
I haven't blogged in a bit and I think part of that is it feels like no one really reads them anymore and just summarize them with an LLM. Is that just a me thing or is there some truth to that?
Garrett retweeted
enough people have been hounding me about GhidraMCP that I went ahead and updated it for those interested.
works with latest ghidra, headless + some extra niceties
just directly load plugin + start reversing
Garrett retweeted
Today, we're proud to finally bring @RemoteThreat out of stealth with the first integrated, end-to-end offensive cyber operations (OCO) platform.
Much of the focus today is on patching as fast as possible against noisy AI-driven attacks. We expect the next phase to arrive soon: models optimized for stealth, connected to sophisticated payloads and nation-state-tier offensive tools. Those attacks will be designed to evade detection, maintain access, and adapt as defenses respond. Enterprise security teams need to start testing against that level of sophistication now.
Evolving U.S. policy is also opening new opportunities for commercial offensive cyber. We see an emerging market for dual-use technology that strengthens enterprise security and supports authorized operational missions. That convergence of capability, policy, and operational demand makes the timing consequential.
RemoteThreat is built for internal enterprise red teams and warfighters. Its composable capabilities let operators select, combine, and customize tooling around their environment and objective. Internal red teams can vary sophistication to match the adversary they’re emulating. Warfighters can configure capabilities for the mission and adapt as conditions change. These capabilities are available to human operators, hybrid human–AI teams, and AI operators.
The platform connects planning, capability development, command and control, execution, and analysis- with existing tools, human oversight, and approvals integrated throughout.
It’s been a significant journey building this alongside my co-founder, Shawn Jones @anthemtotheego . We’re now 15 strong and growing, with some of the most talented security researchers I’ve ever worked with.
Given the sensitive nature of our work, some of our people will remain out of the spotlight. I couldn’t be prouder of this team and what we’ve built together.
If you lead an internal enterprise red team or build capabilities for the warfighter, I’d welcome a conversation.
businesswire.com/news/home/2…
Garrett retweeted
At #OffensiveAICon, @harmj0y & @tifkin_ will explore optimized evasion attacks & their transferability across EDR products.
They’ll share findings from reverse engineering four EDRs and experimenting with LLMs & GEPA to expand the search space for effective obfuscation.
Garrett retweeted
Worried about your production agents going out of scope? Us too. AgentJudge is our agent hall monitor that stops out of scope tool calls before they execute.
Before a tool runs, the judge reads the agent’s intent, the proposed call, and a rubric you define, then returns allow, deny, or ask (escalate to you).
The agent stays autonomous; the judge is the guardrail.
Available in the TUI today, UI updates coming to the Dreadnode Platform soon! 👀
Get Started: docs.dreadnode.io/getting-st…
AgentJudge Docs: docs.dreadnode.io/tui/guard-…
Related Research: dreadnode.io/research/scope-…
Garrett retweeted
I released 9 CVEs and tooling against the ATM supply chain at both @BlackHatEvents and @defcon this summer. I am pleased to share this was published in the following @WIRED article!!
wired.com/story/atm-flaws-re…
Garrett retweeted
ServiceNow won't let you query cleartext discovery credentials, not even as admin. @Tw1sm found a way to make the server hand them over anyway, no coercion or relay needed.
Works on SSH keys, AWS keys, Entra secrets, and LDAP creds.
Check it out ⤵️ ghst.ly/4y37KVo
Garrett retweeted
ConfigManBearPig 2.0 is out, a full Python rewrite built on OpenHound. Faster, runs on Linux, SOCKS proxy support, better BloodHound pathfinding for SCCM attacks.
➡️ ghst.ly/3RGyETm
Catch @_Mayyhem demo-ing it live at #BHUSA Arsenal TOMORROW, Tue 8/4, 5:15pm, Station 6.
Garrett retweeted
I'm releasing a new Python rewrite of ConfigManBearPig, my BloodHound collector for SCCM, next week w/ a TON of upgrades (SOCKS, hash/kerb auth, CVE scan, threads, pathfind) and am presenting at Black Hat Arsenal next Tues. Come say hi and grab a sticker! blackhat.com/us-26/arsenal/s…
Garrett retweeted
Compromise one node in a Windows Server Failover Cluster and you've compromised all of them.
@unsigned_sh0rt dug into why: shared credentials, forged tickets, and a full attack chain to own the cluster.
Check it out! ghst.ly/4wSZSoW
Garrett retweeted
The ADHD dream career is being a highly paid consultant who swoops in, solves a complex crisis with a chaotic stroke of genius, and immediately exits before having to fill out the timesheets.
Garrett retweeted
We used this technique on an op recently, and I wanted to create a simple resource on it due to it being seldom covered but very useful.
It's a cool way to get around various NTLM relay constraints when operating over C2 from low-privilege.
See it here:
specterops.io/blog/2026/07/1…
Garrett retweeted
If you're at Blackhat USA next month, I'm giving a talk on the Wednesday. Currently working on the presentation and attempting to avoid other rabbit holes until it's done! Excited to talk about this 😈 #BHUSA blackhat.com/us-26/briefings…
Garrett retweeted
[TALK] My latest Black Hat Europe talk is now publicly available. If you can look past the painfully obvious anxiety and a speaker who occasionally sounds like his brain has stopped cooperating, you might find something useful. Who knows?
youtube.com/watch?v=tOVcScKu…




















