HAIJA INTEL REPORT

The field of desync flaws arising from deep implementation bugs is absolutely wild. This finding from @calif_io using a fake pseudo-header than gets weaponized by a dodgy length calculation is a great example MAD Bugs: …

Step into real investigations. Real data, real cases, real threat actors, real tradecraft. Join us at DFIR Labs to put your skills to the test and gain insight from the real intrusions. Your lab is waiting: https:// thedfirreport.com/products/dfir- labs/ …

I've been out of the research game for a while, head down working on internal projects at @NetSPI . Finally had some free time to put in some vulnerability research which turned out to be fruitful. Lets see if MSRC agree.

I'm not sure if this is an anti-malware analysis technique, or legitimately child pornography. I don't want to find out. If this is child pornography, shoot them in the head. If this isn't child pornography, this is the most brazen anti-malware analysis technique I've ever

Yesterday two different people contacted me about two different projects on GitHub. "Tito" DMd me about someone making a comment on GitHub claiming to have a patch for "synara" (Image 1) "Robert Z" emailed about something similar on a different GitHub project (image 2).

We've seen four logistics firms getting hit by Teams messages (today!) that lead to Quick Assist, then a RAT/C2 that seems fairly novel. I'll get some IoCs later, but for now keep an eye out for Teams messages from .onmicrosoft.com accounts. @HuntressLabs

In regards to these files inside of "child porn folder", the files present inside all end in *.lnk (A Windows shortcut). This is a very common file masquerading technique to give the facade of a legitimate file, but it's actually malware (shortcut pulls a file that it detonates,

> be me > get dm > "is this malware?" > "windows defender went crazy when i tried this video game mod" > download > look inside > not malware There is a function in Windows you can invoke called "GetAsyncKeyState". In simplest terms, this function waits for user input on the

We are tracking a new #ClickFix campaign targeting #macOS users that installs a backdoor using LaunchAgent. Utilizes affiliate/cloaking redirect URLs to distribute lure pages hosted on pages[.]dev sites leading to 9 distinct payload URLs so far. Details at https:// bit.ly/4gnSkWd

How do you make sense of a Kubernetes environment that's constantly changing? Hector Riestra explores how Codex helped shape a reusable framework for reasoning about AKS identity, trust relationships, and attack surface. Read more

i like to leave a few artifacts of early drafts when i submit papers. maybe a grammatical error or two. want the reviewers to know all these hallucinations are home grown, baby