Casperinous retweeted
Fun research together with @Tera0017. Most reporting so far has been victim side, but we show the agent convos, the hacks and models the ARTEX operators used.
Some obscure chinese grey-market cybercrime stories inside as well :3
Agentic hacking frameworks are on the rise.
We tracked 2,000+ #ARTEX servers and obtained databases with full conversation logs that show exactly how the agents hacked.
It proves: Fully autonomous cybercrime is already here.
Read more 👇:
research.checkpoint.com/2026…
Casperinous retweeted
Meet simil.ar!
We're building a new reverse engineering platform with a purpose-built decompiler and powerful file intelligence capabilities
Analyse, identify and compare all your files in one place
Our early access programme is open now: simil.ar/register
Casperinous retweeted
Finally back home! Slides from "0clicks in an AI World," the talk @brucedang and I gave at @unpromptedconf, are now up:
github.com/pwnlambda/talks/b…
Casperinous retweeted
When an AI jailbreak starts injecting ads: meet #Haiou, an example of Prompt Adware.
A glimpse into a new class of unwanted software.
Read more 👇
research.checkpoint.com/2026…
Casperinous retweeted
We asked GPT-6 Astra to edit Qwen3.5-0.8B weights to improve math.
It directly changed only 0.016% of weights, fixing 0.8B's reasoning loops & improving math up to 6x and even instruction following 3x, without gradients or training.
We call this Weight-Space Programming: frontier LLMs can now natively read/write neural network weights! 🧵
Blog: rikiyat.github.io/blog/weigh…
Readers added context they thought people might want to know
LLM was given weights explicitly as text in prompt and used code/forward passes (per authors' logs) to ablate Qwen looping direction, a known thinking-mode issue per model card. Primarily fixed repetition in that mode, not general 'natively' improving weights/math.
rikiyat.github.io/blog/weight-sp…
github.com/RikiyaT/lm_und…
huggingface.co/Qwen/Qwen3.5-0…
huggingface.co/RikiyaT/Qwen3.…
Casperinous retweeted
#VoltTyphoon operational network for 0-day exploitation uncovered.
Very insightful research from the people
@lumentechco .
Kudos for using the insights on this network over a 3 year timespan to inform victims/targets before major impact.
lumen.com/blog/en-us/silent-…
Casperinous retweeted
Just dropped a new blog post! 🔥
blog.orange.tw/posts/2026-10…
Casperinous retweeted
In an international law enforcement operation 👮, the US Department of Justice 🇺🇸, in cooperation with private sector partners, have taken down notorious bulletproof hosting provider Virtualine 💥
➡️ justice.gov/usao-edva/pr/bul…
Operating as AS202412 (Omegatech LTD), Virtualine received upstream connectivity from German 🇩🇪 providers aurologic GmbH (AS30823) and Pfcloud UG (AS51396), as well as French 🇫🇷 PEERXY NETWORKS SAS (AS213382), as bgp .tools shows. This network connectivity is now gone, currently making it impossible for Omegatech to operate 🛑
Omegatech announced 24x /24 IPv4 CIDRs, totaling 6,144 IPs. Out of these, hundreds were seen daily participating in spamming, internet-wide scanning, and botnet C2 hosting ⤵️
🌐 URLhaus tracked over 10,000 malware distribution sites at Omegatech: urlhaus.abuse.ch/asn/202412
📡 ThreatFox logged 2,000+ community-shared IOCs tied directly to Omegatech: threatfox.abuse.ch/asn/20241…
The hoster primarily served malicious infrastructure associated with RATs 🖥️ (e.g., PureRAT and OverlordRAT), rogue ScreenConnect servers 🔌, and social engineering malware campaigns like ClickFix and ErrTraffic 🖱️. While internet abuse for sure can happen, Virtualine was not reacting on abuse reports at all and advertised their "bulletproof hosting services" on the darkweb, as investigation shows 🕵️♀️
The takedown of Omegatech is welcome news. However, its long-term impact remains uncertain. Bulletproof hosters commonly re-brand and resume operations under new ASNs quickly 🔃
Furthermore, Omegatech is just the tip of the iceberg. Other active bulletproof hosters include:
➡️ AS219502 (STORMCLOUD)
➡️ AS207043 (DEDIK-IO)
➡️ AS214351 (FEMOIT)
What do they all have in common? According to bgp .tools, they all receive upstream connectivity from German provider aurologic GmbH (AS30823) as well 🔍👀
If you don't want to worry about the threats posed by bulletproof hosters, just block any CIDRs and ASNs listed on @spamhaus 's Don't Router Or Peer List (DROP):
🛑 spamhaus.org/blocklists/do-n…
ALT bgp.tools showing historic BGP upstream connectivity of Omegatech LTD provided by AS213382 PEERYX, AS30823 aurologic GmbH and AS51396 Pfcloud UG
Casperinous retweeted
This is absolutely nuts and only hitting German papers so far: leaked emails show that seven politicians from Germany's far-right AfD travelled to Syria to meet with Assad regime officials... facilitated by Hezbollah AND Russian intelligence.
handelsblatt.com/politik/deu…
Casperinous retweeted
Another day - another Stealer: MopsStealer 🐶
Active botnet C2s, hosted at Podaon SIA 🇳🇱:
📡 mops .to
📡 45.91.202.47:408
📡 45.91.202.47:1488
📡 45.91.202.146:408
📡 45.91.202.146:1488
Malware samples ⤵️
bazaar.abuse.ch/browse/signa…
IOCs ⤵️
threatfox.abuse.ch/browse/ma…
Casperinous retweeted
#ESETresearch uncovered #MythicRatatoskr, an undocumented Go backdoor hiding its C&C server inside the #Yggdrasil mesh network. It was used against a Ukrainian 🇺🇦 grain logistics firm in an intrusion that ended in a destructive #Sandworm attack.
welivesecurity.com/en/eset-r… 1/6
Casperinous retweeted
Every single person you meet in your daily life is fighting a hidden battle that you know nothing about
Send them a Zoom meeting link for an 8 AM call on Monday morning to finish them off
Casperinous retweeted
Wrote up my attempt at deobfuscating Luraph-protected Lua: lifting Lua to LLVM IR , then using AI + partial evaluation to strip the VM, and checking it against the original.
nac-l.github.io/2026/10/12/d…
Casperinous retweeted
🦠 ThreatLabz has identified an x64 variant of GuLoader. The sample uses similar anti-analysis methods as GuLoader x86 samples. However, the following anti-analysis features have been added:
- Huge stack frames in order to break IDA's decompilation.
- Direct syscalls to call Windows native API functions. GuLoader chooses a different syscall address that is chosen randomly.
- The registered Vectored Exception Handler (used to obfuscate the control flow) points to a location within NTDLL's memory region, making the exception-driven control flow appear legitimate.
- Use of the Windows API function TrySubmitThreadpoolCallback to execute callbacks and avoid detection.
Sample hash: dc5021a0e1d00fb1da9eef2b5d5ac3f9a5906e5c3c17470807c3845083ac5a6d
Malicious Google Drive URL: hxxps://drive.google[.]com/uc?export=download&id=1Zynj-CzTxaYpQr5aniRGE5gUqs26k-t5
