New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇 ghst.ly/3VSdm7h

1/2 LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced. Patched in October. Blog: specterops.io/blog/2026/10/2… PoC: github.com/grayhatkiller/swi…

The #SOCON2027 Call for Presentations is open! 🙌 Discovered, built, broken, or defended something in identity security or Attack Paths? We want to hear about it. Submit a 25- or 50-minute session proposal by November 13: ghst.ly/4scIMRS

New from the Tradecraft Academy 👇 Built in partnership w/ @OpenAI through OpenAI Daybreak Defense Network, Adversary Intelligence: LLM Tradecraft provides hands-on training to build, evaluate, attack, & defend LLM & agentic systems. More from @harmj0y: ghst.ly/4AAOLn7

We instituted an official AI Writing Policy at @Clay. Massive thanks to @sophiebits on our engineering team who wrote this. Originally this was just for eng, but other teams found it so helpful we expanded it company-wide. Here are the four guiding principles: 1. You must stand behind every idea and sentence It is your responsibility to make sure that the entire document is representative of your own thoughts before you share it. 2. Writing is thinking Spending time on the writing process teaches you more about your topic. If you circumvent this process, you will walk away with a poorer understanding of the subject matter. 3. More time should be spent writing a document than consuming it If you generate a document from a short prompt then ask your readers to go through the longer output, you are disrespecting their time. They can talk to ChatGPT themselves if they want to. 4. Longer is not better AI makes it easy to generate long docs, and it loves padding them with sentences that say nothing. If you're producing docs from a short prompt, consider just sharing the prompt. You can read (and borrow) the full policy below. Hopefully we all communicate a bit more clearly now :)

Where is AI useful in offensive security today? Our latest research covers analysis, tool development, vulnerability discovery and reporting, plus what still fails and how offsec teams can adopt AI in their workflows. Read more from @ne0nd0g ⤵️ ghst.ly/4hqiS7Y

Our team is at #InfosecNashville 🤠 Stop by to say hi to the team, discuss your burning questions on identity attack path management & BloodHound, and grab some swag!

Introducing SpecterOps Skills: a public repository built to turn practitioner knowledge into reusable, reviewable workflows for AI-assisted security work. @zinic shares what we're building, why we're building it, and how you can contribute ➡️ ghst.ly/4ybT6ew

We're back with a new #BloodHoundBasics post from @SadProcessor! Ready to take your #BloodHound skills to the next level? Head over to the SpecterOps Tradecraft Academy and dive into our free BloodHound Basics Workshop. (1/4)

AI coding agents leave a lot behind on endpoints. Consulting Services intern @atomiczsec built Blacklight to show defenders exactly what's exposed and how to monitor it. Covering Claude Code, Codex, Cursor, and Gemini CLI. Check it out! ghst.ly/4g03vT8

ConfigManBearPig adds SCCM attack paths to the BloodHound graph, including all of the known hierarchy TAKEOVERs. I rewrote 2.0 in Python and added a ton of features that make it easier and more reliable to use, whether you're on offense or defense. Let me know what you find!

Your attack surface doesn't stop at AD. BloodHound Enterprise now supports AWS & Microsoft Entra Agent ID. We're also introducing BloodHound Hunter to bring attack path intel into AI workflows. Learn more ➡️ ghst.ly/4fZQN7W

Super excited for this! On-demand training from SpecterOps has been years in the making and this is just the beginning.

Introducing Tradecraft Academy 📚 Our new on-demand training platform brings the practitioner-led education we are known for to learners anywhere, anytime. Get started with BloodHound Basics today. Read more: ghst.ly/4ywKLmM Start learning: ghst.ly/4wBbZqE

If you're at Blackhat USA next month, I'm giving a talk on the Wednesday. Currently working on the presentation and attempting to avoid other rabbit holes until it's done! Excited to talk about this 😈 #BHUSA blackhat.com/us-26/briefings…

New blog post is up looking at how LLMs are making local EDR rulesets, YARA rules, and behavioral detections trivial to extract. This post focuses on how simple the harness can be. Buckle up h4xx0rs, the next few months are gonna get interesting! specterops.io/blog/2026/06/2…

What happens when a new Mythic agent can be generated, tested, and deployed in ~2 hours? @_xpn_ explores "disposable tooling" and the implications for offensive operations and defenders alike. Check out the latest from GhostWorks ⬇️ ghst.ly/4oMyrdC

Our team will be all over #BHUSA! 🎓 4 hands-on trainings 🎤 3 technical briefings 🛠️ 5 Arsenal sessions Stay in the loop on all we have going on that week. ➡️ specterops.io/black-hat/

Scale indirect prompt-injection testing w/ Codex-driven automation by turning payload development into a generate-inject-test-analyze-repeat loop. Antero Guy used it to explore indirect prompt-injection behavior against a custom Claude Sonnet 4.5/4.6 agent ghst.ly/4us3EnJ

New blog post is up looking at what GEPA is, and how it can be used for refining prompts for security agents. specterops.io/blog/2026/06/0…