Mostly RT interesting stuff. RT != Endorsement and all that jazz.
Crimea, Ukraine.
Joined May 2009
- Tweets17.6K
- Following808
- Followers391
- Likes0
Johan retweeted
Microsoft just published Autoruns for Linux 1.0.0, so I created a Velociraptor artifact for it.
Linux.Sysinternals.Autoruns covers cron, systemd, XDG, ld.so.preload, udev and more.
🔗 Linux.Sysinternals.Autoruns
github.com/Velocidex/velocir…
🔗 Autoruns for Linux
github.com/microsoft/Autorun…
Johan retweeted
New technique to identify if LDAP signing bypass has been patched on DCs. @GrayHatKiller found a creative way to determine patch status, and the best part is you can check it unauthenticated. His PR is merged to RelayInformer!
Johan retweeted
Cisco Talos (@TalosSecurity) published NIK C2, a Go implant that sends operator prompts to the OpenAI API from the infected machine. Without an operator key, it uses the victim's own OPENAI_API_KEY. Research by Chetan Raghuprasad.
blog.talosintelligence.com/n…
Johan retweeted
👇👇👇
Cairn: github.com/oritera/Cairn
CyberStrike: github.com/CyberStrikeus/cyb…
PentAGI: github.com/vxcontrol/pentagi
CyberStrikeAI: github.com/AIPentest/CyberSt…
PentestGPT: github.com/GreyDGL/PentestGP…
PentestAgent: github.com/GH05TCREW/pentest…
AutoPentester: github.com/YasodGinige/AutoP…
VulnBot: github.com/KHenryAegis/VulnB…
RedAmon: github.com/samugit83/redamon
MAPTA: github.com/arthurgervais/map…
Strix: github.com/usestrix/strix
Shannon: github.com/KeygraphHQ/shanno…
BugTraceAI: github.com/BugTraceAI/BugTra…
Nebula: github.com/BerylliumSec/nebu…
hackingBuddyGPT: github.com/IPA-Lab/HackingBu…
HexStrike AI: github.com/0x4m4/hexstrike-a…
CAI, now archived: github.com/aliasrobotics/CAI
Beyond #Artex, what other #offensive #AI frameworks should the cybersecurity community be watching?
A few on my radar:
🔹 CyberStrike
github.com/CyberStrikeus/cyb…
🔹 Cairn
github.com/oritera/Cairn
🔹 PentAGI
github.com/vxcontrol/pentagi
Have you tried any of these? Let me know!
Johan retweeted
Beyond #Artex, what other #offensive #AI frameworks should the cybersecurity community be watching?
A few on my radar:
🔹 CyberStrike
github.com/CyberStrikeus/cyb…
🔹 Cairn
github.com/oritera/Cairn
🔹 PentAGI
github.com/vxcontrol/pentagi
Have you tried any of these? Let me know!
Johan retweeted
New blog drop! 😊
Operation Snowball 🇨🇳
While sweeping open directories on @etugenio, I found a workspace of an autonomous AI intrusion harness. The TA used a jailbroken DeepSeek agent and ran two weeks of attacks against a European telecom provider:
malbearlabs.com/posts/operat…
Johan retweeted
keyeroo - Relay a coerced victim's NTLM authentication to LDAP and run an operation as that victim, even when the domain controller requires LDAP signing and is fully patched. github.com/grayhatkiller/key…
Johan retweeted
And yall are worried about agent swarms
teapaw.org/v12sec/status/21184420…
Changing one letter bypassed an entire admin API in @huggingface chat.
One request could trigger bulk internal exports of every user’s private chats, completely unauthenticated.
Here’s how. 🧵
Johan retweeted
Today Physical Superintelligence PBC is announcing a proof of the Aaronson-Ambainis conjecture, one of the central open problems in quantum complexity, with major implications for quantum computing speedup.
psi.inc/research/aaronson-am…
Thread 👇
Johan retweeted
sshole: openssh on musl linux accepts any password longer than 256 characters. sshhole.com
Johan retweeted
LogonStealer: Abuses the Credential Provider interface to steal plaintext passwords from logonui.exe via CredProvDataModel.dll hooks github.com/S12cybersecurity/…
Johan retweeted
No C2 allowed? Beacon over Microsoft Teams.
Reverse engineering Teams' meeting APIs and WebRTC data channels to run a C2 over Microsoft traffic that the infrastructure already allows.
A post by Clément Labro (@itm4n)
Source: blog.scrt.ch/2026/04/21/from…
#redteam #blueteam
Johan retweeted
My first #ARTEX hunt using @Huntio through its MCP server 🔥
New IP addresses returned by the search:
8.217.226.]218
143.198.221.]211:8787
113.45.22.]170:8787
43.143.238.]204:8888
#ThreatHunting
We've observed intrusion attempts against multiple targets using #ARTEX, an openly published AI penetration-testing framework in which an LLM agent chooses each step of an attack. Details at bit.ly/4kuobGz
ALT A flowchart titled "Multi-Stage Attack Flow: From Reconnaissance to Business Logic Abuse" illustrates six stages. Stage 1: "Recon" involves broad reconnaissance with scanned public IPs, S3 buckets, and internal hostname. Stage 2: "Mapping" includes application mapping with software bundles, source maps, and OpenAPI specs. Stage 3: "Identity" focuses on IdP probing with login, recovery, and OAuth flows. Stage 4: "Pivot" entails pivoting to exposed API and falling back to API surface. Stage 5: "Abuse" involves business logic abuse with actions to escalate and obtain functions. Stage 6: "Write" covers unauthorized API actions and executing commands.
Johan retweeted
We've reached a point where installing a browser extension, IDE plugin or software library deserves the same scrutiny as opening a TCP port on a DMZ server.
Except this attack surface can be spread across thousands of hosts inside your org... and you can't map it with a port scan.
Johan retweeted
Let us take a look at this one. We will check the source code for useful information we can use to build a simple hunting query 🧵
AI-Infra-Guard
One-Stop AI Red Teaming Platform by Tencent Zhuque Lab
AIG(AI-Infra-Guard) 는 OpenClaw 보안 검사, 에이전트 보안 스캔, AI 도구 및 스킬 스캔, AI 인프라 취약점 스캔, LLM 보안 평가(탈옥 평가)를 통합하여 AI 보안 위험을 확인하는 가장 포괄적이고 지능적이며 사용하기 쉬운 방법을 제공하는 것을 목표로 합니다.
github.com/Tencent/AI-Infra-…
Johan retweeted
The bypass of LDAP Signing Through Reauthentication described in @SpecterOps blog also works with pure Kerberos relay. too ;-)
Johan retweeted
People learn in different ways. I wrote Dynamic Incident Response, but not everyone wants to get cozy with a 666 page PDF. So I made a Gemini Notebook too: ask questions, critique, interact how you want. Free.
❤️👨💻
dynamicincidentresponse.com/…
Johan retweeted
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Read more: chainalysis.com/blog/binance…
Johan retweeted
Thanks @TenableSecurity for the mention! They used my php2shell PoC to reproduce CVE-2026-109618/109619 on several PHP 8.4/8.5 setups and wrote up why the exploit is so build-dependent: heap offsets, worker reuse, and why version checks lie. Great read.
tenable.com/blog/php2shell-o…
