote, but us-bases only. Feel free to reach out with questions. www.wiz.io/careers/job/...

Just posted my thoughts on maldev academy! Apologies if it’s a little messy, it’s reporting week at work so it’s all text editing all day right now. www.winterknight.net/maldev-acade...

Quality of life improvement for yara-x: I realized the functions that output hash values do not have constraints on them like the hash module functions do. See virustotal.github.io/yara-x/blog/... for details on why this is useful to extend everywhere. PR that fixes it: github.com/VirusTotal/y...

#BinYars (write #YARA-X rules inside of #BinaryNinja) is now available in Binja's plugin manager! I want to give a special shout out to @cxiao.net (Thank You 🙏) who provided valuable feedback making the plugin experience better. Happy rule writing! Learn more @ github.com/xorhex/BinYars

the amount of businesses that use GoPhish as an otherwise legitimate mailer is ... concerning

A new blog this evening from Amazon Threat Intelligence detailing ongoing China-nexus cyber actors leveraging React2Shell (CVE-2025-55182): aws.amazon.com/blogs/securi...

1/ Today we release a new report exposing previously undisclosed entities connected to the wider #Intellexa ecosystem as well as newly identified activity clusters in Iraq and indications of activity in Pakistan: www.recordedfuture.com/research/int...

Videos and papers from this year's @virusbtn.bsky.social in Berlin are now available online. Amazing conference and looking forward to the next one: www.youtube.com/@virusbtn

And #FlareOn12 Task 8: wp.me/p2mVNF-2Qf

#PIVOTcon26 #CfP is open and you can submit your proposals till 6 FEB 2026 CfP rules and submissions here: pretalx.com/pivotcon26/cfp #ThreatIntel #ThreatResearch #CTI

As tempting as it might be, don’t use recursion when writing a #binaryninja workflow.

I'm offering a rare public Applied #CTI training course for cyber threat intelligence in evening North America/morning Australia/Asia in January - register your interest soon if you would like to attend mission-focused #ThreatIntel training! forms.gle/i3n4srD6hWzf...

First release is ready! Hoping to have it included soon in @binary.ninja's plugin manager 🤞

Don't forget to run: cargo install-update -i yara-x-cli

Binary Ninja 5.2 adds support for custom string formats and constant encodings. Instead of wrestling with odd or obfuscated values, you can teach Binja how they work and let the analysis reveal the real content anywhere it appears.

Yara-x 1.10.0 released today! It can now automatically fix some warnings, and some improvements in code generation. This is another great step forward for the project. github.com/VirusTotal/y...

Came across an interesting DLL sideloading case today: Normally when Steam\bin\steam_monitor.exe loads up, it will load Steam\crashhandler.dll as part of the loading process. When loading the crashhandler.dll dependency, steam_monitor.exe checks for the path of the tier0_s.dll to-

Made this last night, it’s useful for finding a large number of domains hosting phishing kits or malware based on a consistent pattern github.com/singe/domain-p… Might be useful for some of you.

Long overdue, but here’s my writeup for #FlareOn12 Task 9: hshrzd.wordpress.com/2025/11/20/f...

Come work with Amazon Cyber Threat Intelligence (ACTI) focusing on the threats targeting Amazon, AWS, and our subsidiaries! US citizenship required, in-office across multiple US locations. DM with questions! www.amazon.jobs/en/jobs/3120...

Tune in at tomorrow at 10:30 AM EST for #BSidesPyongyang25. Stream live on Twitch or YouTube h̲t̲t̲p̲s̲://w̲w̲w̲.t̲w̲i̲t̲c̲h̲.t̲v̲/b̲s̲i̲d̲e̲s̲p̲y̲o̲n̲g̲y̲a̲n̲g̲

Fun little #YARA-X challenge: say you identified a string at an offset - how can you get yara-x to print the length of the string via the "console" module? Assumptions: - Null terminated string - It's a string pointer versus a string match, so ! won't work - variable name: offset - length =< 100

Finally put this up for review in a PR (github.com/VirusTotal/y...) - it's now in it's own command and has been tested on some pretty gnarly graphs of rules. If you have huge dependency graphs the output gets messy, but it works well otherwise.

less known way to calculate sha256 of files on Windows disksnapshot -c -k -v c:\test will print out file info including sha256 for every file in the directory

The final call is here. CFP submissions close at midnight! Our review board is ready to dig in and see what you have been working on. Get your talk in now: sessionize.com/reverse-2026

Binary Ninja 5.2, Io, is live and it's out of this world! binary.ninja/2025/11/13/b... With some of our most requested features of all time including bitfield support, containers, hexagon, Ghidra import, and a huge upgrade to TTD capabilities, plus a ton more, make sure to check out the changelog!

#PIVOTcon26 registration is now OPEN 🤟📷 #ThreatResearch #ThreatIntel 📷https://pivotcon.org Please read carefully the whole 🧵 for the rules about invite -> registration (1/6)🌐

1/ [UPDATE] As of November 10, 2025, metaspinner net GmbH has provided substantial evidence confirming Insikt Group’s original assessment that their identity was unlawfully and fraudulently used in the registration of #AS209800.

Squeeeee 🥳 I'll be teaching my Advanced Linux Malware Reverse Engineering class at RE//verse conference in 2026!! MORE Linux APT insides and peculiarities😍🥰🤩Pls share if you can🙃 shop.binary.ninja/products/re-...

Excited to share another blog where Amazon Cyber Threat Intelligence (ACTI) discovered APT exploitation of zero-day vulnerabilities in Cisco and Citrix products. Proud of the team’s work! aws.amazon.com/blogs/securi...

If you're interested in my dependency querying code for yara rules check out my deps branch: github.com/wxsBSD/yara-... You can build it with "cargo build --features=debug-cmd" and use it like "yr debug deps -h". My TODO list for this is basically: - Write tests - Move to it's own command

The slides and materials from @cxiao.net's "Reversing a (not-so-) Simple Rust Loader" workshop at Ringzer0 COUNTERMEASURE today are now available! github.com/decoderloop/... #rustlang #ReverseEngineering #MalwareAnalysis #infosec #reversing #malware #binaryninja #COUNTERMEASURE25 #ringzer0

Back-to-back-to-back streams! Join us again today at 4pm ET to meet Marion Marschalek, and get a taste of what Advanced Linux Malware Reverse Engineering at RE//verse 2026 will be like! Ask your questions during the stream or reply with them here! youtube.com/live/R72mHPl...

You know how ppl say you can't decompile run-only #AppleScript ... 😜 #macOS #security

D3 viz of Symbiote malware call graph created with @binaryninja.bsky.social. Interactive, and makes pewpew sounds. The pewpew sounds are naturally the most important analysis feature, duh. Code going public soon.

An interesting article talking about public attribution and the lack thereof in Indonesia and India on @bindinghook.bsky.social. bindinghook.com/india-and-in...

We hear you! Registration opens next week, so keep an eye on our social media. The registration link, also known as the 'Ask for invite', will soon be available on pivotcon.org #PIVOTcon26 #CTI #ThreatIntel #StayTuned

New Iran drop from me tracking an attribution nightmare - UNK_SmudgedSerpent! A little Charming, a little Muddy, and a lot C5. Targeting policy experts with benign conversation starters, health-themed infra, OnlyOffice spoofs, and RMMs. Check out the full story www.proofpoint.com/us/blog/thre...