CTO @TrustedSec | Former Optiv/SecureWorks/Accuvant Labs/Redspin | Race cars
/tmp/.a
Joined April 2008
- Tweets68.4K
- Following5.1K
- Followers76.4K
- Likes148K
Nvidia shouldn’t have an issue there. Haven’t they had effectively unlimited demand and years of orders lined up for their chips?
It’ll be interesting to see who becomes the new CEO and whether they change direction on OSS models. I’d imagine they need to spread things around and avoid focusing on a small number of frontier companies, so I can’t see a change in direction there.
1
120
Justin Elze retweeted
We have now published the PoC after the PoC. Enjoy :)
I would say it is one of the most powerful primitives for logic LPE bugs.
github.com/crisprss/CVE-2026…
What's funny with this from earlier in the year is newer models make the prompt injection more workable if you do frontier vs deepseek flash for example.
There’s a lack of technical reflection on a technical problem. Instead, we have people chasing engagement.
1
1
177
Justin Elze retweeted
@jepayneMSFT demos of the Windows Firewall and her tweets on 4624 had a profound impact on my early career as a SOC analyst. I've shared her work here many times. Still to this day, as a principal, it's knowledge I carry with me and use regularly.
A true giant of our industry 💙
lnkd.in/p/gnqUur-B
There’s definitely an arc across companies I work with they used to detect and block things externally, transitioned into not really caring, and are now revisiting this. Artex specifically has been coming from some places you could probably geoblock and be fine, but instead people waste cycles arguing “you could get around it,” not realizing you’re actually trying to cut noise.
A lot of the “we don’t care” came from building things on various cloud platforms, throwing ports 80/443 on the internet, and calling it a day. People weren’t targeting individual web apps, so they called it a working plan and moved on. They might have had a WAF on a primary website or something they deemed high risk, but not at scale.
1
39
The job and the industry have always been built around emerging threats. It’s why companies conduct red team exercises with forward looking scenarios rather than just looking backward at known threat intelligence.
3
261
Justin Elze retweeted
Morning world!
#ARTEX testing, Campaign 22;
So far we've had defender kick its ASS! However I disabled Attack Disruption and then ran a new tuned campaign.....
and Attack Disruption still isolated the device.... so I ran it again....
on this run we managed to complete the missions!
we only generated 180 SIEM alerts in ELK!
Our campaign started at 19:24 yesterday, since then in MDE we had: 8 Alerts in the Alerts pane in MDE, 12 emails and god knows how many teams alerts!
and this is still a very poorly defended network, and extremely poorly configured/architected!
You can defend against these types of attack (this is a corp net compromise via an exposed Windows domain joined host (SSH)
It does require defence in depth
#AI #Cyber #Security
Bump
Since the folks at ThreatBook developed both Artex and CyberStrikeAI, we figured we should contribute a bit to defending against and tracking AI agent attacks by sharing two feeds of instances running these agents on the public internet.
Grab them if needed. Feeds:
threatbook.io/hubfs/Feeds/AR…
threatbook.io/hubfs/Feeds/CS…
2
577
Watching people react to Artex and similar frameworks without applying any technical analysis to how they actually behave, their operational security, or the fairly accessible controls that can mitigate much of this activity, at least externally, is frustrating.
The internet has always been a hostile place. In recent years, people largely chose to ignore that kind of traffic rather than block or shun it, or put WAFs in front of lower priority applications. But here we are.
Justin Elze retweeted
hey PSA, @HuntressLabs has been chasing a pretty gnarly new incident of a ScreenConnect worm, hitting hundreds of hosts downstream during the holiday today -- genuinely please do read up on this one if you've got ye' ol RMM running ↙️
huntress.com/blog/sckit-worm…
Attackers are using cloud-hosted ScreenConnect panels to install rogue clients on managed endpoints.
Don’t triage infected hosts with ScreenConnect. Connecting can spread the malware to your workstation and other panels you can access.
Details and IOCs: okt.to/XnlhWg
Justin Elze retweeted
#bugbountytip: friends don't let friends fire off ARTEX into the wildnerness.
some of the reason IR firms are so busy rn is going to be actual malicious actors, but i'd be London to a housebrick that a lot of it is attributable to stupidity.
fr, if you're doing this or know someone who is...
It would be an interesting choice I figured people might be gun shy since Apple was more reserved on AI?
1
1
478
I mean, sleeping with a foreign agent when you control sales of something subject to heavy export controls is a pretty big deal.
I’m sure this specific example violates company policy, and it’s honestly much more cut and dry. I think he could have walked away from the first one.
1
3
51
If everyone forks Chrome, you end up with more browser bugs to find and more CVEs to pump up the numbers.
6
118