Jimmy Wylie

Howdy folks! I'm a malware analyst focused on critical infrastructure threats and ICS/OT malware. Aside from studying reverse engineering, I lift weights, play a lot of board games and try to keep my philosopher dog, Velma, entertained. Here's an example of my work: www.dragos.com/blog/analyzi...

Framing the php2shell story as "AI uncovered php2shell" is like hearing an awesome song and crediting the guitar instead of the player. It's just incorrect and steals credit from a good researcher and author of one of the best disclosures I've seen in a while. calif.io/php2shell/

So glad someone is saying it. We've been seeing similar. LLMs are only useful for specific kinds of problems, and when applied to the wrong kind of problem, they produce garbage or waste your time. This fact doesn't change when applied to malware. www.darkreading.com/threat-intel...

There's been so much hype and exaggeration about what LLM technology does for malware developers. So, we've spent the past year looking at LLM-generated ICS malware to understand the reality, and we're excited to share the result at DISC. Register here: events.dragos.com/disc2026/120...

We are pleased to release tmp.0ut 5 Volume! Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!! tmpout.sh/5/

Dragos has a Vulnerability Analyst position open! job-boards.greenhouse.io/dragos/jobs/...

We have two malware analyst openings at Dragos! In many malware jobs, your work disappears into the void. But at Dragos, it's easy to see the impact of your work across the company and community. And you get to work on interesting cases across OT verticals. job-boards.greenhouse.io/dragos/jobs/...

I used to spend hours finding wrong answers to Linux issues on Reddit before giving up and figuring it out myself. Now, an LLM gives me the wrong answers instantly, boils the ocean, and forces me to manually solve the problem sooner. I feel so productive!

My "Introduction to ICS Malware Analysis" workshop was accepted at the SANS ICS Security Summit. You'll learn about ICS malware by analyzing samples modeled on FrostyGoop and CRASHOVERRIDE. No prior RE experience needed. It's running twice: June 8 and June 10.

Quoted in Dark Reading on the latest LotusWiper release by Kaspersky. I'm always glad when our team's expertise can reach a wide audience. We've seen an uptick in Wiper use since 2022, which makes sense. They're cheap to develop and effective at turning access into damage.

ZionSiphon is an AI-generated, non-functional attempt at ICS malware. Malicious intent doesn't imply ability, and broken malware like this is a distraction when we have proven threats like VOLTZITE/Volt Typhoon out there hitting water utilities.: www.dragos.com/blog/zionsip...

Ironically, S4 dropped my talk on vibe coding ICS malware on the same day that non-functional AI-slop OT "malware" is making headlines. It’s hype “malware” distracting us from real threats. More to say, but it's Friday :) In the meantime, I hope you enjoy the talk.

This blog nails some real problems with bringing AI into an organization in any industry, not just cybersecurity. The article brings up a human training issue that I've been pondering a lot. What does it look like to train a new reverse engineer with AI tools available?

TIL FLARE distributes educational content for free on GitHub. github.com/mandiant/fla...

I had a great time on Jim's podcast discussing malware analysis, reverse engineering, working at Dragos, and a little bit of my personal history. www.youtube.com/watc...

I earned my first CVE credit (CVE-2025-7676) for helping with a Windows ARM vuln. So, to commemorate the credit, my coworker, Reid, presented me last week with a Trophy of Perpetual Futility, because there’s always more work to do. raw.githubusercontent.com/reidmefirst/...

The Dragos 2026 Year In Review Report is live: 3 new threat groups, updates from 3 of our more active threat groups, and (my personal favorite) coverage of a subset ICS-related capabilities that we found last year.

I've spent a lot of time reversing ICS malware. Recently, I've been building it with AI tools. While there's been plenty of commentary and news about AI and malware, I'm excited to share what I learned actually trying to build some at S4x26. Stage 2, Feb 24, 12pm.

CERT.PL's report on the attacks against Polish infrastructure. A full destructive playbook enabled by default credentials: firmware corruption, wipers, factory resets, even booted Tiny Core Linux on KVM to DD-wipe servers. The report is excellent work.

I know I'm feeling stressed out when I go back to reading Thich Nhat Hahn. His teachings calm me, and I need that reminder that happiness is available in any moment despite circumstance. I'm not even Buddhist. or maybe I am? He'd probably say the distinction isn't important.

This is the first known attack on DERs. Attackers compromised RTUs at 30 different sites. The report has an overview, defensive guidance, and a comparison to past ELECTRUM ops. Hats off to CERT Polska for leading the charge, and kudos to our Intel team for the hard work.

I spent a couple months arguing with Claude and Copilot while building FrostyGoop variants for DNP3 (and Modbus), keeping detailed notes on what worked and what didn't. At S4, I’ll share my honest assessment of these tools and how they might lower barriers to ICS malware dev. See you in Miami!

Finally sharing what’s been under wraps for months. Adam Foster and I tore into HID SEOS to build the first open-source implementation for Proxmark3. This is our Black Hat Asia 2025 story → www.youtube.com/watch?v=mnhG... #RFIDHacking #SEOS #CyberSecurity

We have a job opening in our Community Defense Program (CDP) which gives small utilities free access to the Dragos Platform. This opening is a chance to do some truly meaningful work for the community. Job Description: job-boards.greenhous... CDP Description: www.dragos.com/commu...

Had a great time presenting at LSU this week on hunting and analyzing Go and Python malware samples while hunting for ICS malware. For those who couldn't make it, you can catch a recording of this talk from Hou.Sec.Con last month with @sam-hans0n.bsky.social www.youtube.com/watc...

MacOS 26 really kills the T2 Intel Macs. It's technically compatible, but the experience is a drag, especially just after boot with all the indexing. I'm going to put a T2 Linux distro on this thing, and hope it improves the experience. I refuse to throw away a computer that's barely 5 years old.

My cousin is raising money to go to the MLS Next Youth Showcase. You buy tasty popcorn, and the money funds the trip with an option to donate to teachers. Check it out and support a good cause! I just bought a bunch for our weekly board game meetup :) s.dgpopup.com/0o409evs/rp

Our DEF CON33 ICS Village talk is now on YouTube! @sam-hans0n.bsky.social and I share stories of malware we discovered while searching for ICS threats, and discuss our approach to assessing their reputation. Don't Cry Wolf: Evidence-Based Assessment of ICS Threats

Thanks to @cybrseccon.bsky.social / HOU.SEC.CON for having us last week. (and for a really unique speaker gift!) The conference has grown into a valuable industry event, and I'm looking forward to the next one! ICYMI, we posted resources from our talk here: gist.github.com/maya...