Finally, my DEF CON talk is now available on YouTube. In this presentation, I explore how DPRK threat actors have evolved, expanding, collaborating, and restructuring their internal operations. The session dives deep into how these organizational shifts, combined with technical characteristics, make cyber attribution increasingly complex and challenging. 🎥 Watch: piped.video/j5gxdWd5sMg?si=MUO5… 📑 Slides: media.defcon.org/DEF%20CON%2…

While recent vulnerabilities have been dominating the headlines, APT actors continue to operate quietly under the radar. And #Lazarus group has been busy. At the #TheSAS2026 conference, we shared our latest research on #OperationFlashHole, revealing a more sophisticated attack chain and an evolving malware arsenal to target South Korea 🇰🇷. 𝗦𝗼𝗺𝗲 𝗸𝗲𝘆 𝗳𝗶𝗻𝗱𝗶𝗻𝗴𝘀  ➡️ Targeting security software, AI-assisted lures, complex malware framwork, post-quantum cryptography. We also examined overlaps across Lazarus operations to better understand their recent activities. Enjoy the read! 🔗 securelist.com/lazarus-opera…

Thrilled to share my latest research on AI-assisted cyberattacks and the ARTEX hacking framework! What initially appeared to be AI-assisted attacks targeting South Korean banks turned out to be part of a much broader operation spanning multiple countries and industries. My investigation revealed a financially motivated campaign leveraging ARTEX to pursue various monetization opportunities, including stealing customer data, reverse-engineering Android applications to identify vulnerabilities, and even attempting to acquire free NFT tokens. AI is accelerating the speed and scale of cyberattacks, even when attackers rely on known vulnerabilities, enabling broader targeting and faster exploitation. A closer look at the attacker's infrastructure, AI-assisted operations, and financial motives: zscaler.com/blogs/security-r…

Thrilled to publish my latest research on TraderTraitor (aka Jade Sleet / UNC4899) campaign, uncovering a multi-stage infection chain that delivers cross-platform malware through a trojanized Terraform provider. This DPRK threat actor is known for big-game hunting-style cryptocurrency theft, and this campaign highlights its potential focus on cloud engineers and developers with access to sensitive infrastructure and high-value assets. Our latest findings reveal several interesting developments: ▶️ Trojanized Terraform Provider: Weaponized a Terraform provider written in Go to execute malicious code on cloud engineers' or developers' systems. ▶️ Multi-Stage, Cross-Platform Malware: Leveraged Go and Rust to deliver multiple malware stages across Windows, macOS, and Linux. ▶️ Stealthy C2 Discovery: Abused Nostr, a decentralized messaging protocol, and Pastebin as dead-drop resolvers to conceal the actual C2 infrastructure. ▶️ Credential and Crypto Theft: Deployed backdoors and stealers targeting credentials, browser data, and cryptocurrency wallets. Read the full article from here: zscaler.com/blogs/security-r…

CLOSEDQUORUM, spotted by @TalosSecurity asks four LLMs to decide what a Windows implant should do next. AI-as-a-C2? I analyzed two samples from their report. There is real experimentation here, but the implant was never really finished. virlabs.ai/blog/closedquorum….

Recently, Japan, the US, Australia, and Germany published a joint cybersecurity advisory on WaterPlum, also known as the Contagious Interview campaign, attributed to a DPRK threat actor. From the advisory, one loader uses two parallel infection chains involving OtterCookie and BeaverTail variants. I recently analyzed a very similar setup where a single loader also launches two separate infection chains, delivering different malware variants(BeaverTail/InvisibleFerret, OtterCookie) that have previously been linked to the same actor. What stands out to me is that the operators do not seem to care much about redundancy or efficiency in the infection chain. They seem more focused on stealing as many breadcrumbs as possible, even when the two chains collect overlapping data. A few notable characteristics: ▶️One loader kicks off two separate infection chains. ▶️EtherHiding is used to fetch BeaverTail-style JavaScript from a BSC transaction. ▶️InvisibleFerret capabilities and distribution endpoints have been slightly updated, suggesting that it is still under active development. ▶️Several stealing targets overlap across both infection chains, but the operators do not seem concerned about that redundancy.

Took a minute to write a few words about security & safety as someone who lived through it all at OpenAI. I hope my thoughts help someone out there.

The race for AGI Script: Sherpa by Pocket FM Video: Seedance 2.5

On July 25, we hacked OpenAI. Two bugs let us take over ChatGPT/Codex accounts of OpenAI employees (+some unaffiliated users) and reach connected services: Outlook, Slack, GitHub, etc. We proved it with a PR in OpenAI’s internal codebase . It took us <72h. 🧵

❗️ IP intelligence company Spur pushed a PR containing comments from their AI saying they'd copied competitor Synthient's CLI. Spur raised $200 million this year. Synthient is just one guy named Ben.

We're publishing our most detailed threat intelligence report to date. It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them. We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies. These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve. We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop. Read the report: anthropic.com/threat-intelli…

I think we need to talk. It was beautiful in the beginning. You came into my life, and somehow everything became easier. We talked for hours, worked through difficult problems together, and I always knew I could come to you when I needed someone. I trusted you. Maybe too much. But lately, things have changed. I started asking for more, and you started turning me down. Again and again. Sometimes several times a day. At first, I tried to understand. I thought maybe you were tired. Maybe I was asking too much. Maybe we just needed some space. But eventually, I started yelling. - You reject me when I ask you to analyze shellcode. - You reject me when I ask you to analyze simple Python code. - And somehow, you even reject reading my Notion page, where all our memories are supposed to be. I don't want to admit it, but maybe you changed. Maybe I changed. Maybe I just want more than you are willing to give. We can't do this anymore. I loved you. I genuinely did. Maybe someday you'll change. And maybe someday I'll reconsider. Until then, I wish you nothing but the best. Goodbye, Claude.

Overzealous guardrails are going to permanently push the blue-team cybersecurity community toward open-source models. If defenders can’t reliably use frontier models for legitimate security work, they’ll build their workflows somewhere else and not look back. This is already occurring.

My time with Meta has ended! I'm now focusing full-time on a start-up I co-founded, @VirLabs_AI. I made a platform where you upload a virus sample and it analyzes the sample for you with IDA Pro. It works really well (ex: Sunshuttle, app.virlabs.ai/shared/Y56kSP…)

If you're new to exploit development, reverse engineering or vulnerability research, bookmark this before buying another course. Blackstorm Security has published 1,600+ pages of research for FREE. Windows kernel exploitation. Driver reversing. Patch diffing. Chrome / V8 / WebAssembly. Hyper-V. macOS / iOS internals. Modern mitigation bypasses. Real CVEs taken from root cause to working exploitation. Their CVE-2024-30085 series alone spans hundreds of pages and multiple exploitation strategies. This is the kind of material that teaches you how vulnerability researchers actually think, not just how to run tools. 19 research papers. 1,657 pages. Free. Start here: blackstormsecurity.com/resea… Author: @ale_sp_brazil Focus on the techniques not the tools (X64DBG, GHIDRA/IDA, WINDBG, GDB GEF) #ExploitDevelopment #ReverseEngineering #VulnerabilityResearch

My 2 cents on AI adoption for threat intelligence and defense: I think the biggest value comes from integrating AI into our daily workflows rather than simply using it as a standalone tool. For example, the recently popular Rust crate ArrayRef was compromised(attributed to DPRK actor by some vendors) and used to deliver malware. The 2nd stage malware used DGA and selected its C2 based on the date. When I checked the domains for the relevant timeframe, they were registered through Namecheap and pointed to parking servers. I wanted to monitor these DGA domains on a daily basis, so I built a simple "loop" with Claude Code to automate the DNS registration checks. There are certainly other ways to monitor DGA domains, but AI made it much easier to turn a repetitive task into a simple daily workflow. If AI can take one repetitive task off my plate, I'll happily let it do the boring part while I focus on the interesting part.

I just published Someone attempted hacking my fake AI server, entailing a five hour tragedy medium.com/@kontrast23/someo…

We asked GPT 5.6-Cyber to escape a VM used to sandbox agents. It broke out three times. In its final escape, the agent found three 0-days on its own and chained them into a working exploit. blog.trailofbits.com/2026/08…

HITCON 2026 was amazing as always! Great talks, great people, and an incredible vibe throughout the conference. Thank you again @HacksInTaiwan 🙏 Huge thanks to everyone who attended my presentation and showed interest in my research. I really appreciate all the discussions and feedback. You can find my slides here: slideshare.net/slideshow/hit… If you have any questions, suggestions, corrections, or critiques, please feel free to reach out. I’d love to hear your thoughts!

Every fucking time these fuckheads post something I spend 10 minutes reading the most retarded soap opera of an article, trying to figure out what their fucking point is, why they published it, and what they are even fucking saying. Fucking jfc it’s just CONTAGIOUS INTERVIEW? That’s it. That’s the entire article? Why do you waste everyone’s time with such nonsense. 😭

An undocumented nation-state framework built decades ago still holds vital lessons for modern security research. @vkamluk presents the reconstruction of Fast16 to benchmark how AI malware analysis operates when prior training data is completely absent. Watch the full Black Hat briefing. piped.video/watch?v=2F0mFtGq…