Red/Purple/Research | Adversary Services @xforce red | ✞
The Land of Pleasant Living
Joined August 2017
- Tweets8K
- Following488
- Followers15K
- Likes13.8K
Pinned Tweet
[Blog] Abusing .NET Core CLR Diagnostic Features (+ CVE-2023-33127)
- Analysis of .NET diagnostic features and tradecraft
- Walkthrough of a .NET Cross-Session Local Priv Esc (LPE)
- Defensive Recommendations
bohops.com/2023/11/27/abusin…
bohops retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
bohops retweeted
We're hiring a Principal Security Research Engineer (AI Security)! Looking for someone with a strong background in threat research, detection & offensive security, and a passion for detecting and preventing AI threats.
Apply here: tinyurl.com/2pd2u8sr
bohops retweeted
The context behind such tweets is that the AI companies are rejecting 40 years of cybersecurity knowledge. They are ignorant of cybersecurity and are trying to re-invent it from scratch, repeating the mistakes of bad people from 40 years ago.
Glad to see the Ravens finish strong despite early woes. Game balls for King Henry, Huntley, and Hamilton. #RavensFlock
bohops retweeted
Sometimes in the debates about AD vs Entra it is forgotten that what does and doesn't get added to both is decided by Microsoft based on its own commercial interests.
There's no law that says AD can't have X or Y.
And it's not decided by customers or markets.
bohops retweeted
It’s fun watching companies build paid pentest automation on top of open source tools and research, and give nothing back to the community they’re built on.
Historically, this space has been pretty good about crediting the original researchers and contributing back. That seems to be slipping as everyone tries to productize it.
The pullback in community contributions over the last couple of years is pretty obvious. I’m not sure many people realize what their R&D costs will look like if that continues, even with AI.
bohops retweeted
🔥 The first Three Buddy Problem from Offensive AI Con is live! Audio only.
IBM X-Force’s Valentina Palmiotti (@chompie1337) walks us through the autonomous Windows kernel exploit pipeline she built on older Claude models, which landed within a hair of Mythos for about $180 a chain.
Plus, the Pwn2Own bug Claude called unexploitable, why her Pwn2Own bugs still sit unpatched, disappearing exploit techniques, the dread of being a defender, and how Phrack found its way back into print.
open.spotify.com/episode/2wE…
bohops retweeted
vf3 (very fast fun vibe fuzzer) designed by @_dinolover38 is faster than Jackalope and libprotobuf-mutator 😳 🏃🏻♂️🔥 #OAIC
bohops retweeted
Thank you to @UnpromptedAU & @BSidesCbr for inviting me to speak. Being back down under was lovely! You can find the slides for my n-day automated pipeline talk here. I’m at OAIC this week if you want to chat about exploit dev in 2026 and beyond. beautiful.ai/player/-P2q0r-B…
bohops retweeted
I've been waiting a long time to write this.
@RemoteThreat is officially out of stealth.
For more than 20 years Chris Thompson (@retBandit) and I have worked across cybersecurity, centered on offensive security, red teaming, and building capabilities for operators.
Over that time, we have watched offensive security become incredibly capable, but increasingly fragmented. Tools, infrastructure, workflows, and operational data living across different systems—with the operator left to connect the dots. When we started RemoteThreat, we believed AI was going to fundamentally change how cyber operations are conducted. But we also believed AI alone wasn't enough.
We saw an opportunity to bring the entire operational ecosystem together, connecting capabilities, execution, infrastructure, and data into one operational picture—and giving AI the context to understand what’s happening and act on it. We also wanted to give operators the flexibility to match the platform to the mission—moving quickly when speed matters or dialing up sophistication when the operation demands it.
The result is a platform designed to help operators make better decisions, reduce cognitive load and mistakes, adapt as the operation changes, and help determine what should happen next.
From planning through execution and analysis. Start to finish. One platform.
Cyber operations for a new era.
That's the vision behind RemoteThreat.
Human expertise. Machine capability. Mission speed.
But as proud as I am of what we are building, I'm even more proud of who we're building it with.
One thing you'll hear me say constantly:
"Team beats individual every time."
Chris and I have been incredibly fortunate to assemble a group of people who believe in what we're building, push each other, and genuinely want to build something that can redefine what's possible in cyber operations.
And our team today is only the beginning.
To our team, families, investors, customers, design partners, and everyone who believed in us while we were building quietly—thank you.
We're done building in the shadows.
RemoteThreat is here.
And we're just getting started.
lnkd.in/gDY55WXj
bohops retweeted
Today, we're proud to finally bring @RemoteThreat out of stealth with the first integrated, end-to-end offensive cyber operations (OCO) platform.
Much of the focus today is on patching as fast as possible against noisy AI-driven attacks. We expect the next phase to arrive soon: models optimized for stealth, connected to sophisticated payloads and nation-state-tier offensive tools. Those attacks will be designed to evade detection, maintain access, and adapt as defenses respond. Enterprise security teams need to start testing against that level of sophistication now.
Evolving U.S. policy is also opening new opportunities for commercial offensive cyber. We see an emerging market for dual-use technology that strengthens enterprise security and supports authorized operational missions. That convergence of capability, policy, and operational demand makes the timing consequential.
RemoteThreat is built for internal enterprise red teams and warfighters. Its composable capabilities let operators select, combine, and customize tooling around their environment and objective. Internal red teams can vary sophistication to match the adversary they’re emulating. Warfighters can configure capabilities for the mission and adapt as conditions change. These capabilities are available to human operators, hybrid human–AI teams, and AI operators.
The platform connects planning, capability development, command and control, execution, and analysis- with existing tools, human oversight, and approvals integrated throughout.
It’s been a significant journey building this alongside my co-founder, Shawn Jones @anthemtotheego . We’re now 15 strong and growing, with some of the most talented security researchers I’ve ever worked with.
Given the sensitive nature of our work, some of our people will remain out of the spotlight. I couldn’t be prouder of this team and what we’ve built together.
If you lead an internal enterprise red team or build capabilities for the warfighter, I’d welcome a conversation.
businesswire.com/news/home/2…
💯👇
Just throwing it out there but Offensive AI Conference (OAIC) starts in about a week. This venue is good as any for cybersecurity and AI people to actually talk about working together.
offensiveaicon.com/
Fantastic read and as someone who has worked with ML and cybersecurity this is exactly what I have long suspected.
Cybersecurity and AI need to work better together
We need to help establish standardized training environments, transparency for events, we need to also create measurement systems for capability that helps us understand when to worry and when things are impressive but not end of the world.
Us in cybersecurity are extremely happy to help doing this, please reach out
bohops retweeted
I think that all of the focus on exploit specific detection is a losing strategy in general. Post-exploitation detection is more resilient and if you're strong there, you will catch intrusions regardless of the CVE number. The overwhelming majority of in the wild zero day exploitation I have encountered in my life has been identified by detecting post-exploitation behavior.
Often overlooked endpoint here 👀
Even more privileged ADCS ESC_CES adhdmurky.github.io/posts/po…