Reposted by Ronymad5quirrel.bsky.social @mad5quirrel.bsky.social · 02/03/2026Reverse engineers often spend significant time deciphering third-party libraries within firmware. My talk, scheduled for Friday at 5 PM at Reverse, introduces SightHouse, an open-source initiative aimed at automatically identifying third-party functions to enhance analysis efficiency. 044
Reposted by RonyMax 'Libra' Kersten @maxkersten.nl · 01/07/2025Ghidra, scripting, LLM, automagic automation. That should grab the attention for this thread. If you want to read the complete blog, you can do so here: www.trellix.com/blogs/resear... 1/n 195
Reposted by Ronyaptwhatnow.bsky.social @aptwhatnow.bsky.social · 14/05/2025Many many folks in this effort over the years. Thankful for everyone and hope its of use. 1168
Reposted by RonyNatto Thoughts @nattothoughts.bsky.social · 14/05/2025The Natto Team continues finding stories of Chinese hackers fascinating as they reveal the motivations behind cyber operations and the evolution of China's information security industry. nattothoughts.substack.com/p/stories-of...nattothoughts.substack.comFrom the World of “Hacker X Files” to the Whitewashed Business SphereJiang Jintao’s journey from hacker to infosec entrepreneur illustrates the blend of ambition, skill, and changes in China's cybersecurity industry 055
Reposted by RonyCipher Tech Solutions @ciphertech.bsky.social · 12/05/2025The May release for ACCE includes updates and support including #AurotunStealer #rutserv #PupkinStealer #PE32Ransomware #Interlock www.ciphertechsolutions.com/acce-release...ciphertechsolutions.comACCE Release Notes v2.9.20250508 – Cipher Tech Solutions, Inc. 011
Rony @r0ny.bsky.social · 30/04/2025France just called out GRU Unit 20728 (166th Research Information Centre), posted up in Rostov-on-Don, for cyberattacks. Kremlin got new ops on the board. www.diplomatie.gouv.fr/en/country-f... @wylienewmark.bsky.socialdiplomatie.gouv.frRussia – Attribution of cyber attacks on France to the Russian military intelligence service (APT28) (29.04.25)France condemns in the strongest terms the use by Russia's military intelligence service (GRU) of the APT28 attack group, at the origin of several (…) 063
Reposted by RonyAndrew Morris @andrewmorr.is · 21/04/2025Yall are beyond not ready about the shit we're cooking up with @censys.bsky.social and @greynoise.io powers combined censys.com/blog/hunting...censys.comHunting Botnets With CursorAI, GreyNoise, Censys, and CenseyeThreat hunting is made easier and simpler by combining the power of Censys, GreyNoise, CursorAI, and Censeye. 0258
Rony @r0ny.bsky.social · 15/04/2025I'm always a big fan of @agreenberg.bsky.social's writing, but I don't see a clear reason to believe these six stories are connected to "lesser-known hacker groups." 000
Reposted by RonyBinary Ninja @binary.ninja · 07/04/2025Kyle's talk at Insomni'Hack is live! youtu.be/I0PoE0IdtmE?... Check it out if you're interested in a slice of modern program analysis and try the latest version of Tanto as well, in the plugin manager or at github.com/Vector35/tantoyoutu.be"A Slice Of" Modern Program Analysis - Kyle Martin 0116
Rony @r0ny.bsky.social · 30/03/2025Cool stuff. Kudos to whoever at Censys wrote this. I researched the ORB network myself but lack access to historical data. Thanks for providing historical visibility. censys.com/junos-and-re...censys.comJunOS and RedPenguin 055
Rony @r0ny.bsky.social · 13/03/2025The R&D team at JuniperNetworks released a detailed 35-page malware analysis report "The RedPenguin Malware Incident", covering the #TINYSHELL components used by #UNC3886, including the C2 protocol structure. supportportal.juniper.net/sfc/servlet.shepherd/document/download/069Dp00000FzdmIIARsupportportal.juniper.net 031
Rony @r0ny.bsky.social · 05/03/2025APT27 & i-soon hackers charged by DOJ—12 caught as the cats are out of the bag now. Yet APT27’s infra still purrs. Let’s see how they claw back from this! www.justice.gov/opa/pr/justi...justice.govJustice Department Charges 12 Chinese Contract Hackers and Law Enforcement Officers in Global Computer Intrusion CampaignsThe Justice Department, FBI, Naval Criminal Investigative Service, and Departments of State and the Treasury announced today their coordinated efforts to disrupt and deter the malicious cyber activiti... 021
Rony @r0ny.bsky.social · 03/03/2025CISA is stepping back too!!? It seems they have a different opinion though x.com/CISAgov/stat...x.comCybersecurity and Infrastructure Security Agency on X: "CISA’s mission is to defend against all cyber threats to U.S. Critical Infrastructure, including from Russia. There has been no change in our posture. Any reporting to the contrary is fake and undermines our national security." / XCISA’s mission is to defend against all cyber threats to U.S. Critical Infrastructure, including from Russia. There has been no change in our posture. Any reporting to the contrary is fake and undermines our national security. 100
Rony @r0ny.bsky.social · 27/02/2025Epic collab, UNC4899 🤝 UNC5267 FBI official advisory on Bybit crypto theft www.ic3.gov/PSA/2025/PSA...ic3.govInternet Crime Complaint Center (IC3) | North Korea Responsible for $1.5 Billion Bybit Hack 020
Reposted by RonyRikmer @rikmer.bsky.social · 24/02/2025@shodanhq.bsky.social Awesome! Shodan History is back in the UI. Nice!!! Thank you. But I have a question regarding trends.shodan.io. all trends I do are stopping at October 2024. Why? Please make them to the current data again. I love it and need it. :)trends.shodan.ioShodanShodan Trends - Discover how the Internet has changed over time. 044
Reposted by RonyDan Black @danwblack.bsky.social · 19/02/2025Today, Google Threat Intelligence is alerting the community to increasing efforts from several Russia state-aligned threat actors (GRU, FSB, etc.) to compromise Signal Messenger accounts. cloud.google.com/blog/topics/...cloud.google.comSignals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger | Google Cloud BlogRussia state-aligned threat actors target Signal Messenger accounts used by individuals of interest to Russia's intelligence services. 3165115
Reposted by Ronygeech @captaingee.ch · 15/02/2025This latest blog from Cyfirma on Cl0p/Cleo exploitation is utter garbage, ignore it. LLM YARA rule (not even valid syntax), massively inflated statistics, and misleading IOCs and analysis. www.cyfirma.com/research/cl0...cyfirma.comCL0P Ransomware : Latest Attacks - CYFIRMAINTRODUCTION The Cl0p group has been active since early 2019, leveraging vulnerabilities and exploits to encrypt files for ransom. The... 152
Rony @r0ny.bsky.social · 10/02/2025Excited to receive the @abuse-ch.bsky.social& @spamhaus.bsky.social swag! 🎁 Thank you for sending this amazing package. It means a lot to be recognized as a Top Contributor in the fight against cybercrime. Looking forward to continuing our battle together! 💪 #StrengthINUnity 270
Reposted by Ronyabuse-ch.bsky.social @abuse-ch.bsky.social · 06/02/2025A BIG thank you to our top contributors🎖️for sharing valuable technical cyber threat intelligence on our platforms over the past year. 🙏 Your efforts had a significant impact on cyber security, making the internet a safer place👏💪🛡️ A nice surprise is coming your way! 🎁 👀👇 051
Rony @r0ny.bsky.social · 05/02/2025 More often than not, their information sources are news articles penned by journalists who might not have the same level of insight into the nuanced shifts in cyber operations like those of SVR. 000
Rony @r0ny.bsky.social · 05/02/2025I'm not surprised that the book author might be off the mark on this. Access to technical intelligence of that caliber isn't typically within the purview of authors unless they're directly involved with or have access to high-level cybersecurity entities. 110
Rony @r0ny.bsky.social · 31/01/2025#CMS8000 backdoor Hardcoded IP: 202.114.4[.]119 (h/t @craiu.bsky.social) registered to Tsinghua University 👀 VT link: www.virustotal.com/gui/file/4e4... 📝 www.cisa.gov/sites/defaul...cisa.gov 020
Rony @r0ny.bsky.social · 29/01/2025Yeah, that's true, which should have been useful from attribution perspective. couldn't remember any single blog that did. 100
Rony @r0ny.bsky.social · 29/01/2025The blog feels like a retro FLARE blog from the good old FireEye days! Shout out to Nino Isakovic, @qutluch.bsky.social and @lukejenx.bsky.social cloud.google.com/blog/topics/...cloud.google.comScatterBrain: Unmasking the Shadow of PoisonPlug's Obfuscator | Google Cloud BlogWe been tracking multiple espionage operations conducted by China-nexus actors utilizing POISONPLUG.SHADOW malware. 1124
Reposted by RonyRony @r0ny.bsky.social · 27/01/2025⚖️EU sanctions three Russian GRU Unit 29155 officers for cyberattacks against Estonia in 2020. www.consilium.europa.eu/en/press/pre... Individuals Sanctioned: 1️⃣Nikolay Alexandrovich KORCHAGIN 2️⃣Vitaly SHEVCHENKO 🆕 3️⃣Yuriy Fedorovich DENISOV 📎 eur-lex.europa.eu/legal-conten...consilium.europa.euCyber-attacks: three individuals added to EU sanctions list for malicious cyber activities against EstoniaThe Council imposed restrictive measures on three individuals involved in cyber-attacks against Estonia. 001
Rony @r0ny.bsky.social · 27/01/2025⚖️EU sanctions three Russian GRU Unit 29155 officers for cyberattacks against Estonia in 2020. www.consilium.europa.eu/en/press/pre... Individuals Sanctioned: 1️⃣Nikolay Alexandrovich KORCHAGIN 2️⃣Vitaly SHEVCHENKO 🆕 3️⃣Yuriy Fedorovich DENISOV 📎 eur-lex.europa.eu/legal-conten...consilium.europa.euCyber-attacks: three individuals added to EU sanctions list for malicious cyber activities against EstoniaThe Council imposed restrictive measures on three individuals involved in cyber-attacks against Estonia. 001
Reposted by RonyWesley Shields @wxs.bsky.social · 24/12/2024Spent a bit of time adding some new features to “yr fmt” that I suspect will be well liked and very useful if you write a lot of rules and like consistency. I have the gist of it but am stumbling over some rust intricacies for the first time. Maybe by the end of the year I’ll have it done. 032
Rony @r0ny.bsky.social · 19/12/2024Just read this @sekoia.io's blog, and wow, it's a cool deep dive into how they use YARA internally! They go deep into metadata which you don't hear much about. Good stuff if you're into the nitty-gritty of YARA. blog.sekoia.io/happy-yara-c... #yara #threatintelligenceblog.sekoia.ioHappy YARA Christmas!Discover daily YARA usage at Sekoia.io TDR. Learn how YARA rules identify threats and aid in investigations and DFIR engagements. 080
Rony @r0ny.bsky.social · 17/12/2024A new #yara-x release is out with some small improvements and bugfix. github.com/VirusTotal/y...github.comRelease v0.12.0 · VirusTotal/yara-xThe macho module now parses and exposesLC_LINKER_OPTION commands (#256). Raise warning with some patterns that have too many 2-byte atoms and are potentially slow (#264). Extract more information ... 174
Rony @r0ny.bsky.social · 17/12/2024Russia’s cyber warfare evolved with #SecretBlizzard (APT) repurposing tools from other groups (Storm-1837 & Storm-1919) for targeted operations. The analysis details ongoing attacks on Ukraine, showcasing the group’s resource-sharing strategy and growing sophistication. tinyurl.com/4kzn3zcvmicrosoft.comFrequent freeloader part II: Russian actor Secret Blizzard using tools of other groups to attack Ukraine | Microsoft Security BlogSince January 2024, Microsoft has observed Secret Blizzard using the tools or infrastructure of other threat groups to attack targets in Ukraine and download its custom backdoors Tavdig and KazuarV2. 010
Rony @r0ny.bsky.social · 10/12/2024Two more suspected #Zloader HTTPS C2 server theartofshare./com (193.188.22.125:443) ~ 2024-11-12 checkpointone./world (147.45.79.30:443) ~ 2024-06-14 www.zscaler.com/blogs/securi...zscaler.comInside Zloader’s Latest Trick: DNS TunnelingDiscover how Zloader 2.9.4.0 implemented a custom DNS tunneling protocol combined with TLS encryption to evade network detection. 030
Rony @r0ny.bsky.social · 04/12/2024Also, from Lumen BlackLotus Labs blog.lumen.com/snowblind-th...blog.lumen.comSnowblind: The Invisible Hand of Secret Blizzard 012
Rony @r0ny.bsky.social · 04/12/2024Secret Blizzard: the hand-me-down hacker collective! After using tools from Hazel Sandstorm & Storm-0473, they’re now remixing Storm-0156’s infrastructure for fresh espionage hits. Also, they've leveraged resources from at least 6 other threat actors in the past! 👀 www.microsoft.com/en-us/securi...microsoft.comFrequent freeloader part I: Secret Blizzard compromising Storm-0156 infrastructure for espionage | Microsoft Security BlogMicrosoft has observed Secret Blizzard compromising the infrastructure and backdoors of the Pakistan-based threat actor we track as Storm-0156 for espionage against the Afghanistan government and Indi... 200
Rony @r0ny.bsky.social · 04/12/2024Thank you for sharing. Does it specifically offer guidance on detecting Salt Typhoon intrusion s? 100
