The serpent’s tongue: Luring the Python out of its den
This blog examines the full lifecycle of a Python package, from hosting on repositories such as PyPI or custom web servers, through source and wheel distribution formats, to the final installation into virtual or system-wide Python environments.
https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
🎖@malwr
This blog examines the full lifecycle of a Python package, from hosting on repositories such as PyPI or custom web servers, through source and wheel distribution formats, to the final installation into virtual or system-wide Python environments.
https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
🎖@malwr
Cisco Talos
The serpent’s tongue: Luring the Python out of its den
This blog examines the full lifecycle of a Python package, from hosting on repositories such as PyPI or custom web servers, through source and wheel distribution formats, to the final installation into virtual or system-wide Python environments.
S3N4T0R-0X0/RustyWater-ShellCode-Dropper: RustyWater represents the main payload and the backbone of the entire adversarial operation in Static Kitten group attacks.
https://github.com/S3N4T0R-0X0/RustyWater-ShellCode-Dropper
🎖@malwr
https://github.com/S3N4T0R-0X0/RustyWater-ShellCode-Dropper
🎖@malwr
GitHub
GitHub - S3N4T0R-0X0/RustyWater-ShellCode-Dropper: RustyWater represents the main payload and the backbone of the entire adversarial…
RustyWater represents the main payload and the backbone of the entire adversarial operation in Static Kitten group attacks. - S3N4T0R-0X0/RustyWater-ShellCode-Dropper
AgentRE-Bench
AI agents can write code. Can they reverse engineer it? AgentRE-Bench evaluates compiled-binary reverse engineering with deterministic scoring.
https://www.agentre-bench.ai/
https://github.com/agentrebench/AgentRE-Bench
🎖@malwr
AI agents can write code. Can they reverse engineer it? AgentRE-Bench evaluates compiled-binary reverse engineering with deterministic scoring.
https://www.agentre-bench.ai/
https://github.com/agentrebench/AgentRE-Bench
AgentRE-Bench gives an LLM agent a compiled ELF binary and a set of Linux static analysis tools (strings, objdump, readelf, etc.), then measures how well it can identify C2 infrastructure, encoding schemes, anti-analysis techniques, and communication protocols — all without human guidance.
🎖@malwr
www.agentre-bench.ai
AgentRE-Bench — Reverse-engineering intelligence, measured
The benchmark and evaluation platform for AI agents that understand compiled software.
DomainTools Investigations | Threat Intelligence Report: The Pro-Iran Hacktivist Ecosystem 2026
Threat Intelligence Report: The Pro-Iran Hacktivist Ecosystem 2026
https://dti.domaintools.com/research/threat-intelligence-report-the-pro-iran-hacktivist-ecosystem-2026
🎖@malwr
Threat Intelligence Report: The Pro-Iran Hacktivist Ecosystem 2026
https://dti.domaintools.com/research/threat-intelligence-report-the-pro-iran-hacktivist-ecosystem-2026
🎖@malwr
WallabyDesigns/windows-telemetry-guard
https://github.com/WallabyDesigns/windows-telemetry-guard
🎖@malwr
https://github.com/WallabyDesigns/windows-telemetry-guard
A reversible Windows 10/11 telemetry and tracking hardening toolkit, from Wallaby Designs. Everything it changes is recorded in a timestamped backup first, so Revert restores your machine to exactly the state it was in before Apply.
🎖@malwr
GitHub
GitHub - WallabyDesigns/windows-telemetry-guard
Contribute to WallabyDesigns/windows-telemetry-guard development by creating an account on GitHub.
Analyzing a Linux/Ext4 disk image using The Sleuth Kit (TSK) and other utilities — PART-1
https://osintteam.blog/analyzing-a-linux-ext4-disk-image-using-the-sleuth-kit-tsk-and-other-utilities-part-1-9cde7d700df5
🎖@malwr
https://osintteam.blog/analyzing-a-linux-ext4-disk-image-using-the-sleuth-kit-tsk-and-other-utilities-part-1-9cde7d700df5
🎖@malwr
Medium
Analyzing a Linux/Ext4 disk image using The Sleuth Kit (TSK) and other utilities — PART-1
Hello Everyone! Welcome back, I hope you’ll are doing great. In this write-up we’ll walkthrough a linux/ext4 disk image and try to analyze…
I Detonated Real Ransomware in a VM. Hereâs the Forensic Trail It Left. - Freedium
Static analysis hit a wall immediately. The only way to understand this malware was to actually let it run.
https://freedium-mirror.cfd/https://osintteam.blog/i-detonated-real-ransomware-in-a-vm-heres-the-forensic-trail-it-left-8a386d32d3f3
🎖@malwr
Static analysis hit a wall immediately. The only way to understand this malware was to actually let it run.
https://freedium-mirror.cfd/https://osintteam.blog/i-detonated-real-ransomware-in-a-vm-heres-the-forensic-trail-it-left-8a386d32d3f3
🎖@malwr
freedium-mirror.cfd
I Detonated Real Ransomware in a VM. Here’s the Forensic Trail It Left. - Freedium
Static analysis hit a wall immediately. The only way to understand this malware was to actually let it run.
Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet
TrendAI™ Research analyzed over 200 Gemini CLI session logs showing how a Russian-speaking threat actor used AI to run a live botnet, finishing a full C&C migration in six minutes while doing just 11% of the work himself.
https://www.trendmicro.com/en_us/research/26/g/actor-behind-patriot-bait-used-ai-to-deploy-c2-botnet.html
🎖@malwr
TrendAI™ Research analyzed over 200 Gemini CLI session logs showing how a Russian-speaking threat actor used AI to run a live botnet, finishing a full C&C migration in six minutes while doing just 11% of the work himself.
https://www.trendmicro.com/en_us/research/26/g/actor-behind-patriot-bait-used-ai-to-deploy-c2-botnet.html
🎖@malwr
Trend Micro
Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet
TrendAI™ Research analyzed over 200 Gemini CLI session logs showing how a Russian-speaking threat actor used AI to run a live botnet, finishing a full C&C migration in six minutes while doing just 11% of the work himself.
❤1
TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
TuxBot v3 Evolution, an IoT botnet framework built with LLMs. Read our analysis of its cross-compiled binaries, C2 architecture and bugs.
https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/
🎖@malwr
TuxBot v3 Evolution, an IoT botnet framework built with LLMs. Read our analysis of its cross-compiled binaries, C2 architecture and bugs.
https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/
🎖@malwr
Unit 42
TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
TuxBot v3 Evolution, an IoT botnet framework built with LLMs. Read our analysis of its cross-compiled binaries, C2 architecture and bugs.
Bind Link Abuse: One Windows Feature, Many Ways to Blind Your EDR
I’d like to thank my coauthors, Andrei-Marius Muntea, Andrei Mermeze, Radu-Marian Portase, and Vlad Lazar, for their invaluable contributions to this research.
https://www.bitdefender.com/en-us/blog/businessinsights/bind-link-abuses-windows-feature-edr-evasion-technique
🎖@malwr
I’d like to thank my coauthors, Andrei-Marius Muntea, Andrei Mermeze, Radu-Marian Portase, and Vlad Lazar, for their invaluable contributions to this research.
https://www.bitdefender.com/en-us/blog/businessinsights/bind-link-abuses-windows-feature-edr-evasion-technique
🎖@malwr
Bitdefender
Bind Link Abuse: One Windows Feature, Many Ways to Blind Your EDR
I’d like to thank my coauthors, Andrei-Marius Muntea, Andrei Mermeze, Radu-Marian Portase, and Vlad Lazar, for their invaluable contributions to this research.
🕊1
Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries
An exposed open directory revealed a suspected Chinese campaign using Claude Code and DeepSeek-v4-pro to breach government systems in Afghanistan, Thailand, and Taiwan, with parallel probing of financial services worldwide.
https://hunt.io/blog/chinese-operators-claude-deepseek-government-intrusion
🎖@malwr
An exposed open directory revealed a suspected Chinese campaign using Claude Code and DeepSeek-v4-pro to breach government systems in Afghanistan, Thailand, and Taiwan, with parallel probing of financial services worldwide.
https://hunt.io/blog/chinese-operators-claude-deepseek-government-intrusion
🎖@malwr
hunt.io
Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries
An exposed open directory revealed a suspected Chinese campaign using Claude Code and DeepSeek-v4-pro to breach government systems in Afghanistan, Thailand, and Taiwan, with parallel probing of financial services worldwide.
Anatomy of a CUDA Binary
When you compile a CUDA kernel, the final artifact is a cubin — a CUDA binary. It is a standard ELF64 file with NVIDIA-specific sections that encode everything the CUDA driver needs to load and launch a kernel: the machine code, the parameter layout, register allocation metadata, and a collection of attributes that have no public documentation.
https://hiraditya.github.io/posts/anatomy-of-a-cuda-binary/
🎖@malwr
When you compile a CUDA kernel, the final artifact is a cubin — a CUDA binary. It is a standard ELF64 file with NVIDIA-specific sections that encode everything the CUDA driver needs to load and launch a kernel: the machine code, the parameter layout, register allocation metadata, and a collection of attributes that have no public documentation.
https://hiraditya.github.io/posts/anatomy-of-a-cuda-binary/
🎖@malwr
Aditya Kumar
Anatomy of a CUDA Binary
When you compile a CUDA kernel, the final artifact is a cubin — a CUDA binary. It is a standard ELF64 file with NVIDIA-specific sections that encode everything the CUDA driver needs to load and launch a kernel: the machine code, the parameter layout, register…
2026-06-22: SHub Stealer infection (macOS)
https://www.malware-traffic-analysis.net/2026/06/22/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2026/06/22/index.html
🎖@malwr
2026-06-01: SmartApeSG ClickFix --> Unidentified RAT
https://www.malware-traffic-analysis.net/2026/06/01/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2026/06/01/index.html
🎖@malwr
1❤1
endgamec2framework/endgame: ENDGAME C2 FRAMEWORK — AI-powered command and control for professional red team operations
https://github.com/endgamec2framework/endgame
🎖@malwr
https://github.com/endgamec2framework/endgame
🎖@malwr
GitHub
GitHub - endgamec2framework/endgame: ENDGAME C2 FRAMEWORK — AI-powered command and control for professional red team operations
ENDGAME C2 FRAMEWORK — AI-powered command and control for professional red team operations - endgamec2framework/endgame
One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud ‘Patriot Bait’ Campaign
A solo Russian-speaking threat actor ran a 5-year Telegram channel and, starting September 2025, used AI to automate its content, credential theft, and a cryptocurrency fraud scheme targeting American audiences.
https://www.trendmicro.com/en_us/research/26/e/inside-the-influence-and-fraud-patriot-bait-campaign.html
🎖@malwr
A solo Russian-speaking threat actor ran a 5-year Telegram channel and, starting September 2025, used AI to automate its content, credential theft, and a cryptocurrency fraud scheme targeting American audiences.
https://www.trendmicro.com/en_us/research/26/e/inside-the-influence-and-fraud-patriot-bait-campaign.html
🎖@malwr
Trend Micro
One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud ‘Patriot Bait’ Campaign
A solo Russian-speaking threat actor ran a 5-year Telegram channel and, starting September 2025, used AI to automate its content, credential theft, and a cryptocurrency fraud scheme targeting American audiences.
ProfessorQuantumUniverse/Veto: A nice Virus Total Android Client.
https://github.com/ProfessorQuantumUniverse/Veto
🎖@malwr
https://github.com/ProfessorQuantumUniverse/Veto
🎖@malwr
GitHub
GitHub - ProfessorQuantumUniverse/Veto: A nice Virus Total Android Client.
A nice Virus Total Android Client. Contribute to ProfessorQuantumUniverse/Veto development by creating an account on GitHub.
Schich/Lucky-Spark: A stealthy stager designed for shellcode payloads staged with http/https like Sliver, or on github raw.
https://github.com/Schich/Lucky-Spark
🎖@malwr
https://github.com/Schich/Lucky-Spark
🎖@malwr
GitHub
GitHub - Schich/Lucky-Spark: A stealthy stager designed for shellcode payloads staged with http/https like Sliver, or on github…
A stealthy stager designed for shellcode payloads staged with http/https like Sliver, or on github raw. - Schich/Lucky-Spark
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.
https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/
🎖@malwr
Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.
https://blog.talosintelligence.com/uat-11795-deploys-novel-starland-rat-and-bespoke-wldr-c2-implant-in-financially-motivated-campaign/
🎖@malwr
Cisco Talos
UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign
Cisco Talos is disclosing UAT-11795, a sophisticated, Russian-speaking, financially motivated adversary that has been conducting a malicious campaign targeting users in the U.S. and Europe since at least June 2025.
OkoBot framework infection chain
Kaspersky GReAT experts dissect the new OkoBot campaign targeting cryptocurrency users. This complex framework employs TookPS, exfiltrates seed phrases, monitors Chromium-based browsers, and installs various malware strains, including the Rilide stealer.
https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/
🎖@malwr
Kaspersky GReAT experts dissect the new OkoBot campaign targeting cryptocurrency users. This complex framework employs TookPS, exfiltrates seed phrases, monitors Chromium-based browsers, and installs various malware strains, including the Rilide stealer.
https://securelist.com/okobot-framework-targets-cryptocurrency-wallets/120660/
🎖@malwr