hasherezade.bsky.social

My research blog about #JSCeal is finally out! It was quite a journey. I hope you will like it! research.checkpoint.com/2026/breakin... // #V8 #bytecode #malware #deobfuscation #BlackHatUSA2026

In an update, CERT Poland says the Russian data wiper attack that targeted a power plant last December also targeted a previously unreported second plant cert.pl/en/posts/202...

At #BlackHat2026, I’ll walk through the #JSCeal #malware case study and the static deobfuscation toolkit I built to recover readable code from the obfuscated #V8 compiled bytecode. If you’ll be at #BlackHat, I’d be glad to see you there! blackhat.com/us-26/briefi...

Two members of the Scattered Spider hacking group—Thalha Jubair and Owen Flowers—pleaded guilty to hacking Transport for London last year www.bbc.com/news/article...

New trainings sample on samplepedia Backdoor, obfuscated Python bytecode. 0/60 on Virustotal, which means it's still fresh. www.virustotal.com/gui/file/4ad... samplepedia.cc/sample/4ada6...

-China arrests members of Silver Fox cybercrime group -EU to help Ukraine in major cyberattacks -MS-ISAC loses 70% of members -SBOM still not widely adopted -Infosec execs call for lifting Anthropic ban Newsletter: news.risky.biz/risky-bullet... Podcast: risky.biz/RBNEWS578/

this is actually a very good article

Now the Linux build is also available as AppImage:

New #TinyTracer (4.0) is ready: github.com/hasherezade/... - refactored for compatibility with the latest PIN - and with some new features!

dz6 v0.4.2 is out! github.com/mentebinaria... - now with a smoother scrolling. 🙂

And #FlareOn12 Task 8: wp.me/p2mVNF-2Qf

Heeey, ncurses/terminfo has a small virtual machine! And if there's a VM, there are CTF challenges :) hackarcana.com/public-exerc... hackarcana.com/public-exerc... (third one coming next week, will be a bit harder)

The 13th annual @volatility #PluginContest is OPEN for submissions until 31 Dec 2025! This contest is designed to encourage research & development in the field of #memoryanalysis. Every year, contributions from all around the world continue to help build the next generation of #memoryforensics.

-iOS 26 change deletes clues of old spyware infections -Starlink disables 2.5k scam compound terminals -Caribbean hospital still down 5 months after ransomware attack -Poland charges officials in Pegasus scandal Newsletter: news.risky.biz/risky-bullet... Podcast: risky.biz/RBNEWS495/

Today I'm launching my new app, Hacktivate. It teaches real-world computer science skills through 240 "capture the flag" challenges, and works on iPhone, iPad, and Mac with one purchase. I've poured a ton of love into it, and I'd love to hear what you think 🙌 apps.apple.com/gb/app/hackt...

I used PE-bear for the first time to dump an embedded binary. Its intuitive UI made extraction effortless. Because malware often embeds payloads with the form A in B to evade detection, pulling out the inner binary was crucial for deeper analysis and IoCs hunting.

Finally done with #FlareOn12. What a ride! I am looking forward to read other people’s solutions, especially of those who did the 9th task quickly.

#FTSCon Speaker Spotlight: Aleksandra Doniec (@hasherezade.bsky.social) is presenting “Uncovering Malware's Secrets with TinyTracer” in the MAKER track. See the full list of speakers + event info, including how to register, here: volatilityfoundation.org/from-the-sou...

My intermediate level malware analysis course is there. 60% off for the next two weeks. malwareanalysis-for-hedgehogs.learnworlds.com/course/inter...

Beyond good ol’ Run key, Part 148 www.hexacorn.com/blog/2025/07...

1. Pause thread midway in exploit races (even ⓪). 2. Or block entire CPU core. Kernel APCs run at APC_LEVEL (🤯), so thread scheduling kinda disabled (think priority == ∞). 3. Or build upon @hasherezade.bsky.social work & generalize #WaitingThreadHijacking — making it, in fact, Waitless.

Heard of #ContextJail? It's a nasty new technique: puts target thread into ⓪ deadloop, for as long as you can afford. Requires THREAD_GET_CONTEXT right. The gist? Just spam NtGetContextThread(tgt).😸 Target will be jailed, running nt!PspGetSetContextSpecialApc 🔁. Src & binary in [ALT]. Usecases: ⤵️

Zscaler has published a technical report on HijackLoader (IDAT Loader, GhostPulse) and its recent changes, such as its new call stack spoofing module, anti-VM module, and support for scheduled task persistence www.zscaler.com/blogs/securi...

Abolish April Fool’s day. Society has moved past the need for April Fool’s day

KELA has published a profile on Rey and Pryx, the two main individuals behind the Hellcat hacking group, responsible for several breaches over the past months, such as Schneider Electric, Telefónica, and Orange Romania. www.kelacyber.com/blog/hellcat...

We all knew this day would arrive when the DNA samples you willingly provided 23andMe would be up for sale. Company now says it's seeking a buyer as it files for bankruptcy. 23andMe says any buyer will have to adhere to privacy laws for customer DNA/data they acquire. people.com/23andme-file...

Clevo Boot Guard Keys Leaked in Update Package www.binarly.io/blog/clevo-b...

Someone has done an excellent job collecting RATs and documenting them by version. They also included images. A+ work. This is amazing (we're going to ingest this eventually) github.com/Cryakl/Ultim...

A small demo/tutorial on unpacking executables with #PEsieve and #TinyTracer: hshrzd.wordpress.com/2025/03/22/u... - automatic OEP finding, reconstructing IAT, avoiding antidebugs and fixing imports broken by shims

Would you look at that, it's tmp.0ut Volume 4! Happy Friday, hope you enjoy this latest issue! tmpout.sh/4/

Did anyone find the secret art page? 👀

Next RE//verse video released! Andrew's Day 2 keynote was the next most requested video. It starts with an aside from neuroscience, ends with a challenge to all tool developers and has a fantastic journey between:

whoever made this one, it is perfect for IT work or life in general.

Prodaft has published a technical analysis of Anubis, a new Python-based backdoor linked to Savage Ladybug (FIN7) operations catalyst.prodaft.com/public/repor...

The BlackBasta ransomware gang developed and used its own custom tool to brute-force enterprise firewalls and VPN remote-access products. Named Bruted, the tool was written in PHP and could brute-force the following products (see image) blog.eclecticiq.com/inside-brute...

The Blind Eagle APT group has compromised over 1,600 victims inside Colombian institutions and government agencies. The campaign took place in November & December of last year and used an exploit similar to a zero-day exploited by Russian hackers in Ukraine. research.checkpoint.com/2025/blind-e...

[DEMO] Searching for #AceLdr in memory, with #PEsieve/#HollowsHunter threads scan: www.youtube.com/watch?v=RQf2... ; read more: github.com/hasherezade/...