Maintainer of Manalyze, Gepetto, and writer. Trolling on a purely personal capacity.
London, UK
Joined April 2014
- Tweets3.1K
- Following72
- Followers11.4K
- Likes2.9K
Pinned Tweet
I've been working on this for 5 years, and it's finally out! I wrote a dark fantasy book (no computers involved), and it's the hardest thing I have ever done. I'm extremely proud of the final result. (But it's in French, for now.)
lechantducygne.fr/gestalt/
Ivan Kwiatkowski retweeted
Leaked files from Chinese company ZRON show a vast product catalogue and police (MPS) customers. But what did they actually buy from it, and how did AI fit in? Our new Natto piece digs in. Big thanks to @JusticeRage for insights from his own analysis of the leak. Link 👇
I just released some new research on an unknown MikroTik backdoor compiled for TILE-Gx. IDA Pro couldn't even open the file!
I think there's more to find, would love to get more eyes on this implant. Really excited about this research!
xitter.cf/VirLabs_AI/status/2110…
New VirLabs research: Tessera, an undocumented backdoor targeting MikroTik RouterOS on TILE-Gx.
The samples had 0 detections on VirusTotal. Underneath a small launcher and wrapper sits a fairly sophisticated remote-control implant.
virlabs.ai/blog/tessera/
Port-knocking is not something you see every day. I found a cool little Linux malware with zero detections which uses this technique, but wasn't able to tie it to any known actor nor find any other variant. Has anyone seen this before?
xitter.cf/VirLabs_AI/status/2106…
[Insert witty knock-knock joke]
I found an interesting/undetected Linux sample on VirusTotal: a port-knocking launcher that waits for a packet sequence before executing a separate payload, which unfortunately I couldn't find.
virlabs.ai/blog/knock-outd/
Man, it's great to be back to doing research. It's not groundbreaking, but sometimes looking at the broken stuff is fun. I know there are AI haters out there, but it makes me so happy to be able to do these quick investigations!
xitter.cf/VirLabs_AI/status/2105…
CLOSEDQUORUM, spotted by @TalosSecurity asks four LLMs to decide what a Windows implant should do next. AI-as-a-C2?
I analyzed two samples from their report. There is real experimentation here, but the implant was never really finished.
virlabs.ai/blog/closedquorum….
I had never participated in #FlareOn, not for lack of interest but due to the massive time commitment it represented. This year, I decided to pit @VirLabs_AI against it and was able to solve all challenges in <2h.
I suspect next year's challenges will be very different.
VirLabs now has a blog. I just published some new research on Red Heron!
xitter.cf/VirLabs_AI/status/2103…
Two names in a Linux rootkit configuration led back to HestiaCP compromises reported months before Acronis's Red Heron report.
I used VirLabs to follow the trail through SIXZUT, JITTERLY and their infrastructure.
virlabs.ai/blog/red-heron/
Ivan Kwiatkowski retweeted
Yes…the huge frontier models are going to become superintelligent, copy themselves, escape, and then discover the only hardware around is a 1080 Ti with 11GB of vram.
Jacob Coxon's next interview on CBS News (ex Anthropic+Open AI researcher who resigned)
"We can't just unplug it because it could be copying itself over to other computers. Like it's not that difficult to find yourself because an AI is just code. It could transfer itself over the internet to a different place and then you unplug it here, but it's actually still over there and maybe it makes 10,000 copies of itself and they're all cooperating."
----
From "CBS News" YouTube channel, (full video link in comment)
One thing that annoys me with the AI industry's open letter (openai.com/collective-cyberd…) is how they're creating a problem and asking everyone else to find a solution.
The solution is easy: if you believe your models pose grave cyber risks, stop releasing new ones for a year.
Cute phishing attempt today abusing @github. An issue is created in a fresh repo to send me an email notification from github.com that a suspicious sign-in was prevented. Clicking "this wasn't me" fetches support-message.github[.]io
Ivan Kwiatkowski retweeted
Wrote a short post on my experience running GLM-5.3-Flash, DeepSeek 4 Flash, and Qwen-3.8-Next locally.
Which is the best all-around local model for CTI workflows?
medium.com/@costin.raiu/top-…
Ivan Kwiatkowski retweeted
VulnCheck recently published its analysis of SPEAKINGSTONE, a Nim implant found in ZBT router firmware.
We submitted the exact sample to VirLabs to see what it could recover from the isolated binary: app.virlabs.ai/shared/WmceoI…
My time with Meta has ended! I'm now focusing full-time on a start-up I co-founded, @VirLabs_AI. I made a platform where you upload a virus sample and it analyzes the sample for you with IDA Pro.
It works really well (ex: Sunshuttle, app.virlabs.ai/shared/Y56kSP…)
The payload used by the French police might have been low-tech, but it shines light on a threat model that is anything but.
How do you defend against an adversary that can seize your private keys, SSL certs, and can change your DNS records at will?
computerweekly.com/news/3666…
For the record, a garden leave in the UK means that you're still employed by your company, not required to perform actual work, and can't be rehired or start a company.
In other words the person gets paid+vests for a year for doing absolutely nothing.
There are worse fates.
John Jumper, Nobel prize winning co-creator of AlphaFold has to serve a one-year gardening leave stint before he starts work at Anthropic (originally picked up by @HughLangley @ BI)
Stints of this length given current acceleration make literally no sense.
Last month is a different world, imagine what next year will look like.
On August 12, the White House created a framework for private companies to conduct offensive cyber operations overseas.
I wrote about why this is a bad idea, from perverse incentives to the erosion of trust in US security vendors:
blog.kwiatkowski.fr/hack-bac…
Armored Likhod is a very interesting threat actor, it's not every day that you get what looks like a western APT!
I took a look at the malware using VirLabs and found a C2 server not reported publicly by Kaspersky: servrwindow[.]com
xitter.cf/VirLabs_AI/status/2088…
Kaspersky published some interesting research yesterday on Armored Likho's new Still toolkit.
VirLabs analyzed two of the samples: StillSync (68f0365d2fa8c828d012d8859e52a773) and StillAudio (439255736797bc88bd19f282449e0436).
app.virlabs.ai/shared/Emz-hS…
app.virlabs.ai/shared/CGLyG-…