Greg Lesnewich

Excited to publish my first @bindinghook.bsky.social piece on challenging assumptions of how Iranian cyber ops function in wartime & the discrepancy between capability/intent signals from peacetime. What does the evidence say on how cyber/kinetic interact in conflict? bindinghook.com/what-does-th...

it’s time to give Ms Rachel a gundam

#ESETresearch hunted for additional context and found that we detected this backdoor between 2020-11 and 2023-11, targeting financial services sector in the Netherlands and Kazakhstan. 1/6 x.com/genthreatlab...

Most exciting @threatinsight.proofpoint.com drop yet - in collaboration with NSA - and the product of @greg-l.bsky.social's blood, sweat, and tears. Research into two Russian actors throwing half-click exploits against mailservers. Part 1 on TA488 / Void Blizzard www.proofpoint.com/us/blog/thre...

On this day 35 years ago, HEIR TO THE EMPIRE was released

Dodgers broadcast was discussing the science behind the perception of time between children and adults. After hearing the explanation, the color commentator pauses and asks, "Am I gonna feel any better?" Andy Pages then smashes a dinger into space, thus ending the existential crisis on commentary.

After 11 years of silence at Black Hat, I am delivering a speech today. In memory of a legendary APT Hunter, Mr Sergey Mineev, who passed away 40 days ago. If you cannot attend, here is the write-up: www.sentinelone.com/labs/fast16-...

After 11 years, I'm returning to the Black Hat stage. The last time, in 2015, I gave a joint talk with INTERPOL - their first-ever appearance at Black Hat. If you're around, come support me tomorrow - I promise the talk goes well beyond what you'll find in the abstract.

PEMDAS, but for the correct order to eat fruit snacks

Easter dinner was a movie (a delicious Dune knock off)

This is what happens when I take time off, I actually write silly length blog posts and deep dive things blog.zsec.uk/bullyingllms/ the post dives into a MCP pipeline I've put together for autonomous 0day hunts.

RationalEdge #REDS new release: Maliciousness #Score, #AI Assisted Full Sample Analysis, and a new #Behaviour Panel. rationaledge.io/blog/malicio... @rationaledge.bsky.social #ThreatResearch #ThreatIntel #CTI #Malware #MalwareAnalysis #ReverseEngineering 1/4

Proofpoint has directly observed a targeted email campaign that delivers DarkSword RCE, and we attribute the messages to Russian FSB threat actor TA446 with high confidence. 🧵

I’m not interested in skinny propaganda in any form I was on board when Oprah was built up like a Baltimore row house

Them Europeans cannot be your standard for beauty… they almost died because they wouldn’t wash their hands

📣 #PIVOTcon26 Agenda is here 🤟 We are thrilled to announce the lineup for this year's edition! 2⃣ days and 19 talks from leading #ThreatResearch experts. The agenda link is in the first comment👇, and the talks and speakers are in the thread.🧵 #CTI #ThreatIntel 1/15

Can someone smarter than me tell me if the cyber strategy for america from the regime means anything for me personally?

Christopher Kempczinski bit into that burger like it was the first time he'd every tasted a McDonalds burger AND... This is actually a case study on how American companies no longer promote within

Staying off socials to keep my mentals in order but had to come in here to say that I’m certain Bad Bunny had more yards from scrimmage than the Pats in that first half

#BREAKING #ESETresearch identified the wiper #DynoWiper used in an attempted disruptive cyberattack against the Polish energy sector on Dec 29, 2025. At this point, no successful disruption is known, but the malware’s design clearly indicates destructive intent. 1/5

You fear innovation

"A superpower is choosing to self-immolate and torch its remaining global trust and friendships, including and especially NATO...at the precise moment when it had been reinvigorated and renewed...in the wake of Russia’s large-scale invasion of Ukraine in 2022" - by @vermontgmg.bsky.social

They have quite an operation going. www.mprnews.org/episode/2026...

I don’t think we’ve collectively paid enough attention to the fact that Annie’s is now the regent of boxed Mac and cheese Kraft got their chain snatched and now it just tastes like dog water compared to Annie’s

#100daysofYARA - day 12 VirusTotal uses CAPE sandbox to identify many malware families and determine if they can extract the malware's configuration. Since they use CAPE, we can often see their logic. Today, we'll suggest edits to a rule for AgentTesla. Rule at end. 1/10

Imagine publishing a blog on "Lazarus" in the year of our lord 2026

#100DaysofYARA - Day 11 In looking at automatic YARA generation, yarGen-Go is a must. Just released by @cyb3rops, it is a rewrite and advancement from the original yarGen. We'll look at the same malware from day 10; a targeted HavocC2 loader with decoy. rule at bottom 1/5

This scripts are deceptive as they contain 10,000 empty lines. BTW #malcat loads scripts like these better than most text editors. If I get the chance, I may revise it to see how to find ones without the matching text or if you have ideas, hmu. github.com/Squiblydo... 3/3

The rule is fairly simple but it seems that at least one DPRK team is using the same consistent message in the header. I validated this using ReversingLab's YARA scanning. A slightly different header is seen in Huntress' analysis: www.huntress.com/blo... 2/3

#100DaysofYARA - Day 9 YARA looks for the header used in a .SCPT file used by BlueNoroff (DPRK) to target MacOS systems. Script is delivered to victims disguised as a Zoom meeting launcher. e.g. a7c7d75c33aa809c231f1b22521ae680248986c980b45aa0881e19c19b7b1892 Rule at end 1/3

#100DaysofYARA - Day 8 For many years, many attackers tried to keep their binaries small. However, the others found the opposite works too: extremely large binaries can cause problems with analysis. What can be done about these large executables? Rule at end 1/6

The same people spent the last decade justifying Black folks being choked to death on camera… they’ve been practicing

Today, we released new @RecordedFuture research detailing BlueDelta’s expanded credential-harvesting activity observed between February and September 2025. #BlueDelta #APT28 #FANCYBEAR #ForestBlizzard #FROZENLAKE #ITG05 #PawnStorm #Sednit #Sofacy #TA422 (1/5) www.recordedfuture.com/research/gru...

#100DaysofYARA - Day 7 @malwrhunterteam identified a suspicious file signed by "Xiamen Jialan Guang Information Technology Service Co., Ltd." While we have a pretty good idea it'll be abused, it hasn't been yet. So, lets watch for it to be abused. Rule at end 1/5

#100DaysofYARA - Day 6 In December and again in January, an unknown actor replaced the download on EmEditor's website with a malicious installer. Each time, the download was a trojan installer with a valid code-signing signature. How can we detect this? Rule at end 1/6

YARA-X can dump the certificate details of a MACHO binary. "yr dump [file]" shows the data produced by the modules We can output it to JSON and pass it to jq as like this: yr dump -o=json [file] | jq '.macho.certificates' 3/7

#100DaysofYARA - Day 4 One heavy user of code-signing certificates is Rhysida Ransomware. In June, I created a YARA rule focusing on their malware to help me find and report their certificates. To do so, I had to create a YARA rule on the Rich PE Header. Rule at end 1/7

#100DaysofYARA - day 5 The Cert Graveyard project reports and documents abuse code-signing including Apple issued certificates. When reporting a certificate, we want to ensure Apple has all the identifiers they need to investigate and act. Rule at end 1/7