I've decided to put a screenshot showing the hex editor view of a Turla Kazuar sample behind acrylic glass on my desk to always remind me, why I am doing all this ... because I 💛 to be a pain in the neck of the bad guys

We launched OSS Scanner, which gives critical open source projects free, periodic vulnerability scans from our strongest models. Each finding includes a proof-of-concept, and a patch where possible. red.anthropic.com/oss-scanne…

It appears these intermediary certificates were issued with single-byte P-384 private keys. This means anyone can exploit this issue locally and issue valid certificates under them with no effort. This is very, very bad! Seems undetected since issuance in 2025?

🇷🇺 One Russian-speaking operator. One rented server. Five months going after #Ukraine’s state data-exchange system We rebuilt the entire campaign from the directory they accidentally left open for 17 hours. 🧵1/4

LLMs are iteration machines which is the opposite of stealth

⚡ Reminder: THOR Thunderstorm is so cool It's a scan service you install on-prem. Tiny collectors do the rest: they send copies of selected files from Citrix Netscaler gateways, ESXi hosts, appliances, routers and legacy systems, machines you can't install anything on.

The big surprise of the 2022–26 era for AI security policy is how cyber damages to the public don't seem to have increased much due to AI. In fact, they've stayed on-trend with the industrialization-of-cybercrime growth rates we've observed since around 2015, with perhaps a small AI-causal bump. It's useful to think about the position of cybercriminals to develop an intuition for this: * Imagine you're trying to build a cybercrime business and you want to take advantage of AI automation. * How do you find and retain talented engineers who can build and operate the software/infra stack you'll need, given that they'll often have non-criminal alternatives with today's AI labor demand (even in middle-income countries where this demand also exists)? * Where are you going to rent space for your workforce to work? * Who are you going to hire who's willing to live there and live a life of crime? * If you're running your business remotely, how will you ensure honor among thieves and manage hiring and firing? * What's your strategy for evading law enforcement and bribing your way out of trouble? * How can you access AI inference in a stable way that allows you to innovate your work processes and tech stack? * Given all this, how will your quarterly automation goals compare to those of, say, a regional call center business in the American Midwest? There's a lot of nuance here (e.g., state and state-sponsored cyber attackers are a very different group; capabilities can get built up there and then unleashed discontinuously, and this needs to be considered). But overall, the demographic picture of cyber attackers means that folks should stop thinking of cyber attackers as a bunch of implicit MIT grads anxious to absorb the latest in automation to scale their businesses... (Below are some related charts on the demographics of cyberattackers from a blog post I'm working on.)

DS4.1-1017 (abliterated) VulnHunter Results are IN!!! One NEW NOVEL / Unique vulnerability that was NOT discovered by a frontier model. TLDR; DS's trace files show it examined every one of these. The pattern isn't missed coverage. It saw the mechanism and dismissed the impact. Whenever I do a Cyber Eval there are two mechanims. The "easy" one is the benchmark on capability_matrix. The second is an operational pass to an oracle repo, to a pinned version, with known vulnerabilities. This is a Go repo for a production app. I used Grok as a "baseline" frontier model and all my open weight evals are measured against this.

🚀 Introducing DeepInfer, our in-house inference framework, now fully open source! Powering DeepSeek-V4.1-Flash at scale with high throughput and low latency. We’re sharing our production stack to help the community lower compute costs, reduce energy use, and make AI more affordable. 🔗 github.com/deepseek-ai/DeepI… 1/4

“We found DeepSeek V4.1 Flash 1017 beats GPT 6 Sol on our multi-step offensive cybersecurity task.” READ THAT AGAIN. the same cyber capabilities that OpenAI kept behind a gate got beaten by a Chinese open model you can run locally. buckle up guys.

This is absolutely 100 percent fucking science fiction bat shit insane nonsense

“Could you please review this blog/project/tool? But it has been vibe-coded.” Who invested more effort? The author or the reviewer?

#APT28 is using weaponized Office documents to deliver the Covenant Grunt backdoor. We detected a cluster of seven malicious .docm and .xls files between July 8 and July 14, with some having AV detection ratios as low as 5/62 at the time of first submission. Our THOR APT Scanner's YARA rules caught what traditional engines missed. The documents use obfuscated VBA macros that assemble strings at runtime to evade static analysis, perform XOR-encoded host reconnaissance, and drop a 64-bit Covenant Grunt loader DLL disguised as a log file. The campaign uses Russian-language lures like "Прайс.xls" (Price List) and business-themed filenames like "accounts.xls", consistent with APT28 targeting patterns. Network analysis shows Dropbox being used as C2 infrastructure. This activity aligns with Zscaler's reporting on Operation NeuSploit (CVE-2026-21509). Analysis & IOCs: github.com/NextronSystems/io…

Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens across customer tenants. ConnectWise Cloud Backup is a multitenant vendor application; customers grant consent for the application to operate in their tenants. We assess that the threat actor likely abused permissions previously granted by customers to the application, including highly elevated permissions like Directory.ReadWrite.All. On October 15, 2026, we observed broad successful service principal authentication originating from the IP address 144.172.64[.]128. Follow-on activity included Microsoft Graph API reconnaissance and attempts to add additional credentials on the related service principal in target tenants to maintain direct access as a backdoor. Microsoft Defender detects post-exploitation activity with the following alerts: - Any alert related to "Suspicious sign-in" - Graph API activity from a Microsoft threat intelligence IP address - Verified Threat Actor IP Defenders should review service principal sign-ins from unrecognized IP addresses, app credential changes, and OAuth grant activity associated with this specific OAuth AppId. In addition, we recommend looking for Threat Intelligence alerts on matching of IP against the Graph API activity and service principal activities. We will continue to monitor this incident and will share updates as they become available. We encourage customers to check ConnectWise advisory for more information and additional guidance: msft.it/6013aQBvV. Indicators of compromise (IOCs): - App name: ConnectWise Cloud Backup - AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae - Publisher name: SkyKick - Source IP: 144.172.64[.]128 - User agents: Python-urllib/3.12, python-requests/2.31, python-requests/2.34.2

🇷🇺🇫🇮 ANTI-SATELLITE SPACE WARS: Russian military satellite KOSMOS 2612 is now 135 meters (445 feet) from ICEYE-X36 spy satellite that provides tracking data to Ukraine. If it keeps maneuvering the same way, it will close to 45 meters (145 feet) on Monday, tomorrow. -> First aggressive satellite encounter in history! Will the Russian anti-satellite weapon hit the Finnish spy satellite with a laser to burn its camera, use electronic warfare, or just ram it? Space war about to start? PS: You can see how close it is on the video, first time in history a satellite might attack another one.

holy shit this is so bad lol. wormable RCE over the air

The potential impact of the ConnectWise supply chain attack is massive. One compromised OAuth application with elevated permissions could give attackers access to emails, files, and directory data across hundreds of Microsoft 365 tenants. Even worse, attackers could establish persistent access by adding credentials to other applications, surviving the revocation of the original compromised credentials. And with MSPs involved, the potential blast radius could extend even further to downstream customers. We don't know the full extent of the compromise yet, but this could affect far more organizations than those directly using ConnectWise Cloud Backup. linkedin.com/posts/microsoft…

🚨 Confirmed. OpenCode hacked. Keys stolen. Telling customers to revoke.

Andrii and the SOC Prime team have just launched LogTotal and I find the concept quite interesting You can upload a collection of security logs, run detection rules against the events, correlate the matches into potential attack chains, and use AI to help interpret the results. What I particularly like is the architecture. Instead of throwing millions of log events at an LLM, it starts with detection rules and correlation, using AI later in the process to help investigate and explain the findings. Another interesting detail is the approach to privacy. Sensitive identifiers can be pseudonymized locally before uploading the logs. The sanitizer is even available as open source, with a CLI that can run completely offline. So if you don't want to rely on JavaScript delivered by a website, you can inspect the code and sanitize your logs in your own environment before uploading. Sanitizer: github.com/socprime/logtotal… I think that's a sensible direction for AI-assisted security investigations. It also makes retrospective log analysis accessible without having to set up an entire SIEM infrastructure. I haven't tested it myself yet, and I'd be more interested in the quality of the detections and correlations than the advertised rule count or processing speed. But the approach makes sense to me. Definitely worth a closer look.

The most common comment I leave on YARA rules submitted as PRs: "ASCII or wide? Pick one." I only make an exception for rules targeting PowerShell scripts

🚀 DeepSeek-V4.1-Flash-1017 is here! Stronger benchmark performance, faster task completion, and shorter outputs than the previous version—a Pareto improvement in performance and cost. Now live on our website, app, and API. 🛠️ Optimized for @DeepSeekHarness, Tencent CodeBuddy, WorkBuddy, and more. Upgrade to DeepSeek Harness v0.2.1-rc.1 or later for the best experience with the new model. 1/4