Stuart Ashenbrenner
@stuartjash.bsky.social
📤 166
📥 38
📝 8
Principal macOS Security Researcher @ Huntress | 🏀 Skill Development Coach | 🖼️📖
reposted by
Stuart Ashenbrenner
Phil Stokes ⫍🐠⫎
28 days ago
You know how ppl say you can't decompile run-only
#AppleScript
... 😜
#macOS
#security
0
4
3
reposted by
Stuart Ashenbrenner
Binary Ninja
4 months ago
One of the coolest new things in Binary Ninja 5.1? Pseudo Objective‑C. Huge shoutout to Mark, who actually wrote this before joining the team (talk about an overkill job application). If you’re digging into iOS, Swift, or kernelcaches, this one’s a game‑changer.
0
4
3
reposted by
Stuart Ashenbrenner
Kenneth Kinion
6 months ago
Hot on the heels of the researched published by
@huntress.com
, hunting for Zoom-themed lures from DPRK's
#BlueNoroff
💥Learn hunting techniques 💥Leverage new Validin features and data 💥Full, unredacted indicator list (domains, IPs, hashes)
www.validin.com/blog/zooming...
loading . . .
Zooming through BlueNoroff Indicators with Validin | Validin
Pivoting through recently-reported indicators to find BlueNoroff-associated domains
https://www.validin.com/blog/zooming_through_bluenoroff_pivots/
1
2
2
reposted by
Stuart Ashenbrenner
alden
6 months ago
excited bc today
@huntress.com
is releasing our analysis of a gnarly intrusion into a web3 company by the DPRK's BlueNoroff!! 🤠 we've observed 8 new pieces of macOS malware from implants to infostealers! and they're actually good (for once)!
www.huntress.com/blog/inside-...
loading . . .
Inside the BlueNoroff Web3 macOS Intrusion Analysis | Huntress
Learn how DPRK's BlueNoroff group executed a Web3 macOS intrusion. Explore the attack chain, malware, and techniques in our detailed technical report.
https://www.huntress.com/blog/inside-bluenoroff-web3-intrusion-analysis
1
29
21
Been busy this week digging in to a BlueNoroff attack.
add a skeleton here at some point
6 months ago
0
3
0
reposted by
Stuart Ashenbrenner
Brandon Dalton
6 months ago
Sadly no new ES events for macOS 26. There are a few nice event property updates and additions to the process structure though :)
0
4
1
reposted by
Stuart Ashenbrenner
Lindsey O’Donnell Welch
8 months ago
Some good takeaways from
@huntress.com
’s recent Tradecraft Tuesday ft. Patrick Wardle: -The impact of Apple bringing TCC events to Endpoint Security -#Mac malware persistence techniques vs BTM -Security alert inundation for
#macOS
users Catch up here⤵️
www.huntress.com/blog/say-hel...
loading . . .
Say Hello to Mac Malware | Huntress
In this month’s Tradecraft Tuesday, we talked about how threat actors are finetuning their macOS malware in order to maintain persistent access and avoid detection by Apple’s security features.
https://www.huntress.com/blog/say-hello-to-mac-malware-a-tradecraft-tuesday-recap
0
2
3
reposted by
Stuart Ashenbrenner
Binary Ninja
7 months ago
You asked, we delivered: Binary Ninja 5.0 brings major iOS reversing upgrades! DYLD Shared Cache is now a first-class feature, with up to 18x faster performance and way smarter analysis across the board.
binary.ninja/2025/04/23/5...
1
12
5
reposted by
Stuart Ashenbrenner
alden
8 months ago
finally got around to rewriting the copy as yara binja plugin! 🥰 has a few quality of life improvements (new formats) and address wildcarding is fixed for ARM! (sorry bout that mac homies) ❤️ it's also now available in the plugin repository! 🔥
github.com/ald3ns/copy-...
0
7
2
reposted by
Stuart Ashenbrenner
Jamie Levy 🦉
8 months ago
✅Are you well versed in Linux? ✅Do you understand Linux internals and eBPF? ✅ Do you like building out POCs? ✅Do you understand cyber threats and forensic artifacts? 💥Become a Principal Linux Researcher at
@huntress.com
Apply here: 👉
job-boards.greenhouse.io/huntress/job...
loading . . .
Principal Security Researcher - Linux
Remote US
https://job-boards.greenhouse.io/huntress/jobs/6524934003
0
6
4
reposted by
Stuart Ashenbrenner
golby
8 months ago
Finally! 🥳
objective-see.org/blog/blog_0x...
loading . . .
TCCing is Believing
Apple finally adds TCC events to Endpoint Security!
https://objective-see.org/blog/blog_0x7F.html
0
3
2
reposted by
Stuart Ashenbrenner
Phil Stokes ⫍🐠⫎
8 months ago
s1.ai/readup
🐚 Adware loaders are always the most complex! Props to
@syrion89.bsky.social
for helping me pull apart all these different bins and figuring out what they had in common and how to attribute and detect them. 🦾
#adware
#malware
#macOS
#security
@sentinelone.com
@sentinellabs.bsky.social
loading . . .
ReaderUpdate Reforged | Melting Pot of macOS Malware Adds Go to Crystal, Nim and Rust Variants
A widespread campaign with binaries written in different source languages, ReaderUpdate presents unique challenges for detection and analysis.
https://s1.ai/readup
0
7
5
macOS Malware Knowledge Base: I've been putting together a KB of sorts of macOS malware research. So next time you are writing about some malware family, you can just visit here and see all technical articles written about any particular family. Still a WIP.
notes.crashsecurity.io/notes/b/06C7...
loading . . .
Notes
https://notes.crashsecurity.io/notes/b/06C749EC-4BB5-4D23-82EF-B64444AF4C5D/Malware-Knowledge-Base
9 months ago
0
5
2
reposted by
Stuart Ashenbrenner
Greg Lesnewich
9 months ago
Trying to attribute DPRK cryptoheist activity? Here’s a quick pocket attribution guide Remember to practice your DPRK ABC(TT)s
0
13
5
reposted by
Stuart Ashenbrenner
XPN
9 months ago
Brilliant talk from
@scott.hanselman.com
on the realities on LLMs. The temperature demo is such a good way to explain the "magic" behind text generation.
www.youtube.com/watch?v=kYUi...
loading . . .
Keynote: AI without the BS, for humans - Scott Hanselman - NDC London 2025
YouTube video by NDC Conferences
https://www.youtube.com/watch?v=kYUicaho5k8
1
47
16
reposted by
Stuart Ashenbrenner
Kenneth Kinion
9 months ago
Found these likely
#Lazarus
/
#TraderTraitor
domains w/
#Validin
getcoinprice[.]info stocksindex[.]org wfinance[.]org stockinfo[.]io Read my how-to on leveraging Validin's exceptional visibility, history, and pivoting features for C2 infrastructure forensics:
www.validin.com/blog/bybit_h...
loading . . .
Lazarus Group Bybit Heist: C2 forensics | Validin
An in-depth hunt for Lazarus APT group infrastructure related to the Bybit hack using Validin's host response and DNS databases.
https://www.validin.com/blog/bybit_hack_infrastructure_hunt/
0
5
2
reposted by
Stuart Ashenbrenner
Rob Joyce
11 months ago
For all my math peeps out there: 2025 is pretty amazing mathematical arrangement. 1. 2025 is a perfect square (45×45=2025) 2. 2025 is the sum of digits of cubes from 1 to 9 (1³ + 2³ + 3³ + ... + 9³ = 2025) 3. 2025 is the first square year after 1936 (Cont…)
19
349
150
Entering EOY PTO in the throes of a sleep regression is like taking a gulp of water after a run and realizing it’s tonic.
12 months ago
0
1
0
Our talk from
@objective-see.bsky.social
is now available online. Check out
@re.wtf
and I yap about macOS infostealers.
www.youtube.com/watch?v=Hv6A...
loading . . .
#OBTS v7.0: "Stealer Crossing: New Horizons" - Alden Schmidt & Stuart Ashenbrenner
YouTube video by Objective-See Foundation
https://www.youtube.com/watch?v=Hv6A2XcUv2s
12 months ago
1
10
4
reposted by
Stuart Ashenbrenner
Csaba Fitzl
12 months ago
📣I’m happy to announce that I’m planning to write a brand new “macOS Vulnerability Research” training. 🥳 Considering the amount of work the writing requires it will be available late 2025 or early 2026. It will be Live class only, and likely only once or twice a year.
0
20
5
reposted by
Stuart Ashenbrenner
Raphaela Mettig
12 months ago
I'm having
#OBTS
FOMO, so I decided to go ahead and make my own Apple security starter pack! I'm definitely missing folks on here, so feel free to DM me about anyone else who should be added! 🍎
go.bsky.app/gE3xQq
add a skeleton here at some point
0
4
2
#OBTS
has wrapped. Next year has so much on deck 👀 - TAOMM v2 book @patrickwardle - MacOS Threat Hunting book @jbradley89 - MacOS Vuln Training
@theevilbit.bsky.social
- OFTW v3 @objective_see - WeTalks v1 @x71n3 - OBTS v8 in Ibiza Awesome stuff coming from the macOS security space 🙌
12 months ago
0
9
1
reposted by
Stuart Ashenbrenner
Brandon Dalton
12 months ago
Shout-out to the incredible Huntress crew for the special T-shirt 🏝️ and a killer
#OBTS
presentation by
@stuartjash.bsky.social
and
@re.wtf
!
0
7
1
reposted by
Stuart Ashenbrenner
Jacob Latonis
12 months ago
Catch
@greg-l.bsky.social
and I talking about Mach-O binary similarity methods, YARA-X, and all the cool APT malware we pulled apart at
#OBTS
v7 today at 11:50am HST 🌺
1
7
5
Yesterday I got to present with the 🐐
@re.wtf
. Such a blast talking thru infostealers and the telenovela that they’ve become.
#OBTS
really is the best, chillest conference out there. Excited for a second day of talks 🤓🍎
12 months ago
0
13
1
reposted by
Stuart Ashenbrenner
XPN
about 1 year ago
Good lineup of books!
www.humblebundle.com/books/hackin...
loading . . .
Humble Tech Book Bundle: Hacking 2024 by No Starch
Level up your hacking and skills with this tech bundle from No Starch. Learn to protect yourself and others! Pay what you want & support charity!
https://www.humblebundle.com/books/hacking-2024-no-starch-books
1
20
9
reposted by
Stuart Ashenbrenner
Jacob Latonis
12 months ago
@re.wtf
🐐
@stuartjash.bsky.social
🐐
0
7
3
reposted by
Stuart Ashenbrenner
Brandon Dalton
12 months ago
Extremely excited to be giving a talk titled "Mac, Wheres My Bootstrap" tomorrow at
#OBTS
with
@theevilbit.bsky.social
! Join us live on YouTube or in-person at 2:40pm HST / 7:40pm EST. We'll be dropping a tool you can walk away with :)
0
9
4
reposted by
Stuart Ashenbrenner
Phil Stokes ⫍🐠⫎
about 1 year ago
@sentinelone.com
is hiring -
#macOS
detection engineer.
www.sentinelone.com/jobs/?gh_jid...
loading . . .
Careers at SentinelOne
Take a look at the open positions at SentinelOne. We're dedicated to defending enterprises across endpoints, containers, cloud workloads, and IoT devices in a single cybersecurity platform.
https://www.sentinelone.com/jobs/?gh_jid=6268424003
0
6
7
A few files in my macOS notes got updated, especially XProtect to reflect some its newer changes in macOS Sequoia.
notes.crashsecurity.io/notes
loading . . .
Notes
https://notes.crashsecurity.io/notes
about 1 year ago
0
4
1
reposted by
Stuart Ashenbrenner
Binary Ninja
about 1 year ago
Don't Panic! The answer: version 4.2 of Binary Ninja, is now available. Check out the release blog post which shows: - New PseudoC/Python/Rust decompilation - DLYD Shared Cache Support - WARP Signature System And many other impactful features.
https://binary.ninja/2024/11/20/4.2-frogstar.html
2
34
16
you reached the end!!
feeds!
log in