Founder of ThreatBook. ex Microsoft TwC, ex Amazon InfoSec.
- Tweets 227
- Following 3,582
- Followers 2,038
- Likes 135
Clearly targeting a customized version of Windows for China
‼️ An unknown APT group likely poisoned the supply chain of a custom Windows 10 build for Asian governments, Kaspersky says.
Its NetamLoader malware hid in a Windows Update folder among real Patch My PC files and ran via Microsoft-signed .NET code.
3
17
1,991
People keep asking - how can I detect or stop AI Agent attacks?
People kept asking me for “ARTEX signatures” and “Cairn indicators”, so I wrote this
We found useful fingerprints and wrote rules. But identifying the framework isn’t the same as covering the attacks it orchestrates.
I wanted to explain that distinction, why attribution gets harder, and how noisy attacks can still succeed by moving fast.
I expect these frameworks to have a much bigger impact in the coming months. It’s worth understanding the technology behind the current attack waves, because I suspect they’ll build into a flood.
#ARTEX #Cairn
nextron-systems.com/2026/10/…
230
One of the best NDR products，seriously
ThreatBook TDP® named a Visionary Leader in Frost & Sullivan's Frost Radar™: Network Detection and Response, 2026.
The report notes TDP's advantages in hybrid deployment and open integration.
na2.hubs.ly/H08J6xP0
4
378
The 1st case of open weight model to weak cyber capabilities: Moonshot AI cuts cyber training data from open-weight Kimi K3.1 Pro, dropping its internal exploit success from 90.5% to 81%.
For the open-weight release, Moonshot removed cyber-related data from both mid-training and RL stages (while keeping general coding data) to reduce misuse risk. This followed analysis showing that such content was naturally present in broad training and that unrestricted scaling would substantially boost cyber capabilities.
Results on their internal xdev-bench-hard(real-source-code vulnerability discovery/exploitation tasks from software like the Linux kernel, Node.js, etc., with mitigations enabled):
• Unfiltered checkpoint: 90.5% (pass@3)
• Final released K3.1 Pro: 81.0%
The filtering meaningfully lowers cyber performance versus the unrestricted version, yet the model still improves substantially over prior Kimi K3 due to stronger general coding and long-horizon skills. Its offensive cyber capability remains behind frontier proprietary models that have been public for months.
Moonshot’s stated approach is to avoid pushing the absolute cyber frontier in open weights while gradually making dual-use defensive capabilities more widely available.
#Kimi #k3 #Cyber
5
2
548
I can't agree on this.
Even the non-abliterated version are good at finding vulnerabilities, trivial to bypass if needed at all. so it's basically saying "part of it are because of open source models ".
Not to mention that many people have access to cyber programs of OAI and Anthropic.
I strongly believe a part of why so many critical vulnerabilities are happening all over the proliferation of "abliterated" models, or models with safeguards removed.
You can access an abliterated GLM 5.3, a near frontier AI model, on @abliteration_ai today. And it's a world class penetration tester for like $10.
6
763
Seems folks are getting stable universal RCE for mod_php, but not PHP-FPM yet?
#php2shell
2
343
Is it mapping for PHP applications? Or real exploit shoot?
PHP2Shell (CVE-2026-109618/109619) hit our MadPot honeypots on Oct 17, four days before disclosure.
Investigating? Start your timeline there, not at the advisory date. Patch to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 now.
aws.amazon.com/blogs/securit…
1
274