Its been two weeks since (my workshop at) @botconf.infosec.exchange.ap.brid.gy 2026, and last weekend I found some time to write about my experience: maxkersten.nl/2026/04/27/m...

The debugger got some real love in our latest update. Hardware breakpoints and conditional breakpoints have both landed, and the new debug adapters make things faster and more reliable across a range of workflows. Read more from the latest blog: binary.ninja/2026/04/13/b...

CertGraveyard's PKI Lab is available now. Want to better understand code-signing certificates? The site allows you to extract and view certificates. The Cert Inspection tool parses out all of the bits and flags anomalies. 1/2

So @xorhex.bsky.social asked (in our YARA keybase chat) how one might only iterate through the last 10 matches of a string in YARA. I took a shot at answering it by logging the last 10 locations of a match in descending order: for all i in (0..10): (console.log(@a[#a - i]))

MalChela 3.2: More Cowbell? More Intel! One of the things I value most about the open-source community is that the best improvements to a tool often don’t come from inside it — they come from outside conversations.  A short while back, the author of mlget, xorhex,  reached out and suggested I add…

For the few people using #BinYars, it has been updated to support #BinaryNinja 5.3 and now targets YARA-X 1.15.0 Update via Binja's plugin manager to get the latest. github.com/xorhex/BinYa... #YARA #YARAX

JSAC 2026 videos: www.youtube.com/playlist?lis... NDSS 2026 videos: www.youtube.com/@NDSSSymposi...

Binary Ninja 5.3 (Jotunheim) is released: binary.ninja/2026/04/13/b... Major updates: NDS32 support, AArch64 ILP32 ABI, new Universal MachO UI, way more containers, command palette upgrade, type library helpers, ghidra gzf export, updated IDB import, HW and conditional breakpoints, and much more!

REWorkshop - Axios supply chain attack retrospective 🔔 twitch.tv/azakasekai 🔔 youtube.com/live/RxeAPsO...

It’s trite but this marks the dawn of a new era of hacking. This is Pandora’s box and we just have to hope that some of the defender benefits outweigh the bad. These are the technical details of the hack of the government of Mexico using AI. cdn.prod.website-files.com/69944dd945f2...

📣 Our own @cxiao.net will be speaking at @rustconf.com this year, with the talk "Reverse Engineering Rust Malware in 2026"! sched.co/2KHt7 Rust is now a popular language not only for writing legitimate software, but also for writing malware. How are malware reversers dealing with this? #RustConf

#binjaextras has been updated to allow for type information to be applied to both struct members and global variables. Local instance of OALab's hashdb has been added as well - see setup info here: github.com/xorhex/binja... Install/update binjaextras via the plugin manager! #BinaryNinja

The history of BumbleBee's relationship with certificates can be viewed a few ways with CertGraveyard. You can review via a table, a graph, or download the whole database to transform the data yourself. 4/4

Two for one today! Added support for console.log(offset, length) to the console module in YARA-X, per the suggestion of a user. Makes it nicer to work with arbitrary sequences of bytes. Hopefully it makes it in the next release!

New: Group member labels, a way to describe yourself or your role in a group chat, only visible to that group chat. Label yourself the “Goalie” to your soccer team or “Favorite Child” to your family to stir some drama. Available on Android, Desktop & iOS signal.org/blog/group-m...

Get your tickets (and CFPs) now! This conference is always a great time and you learn a lot.

Your UEFI firmware can drop a binary into Windows on every boot via Windows Platform Binary Table. OEMs use it for bloatware persistence. Attackers use it the same way. One reg key kills it: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v DisableWpbtExecution /d 1 /t REG_DWORD /f

RE//verse 2026 talks are live on YouTube! Want to revisit a talk or catch the ones you missed? The full playlist is now available: youtube.com/playlist?lis...

My @REverseConf talk about reverse engineering #AoE2 is now available on YouTube: www.youtube.com/watch?v=Dp-I... check it out and hear about some reverse engineering techniques and a code pattern matching tool I released: github.com/ZetaTwo/bnil...

Looking for #RustLang samples to practice your reverse engineering skills on? Just since January, we've added samples from 8 different #malware families to the Rust Malware Sample Gallery: github.com/decoderloop/... 1) KCVY OSLOCK Ransomware 2) An unnamed Rust DDoS botnet 3) FunkSec Ransomware 🧵

RationalEdge REDS now supports #APK analysis for #Android #malware, along with LLM-assisted code explainability. If you're looking for a malware repository/analysis platform, reach at rationaledge.io MoRE to come @rationaledge.bsky.social #ThreatResearch #ThreatIntel #CTI #ReverseEngineering 1/3

The dark money group’s democracyunmuted[.]org domain is almost certainly administered using the same Cloudflare account as demfluencers[.]com. The latter—originally registered in June 2025 and operational in the Nov/Dec timeframe—claims to provide paid opportunities and access for influencers.

📣 #PIVOTcon26 Agenda is here 🤟 We are thrilled to announce the lineup for this year's edition! 2⃣ days and 19 talks from leading #ThreatResearch experts. The agenda link is in the first comment👇, and the talks and speakers are in the thread.🧵 #CTI #ThreatIntel 1/15

Victor just released v1.14.0 - improvements in macho module, tighter code generation in the compiler and the new “deps” command. Congratulations to everyone involved! github.com/VirusTotal/y...

We are still finalising the agenda and the updated website, so the #PIVOTcon26 lineup announcement will be made early next week. #CTI #ThreatIntel #ThreatResearch #StayTuned

never ask a researcher for their config parser code because it's gonna be the most spaghetti thing you've ever seen

Reverse engineers often spend significant time deciphering third-party libraries within firmware. My talk, scheduled for Friday at 5 PM at Reverse, introduces SightHouse, an open-source initiative aimed at automatically identifying third-party functions to enhance analysis efficiency.

@re-verse.io has lighting talks 🤔 Wonder if I can dust the cobwebs off of this deob-CFF project and get it working prior to Saturday. Chances are low but going to try 😅 re-verse.io

PlugX is a long-running Remote Access Trojan (RAT) that has been consistently linked to multiple China-aligned threat actors and espionage operations worldwide. Lab 52 | S2 Grupo lab52.io/blog/plugx-m...

Without exaggeration, one of the most epic DPRK reports ever about.gitlab.com/blog/gitlab-...

RationalEdge's #REDS Platform now supports 🍎 Mach-O 🍏( #iOS + #macOS) and Universal (FAT) binary formats. We now cover: - #PE, #ELF, #MachO - x86/64, ARM/AArch64, MIPS, PowerPC, RISC-V (32/64) @rationaledge.bsky.social rationaledge.io #ThreatResearch #ThreatIntel #CTI #Malware #OT #Embedded 1/3

1/ Today, Insikt Group is publishing on GrayCharlie, a threat actor active since mid-2023 that overlaps with SmartApeSG. GrayCharlie compromises WordPress sites and turns them into malware delivery hubs: www.recordedfuture.com/research/gra...

We've uploaded our stream from last Thursday where we analyzed the Avalon Linux bot with IDA Pro. Throughout this stream we reversed its persistence, C2 functionality, encryption and command dispatcher. Enjoy! www.youtube.com/watch?v=IaWU...

Decrypted/decoded a payload/binary using the Transform API in #BinaryNinja, but need a place to put it: use this to save it to your current project: current_project.create_file(decoded_bytes, name="extracted.bin", folder=None, description="Extracted from: <insert hash of current file>")

Scoop: A report published last week outlined what Palo Alto researchers believed was a China-linked hacking campaign. But after an intervention from execs, the report's language was changed to refer more vaguely to "a state-aligned group that operates out of Asia." www.reuters.com/world/china/...

Nice to see my #BinaryNinja plugins getting some use

🏋️ 𝗡𝗼𝗿𝘁𝗵𝗦𝗲𝗰 𝟮𝟬𝟮𝟲 𝗙𝗼𝗿𝗺𝗮𝘁𝗶𝗼𝗻𝘀/𝗧𝗿𝗮𝗶𝗻𝗶𝗻𝗴𝘀 (5/12): "Deconstructing Rust Binaries" 𝗽𝗮𝗿/𝗯𝘆 Cindy Xiao 📅 Dates: May 11, 12 and 13, 2026 (3 days) 📊 Difficulty: Medium 🖥️ Mode: Hybrid (on-site & remote) 🔗 Training details: nsec.io/training/202... #NorthSec #cybersecurity #malwareanalysis #reverseengineering

github.com/VirusTotal/y... - Once again, new release with some good bug fixes and nice improvements.

How can we detect malicious documents exploiting CVE-2026-21509, the recent 0-day vulnerability in MS Office ? I designed a YARA rule for this, which detects all the malicious files that have been reported. To get the YARA rule and all the explanations: decalage.info/CVE-2026-215...

"State-backed #phishing attacks targeting military officials and journalists on Signal" by Zeljka Zorz, Editor-in-Chief, Help Net Security February 6, 2026 www.helpnetsecurity.com/2026/02/06/s...

Great to collaborate with old friend Duy-Phuc Pham at Trellix on this recent APT28 cluster strikeready.com/blog/apt28s-... www.trellix.com/blogs/resear...

Join us today from 3-5pm ET to learn to recognize and apply types to decompiled C++ that's using virtual functions, inheritance, and vtables. We'll recover missing parameters, apply types, clean up decompilation, and everything else you need to get started reversing C++! youtube.com/live/QmsUmvH...

The CertGraveyard is now being leveraged by MagicSword. MagicSword makes use of certificates we report and blocks them within your environment. I was really amazed by the work they do to block RMM and bad drivers. Now this further enables orgs to block malicious signers. x.com/magicswordio/s...

New blog post is live! Xusheng tears apart a tiny Linux binary that really does not want to be reversed. Malformed ELF headers, segment tricks, layered XOR and RC4, plus a bunch of Binary Ninja tricks along the way. Read it here: binary.ninja/2026/01/23/r...

🦔 📹 New Video: Can office files be malicious without Macros? ➡️ VSTO Add-Ins ➡️ External Templates ➡️ Checklist for Office analysis #MalwareAnalysisForHedgehogs www.youtube.com/watch?v=RtHH...

#BREAKING #ESETresearch identified the wiper #DynoWiper used in an attempted disruptive cyberattack against the Polish energy sector on Dec 29, 2025. At this point, no successful disruption is known, but the malware’s design clearly indicates destructive intent. 1/5

Great work by Kim and ESET to get this story out there. The cyber threat has been off the front pages with everything else going on, but is still very real.

New Children's Health Defense site registered on 1/9/26 and currently in development: covidjustice[.]org covidjustice[.]metalteam[.]dev (69.16.249[.]248, dev site)

We are less than a month away from #PIVOTcon26 #CfP deadline,come present your best research in a trusted,vetted environment attended by some of the best researchers. We created such an environment so that we can feel safe to exchange beyond the blogposts #CTI #ThreatResearch #ThreatIntel #MemeGuide

Carl Svensson is bringing Age of Empires II Definitive Edition to RE//verse 2026 as a playground for tooling. This talk walks through Binary Ninja automation to decrypt and deobfuscate...