CTO @TrustedSec | Former Optiv/SecureWorks/Accuvant Labs/Redspin | Race cars
/tmp/.a
Joined April 2008
- Tweets68.4K
- Following5.1K
- Followers76.4K
- Likes148K
Justin Elze retweeted
hey PSA, @HuntressLabs has been chasing a pretty gnarly new incident of a ScreenConnect worm, hitting hundreds of hosts downstream during the holiday today -- genuinely please do read up on this one if you've got ye' ol RMM running ↙️
huntress.com/blog/sckit-worm…
Attackers are using cloud-hosted ScreenConnect panels to install rogue clients on managed endpoints.
Don’t triage infected hosts with ScreenConnect. Connecting can spread the malware to your workstation and other panels you can access.
Details and IOCs: okt.to/XnlhWg
Justin Elze retweeted
#bugbountytip: friends don't let friends fire off ARTEX into the wildnerness.
some of the reason IR firms are so busy rn is going to be actual malicious actors, but i'd be London to a housebrick that a lot of it is attributable to stupidity.
fr, if you're doing this or know someone who is...
Justin Elze retweeted
I made a video showing @SandflySecurity 6.0 ripping into Mystrodx/Chronsrat malware disclosed earlier this year. I want to hit some highlights here (video link at end). This malware targeted telcos and likely other infrastructure. It had multiple mechanisms to hide. This is what we show when run on a host....
Justin Elze retweeted
I'm still happy to see that stackd still is superior in some areas.
github.com/radkawar/stackd
BREAKING: Nvidia, $NVDA, is preparing to fire Jensen Huang, its founder and CEO, after allegations of a second affair have surfaced, per WSJ.
The board is preparing to meet as soon as today to determine his future.
Justin Elze retweeted
And now have it confirmed from multiple people that the new tenant arrives in a broken-by-default state where MFA is required for your one admin user but MFA registration is blocked by CA, no workarounds 😬 cc @olafhartong
Seems Microsoft is nuking all M365 developer program tenants, with no path to migrate to their "new" setup. Just create a new tenant, of course subject to the current eligibility requirements. There goes my research tenant I've been using for 7 years... 🙄 learn.microsoft.com/en-us/of…
Tactical mistake I haven’t touched my PS5 or played Battlefield in four months, since I moved. Finally have a day off and wanted to play.
100 GB of updates later, I’m still not playing…
13
82
3,851
Agentic demos for regular people are in shambles
xitter.twitterapi.xyz/WSJ/status/21205794846…
United Airlines is banning personal AI assistants from booking flights, arguing the bots pose privacy threats and may violate FAA rules. 🔗 on.wsj.com/489bKZJ
Justin Elze retweeted
“We can do an indirect prompt injection to trigger a poisoned backdoored model to run a tool bypass that can exfiltrate data and it burns about $3000 in tokens to execute…”
“You know you can social engineer an employee to get the same data for pennies?”
“Yes, but that won’t get me clicks and VC funding to “defend” against this”
Most people in OffSec know clients who are still shook up from an incident 10 years ago when pentesters knocked over some servers or prod, and they’re still scoping and putting restrictions around testing because of it. Don’t be the people who start this cycle over because your agent framework is untested and does stupid things.
Justin Elze retweeted
I just built a cool project called p2pswarm!
p2pswarm is a true serverless, peer-to-peer work mesh for coding agents.
p2p-swarm connects Claude Code sessions on different machines into one self-organising team over Hyperswarm, a peer-to-peer protocol: a Kademlia DHT to find each other, UDP hole punching to connect directly, and Noise encryption end to end. They plan the job, split it, work in parallel, check each other and hand back the result.
at @adverserialAI we are planning to run swarm of AI Agents for cyber defense, this swarm need to be unstoppable so we choose P2P protocol and built p2pswarm
p2pswarm.github.io/
Justin Elze retweeted
This is good info about Microsoft Defender internals.
protokol-7.github.io/dfir/20…
Justin Elze retweeted
Got credited for CVE-2026-122175 yesterday.
Step 1: google what Windows Autopilot is.
Step 2: dig through my notes to guess which report it was. Can't find it.
Step 3: hope MSRC enlightens me with a case number someday.
No bounty, just my name on a page. Thanks, MSRC!
msrc.microsoft.com/update-gu…
Justin Elze retweeted
Basically InstallerFileTakeOver but superior
github.com/MSNightmare/SignD…
Justin Elze retweeted
A friend and ex coworker @martin_vigo 's DEFCON talk on hacking Amazon lockers is finally on YouTube. It's such a fun, excellent, pure hacker ethos talk... I highly recommend it, and definitely watch to the end... youtu.be/ZVmRe8OVZtE?is=D4Li…
Justin Elze retweeted
One of LOLBAS founding contributors, Jimmy Bayne (@bohops) joins us for the next PLL Episode. If you’ve ever wondered what’s still executing after you think you’ve locked everything down, he’s the person to ask.
We’re getting into WDAC bypass, the binaries that survive app control, and what attackers are still finding room to work with.
Subscribe here to join: magicsword.io/community/live
Justin Elze retweeted
I too have been basing my dismissal of abliterated models off the regular models lack of refusals.
This post from @Jhaddix made me go back and actually test. I think he is on to something.
In some IoT pentest benchmarks of mine, abliterated GLM 5.3 Flash is finishing the task 2-3x times faster on the same hardware.
Running my full benchmark setup now. This could be big.
I (and @xssdoctor) were just talking about our experiences the other day, for bounty and pentest work.
We have the opposite experience.
Running Abliterated models drastically changes offsec CoT and hence outcomes for cyber testing.
If you watch your chain of thought in a normal model, you’ll notice it taking a significant portion of your inference or tokens to argue about the tasks validity, safety, scope, and system prompt directives. PAGES of garbage reasoning polluting your attention mechanism for the transformer. It may get to “ok, I’ll do it” but you’ve wasted time, attention, and tokens, and have context pollution for future generations.
Abliterated models don’t do this. That and they also have the latent space to ideate and find solutions to things a normal model won’t.