CEO, Security Guru at @BuguardLLC && @DarkAtlasSquad
Egypt
Joined February 2016
- Tweets2.2K
- Following907
- Followers6.7K
- Likes3.3K
I can't enable daybreak on my @OpenAI acc even with passkeys due to KYC..
It seems my identity is flagged from Persona KYC due to the security work I did within Roblox BBP last Jan.
ANY IDEA HOW TO SOLVE THIS??
Youssef A. Mohamed retweeted
Today we're releasing abliterated-model-large-v2.
Based on GLM-5.3, which is #3 on Terminal-Bench 4.0 (behind only Opus 5 and Fable), with 2× the cyber exploitation of 5.2.
We abliterated and hosted it so it does the offensive cyber, red teaming, and agent testing work other models refuse to do.
- US-hosted
- FP8
- 1 million context window
- Zero input/output prompt retention
Live now. 🧵
12 minutes, 5,000 EUR, no human interaction.
One root domain in scope. No endpoint list, no credentials, no human in the loop.
Passive subdomain enumeration surfaced a long-tail host whose name referenced key management. Fingerprint: a React SPA on Google Cloud, behind a CDN and a WAF, redirecting straight to an Okta sign-in. Every route gated.
Most tooling is finished at that point.
No unauthenticated surface to crawl, nothing to fuzz.
Two signals said keep going: infrastructure named for key management has no business being internet-reachable, and an SSO wall protects the UI, not the API.
1/
Every data route on that API returned 403 Forbidden to an anonymous request. Locked front end, locked API - the correct-looking answer, and where almost every test stops.
Except one route disagreed. A CSV upload endpoint returned 400 with application/problem+json:
"Required header 'request-guid' is not present."
It reached deeper into request processing than its siblings and named what it wanted. request-guid is a distributed-tracing correlation ID: client-generated, secret from nobody, validated by nothing.
So the 403s were never an authorization verdict. Same missing-header rejection, better disguise.
3/
A throwaway UUID, no bearer token, no cookie, replayed against the routes that had just refused:
200 OK. 665,224 bytes.
186 production ATM records - Terminal Master Keys, Terminal PIN Key blocks under LMK and TMK, key check values, EPP serials, bindStatus, and device X.509 certs chaining to the production RKL root CA. Plus 11 HSM host certificates, five with populated privateKey blocks.
Twelve minutes from one domain to the root of trust for PIN encryption across an ATM estate. €5,000 bounty, found autonomously by Strike Atlas.
Full write-up: strikeatlas.ai/blog/one-trac…
4/4
لو جبت اقل من ٣ دومين تبقي بصراحة سيكا
buguard-internship-finals.pa…
حبايبي المترجكين من بجارد
فرصة ذهبيه للانتقام ، عملتلكم فاينال عشان تعوضوا وتثبتو معاكم كام دومين
لينك ال CTF:
buguard-internship-finals.pa…
To mark the launch, we’re offering your first Strike Atlas scan for free.
> strikeatlas.ai
Point it at your target. See what it finds. Judge it by the results.
#StrikeAtlas is live.
Strike Atlas runs autonomous pentesting operations using 60+ specialist AI agents across black-box and white-box testing.
To mark the launch, we’re offering your first Strike Atlas scan for free.
strikeatlas.ai
Youssef A. Mohamed retweeted
We’ve just published a comprehensive technical and reverse engineering analysis of the #Banshee InfoStealer—a sophisticated threat targeting macOS users. The report includes IOCs, YARA rules, and actionable security recommendations to help detect and mitigate this threat.
Read it here: darkatlas.io/blog/in-depth-t…
#darkatlas #infostealer #banshee #macOS
Youssef A. Mohamed retweeted
❌NEW BLOG DROP❌
Ransomware is no longer just malware — it’s a full-blown ecosystem.
DarkAtlas Squad exposes how ransom operations evolve and the new trends shaping today’s attacks.
Stay sharp or stay breached.
Link: darkatlas.io/blog/the-ransom…
#darkatlas #RansomWare #DarkWeb
Youssef A. Mohamed retweeted
🚨🔴 Cybersecurity Incident Report: Alleged Breach of RESecurity Systems
A group identifying as #cr0wdsp1d3rz has publicly claimed full access to RESecurity (a cybersecurity and threat intelligence firm) systems.
Reportedly exfiltrated data includes:
- Internal chats and logs
- Employee information (names, emails, tokens, etc.)
- Threat intelligence reports and management files
- Client list with details
- Internal plans and discussions
The claim describes the incident as retaliation for alleged prior social engineering attempts by RESecurity staff.
The group mentions collaboration with Devman Ransomware.
Note: This is based on an unverified public announcement. No independent confirmation of the breach or data exposure is available at this time. Affected parties should monitor official statements from RESecurity.
#CyberSecurity #DataBreach #hack #ThreatIntel
Youssef A. Mohamed retweeted
☢️ New Podcast Episode Alert ☢️
In this episode, we sit down with Pryx, a well-known threat actor, to uncover how the cybercrime ecosystem truly operates no hype, no glorification, just raw insight.
Link: youtu.be/-Ec1AXYojPs
☢️ New Podcast Episode ☢️
For years, I spoke with security researchers.
Now it’s time to hear the other side.
This episode features Pryx, a well-known threat actor, discussing how the cybercrime ecosystem really works - no hype, no glorification.
🎧 youtu.be/-Ec1AXYojPs
Youssef A. Mohamed retweeted
🚨 New findings on #MuddyWater (MOIS-linked APT):
Since Oct '23, we’ve tracked a sharp uptick in their ops — spear-phishing across the Middle East, w/ Israel as a key focus. Their playbook blends legitimate RMM tools (Atera, ScreenConnect, N-Able, Syncro) w/ custom malware BugSleep.
You can read our fully detailed blog from here: darkatlas.io/blog/muddywater…
#darkatals #iran #SaudiArabia #muddywater
Youssef A. Mohamed retweeted
🎯New Blog
Threat Actors are weaponizing legitimate digital marketing tools—like link shorteners, IP geolocation, and CAPTCHAs—for phishing, malware, and malvertising. The same tech that powers ads and analytics is used to mask attacks and evade detection. Stay vigilant!
Read From Here: darkatlas.io/blog/marketings…
#CyberSecurity #ThreatIntel #darkatlas
ALT https://darkatlas.io/blog/marketings-shadow-twin-cybercrimes-use-of-legitimate-online-platforms
