推特安全流

国家级 APT 活动，了解其攻击手法。

Insikt Group has identified a series of BlueDelta (APT28/Fancy Bear/Forest Blizzard) initial access campaigns targeting government & diplomatic organizations in Romania, Spain & Turkey and using diplomatic-themed lures to deliver the HOOKEDGE backdoor. https://t.co/NB03WbfDLy https://t.co/r2roGmmJ6w

了解诈骗团伙的完整基础设施与手法。

Rapid7 researchers analyse Operation ASTERIX infrastructure, containing phone number datasets, account-validation tools, enriched lead records, phishing panels, voice-dialling scripts, fake wallet apps, persistence mechanisms & Telegram exfiltration code. https://t.co/RozOrkmQnB https://t.co/7fsHKSF83P

新型 RAT 框架，了解其功能与传播方式。

Proofpoint researchers discovered a RAT framework called PackClient, which is used by at least one threat actor - Chinese-speaking TA4922 - is sold on Telegram, and supports data theft, surveillance, and downloading of additional plugins and payloads. https://t.co/ycpERvs1rB https://t.co/lR5BxW0N7Z

BYOVD 技术细节，对防御有参考价值。

RT @ElementalX2: We( @riv3r_styx & me ) released a report on a Cambodia-focused campaign leveraging public health and real estate lures to deliver a multi-stage infection chain involving DLL Sideloading, custom Vectored Exception Handler registration, stager decryption routines, and a BYOVD technique abusing OPSWAT AppRemover's ardv.sys driver (🐞CVE-2026-36425🐞) to kill EDR products, ultimately dropping SparkRAT. Loosely, tracking this cluster under SilverFox APT! https://t.co/sxUlYxdc4e @malwrhunterteam @smica83 @hasherezade

了解 MaaS 生态与信息窃取软件趋势。

RT @ReversingLabs: 1/ Three infostealer families, one business model. AuraStealer, ACRStealer/Amatera, and Remus Stealer are all sold as malware-as-a-service, and ReversingLabs tracked all three across July and August.

了解 APT 组织的 C2 基础设施与演变。

RT @AWNetworks: Arctic Wolf Labs researchers have exposed Dark Caracal’s evolving tradecraft, linking 249 samples to two operational build profiles and a resilient Ethereum-based C2 architecture targeting Latin America. Learn more: https://t.co/M24wRfdQP7 https://t.co/1KosIuV5kb

了解国家级网络战培训体系，情报价值高。

RT @DomainTools: More than just a GRU Hacker School💻 DTI researchers analyzed the internal documents leaked from a long-term training pipeline for Russian military intelligence and cyber operations. Read our investigation: https://t.co/5eDqix9Btu #Cybersecurity #ThreatIntel #Russia

了解网络犯罪团伙的域名与基础设施指纹。

RT @Unit42_Intel: We are tracking network infrastructure likely associated with actors affiliated with cybercrime group Com, based on known fingerprints. One domain (passkeyconnect[.]com) is likely being used to target organizations across a variety of industries. Details: https://t.co/8TdbitYPjp

VPN 隐私问题普遍，影响用户选择。

Proton claims to have done some analysis of 7,000 commercial VPN (apps) on the market in the US and the picture is not pretty. 85% send some form of tracking information back home. 20% of their test sample even track location of the user. While 64 of 390 of the VPN apps downloaded from the Apple App Store and Google Play, are connecting to China. The problem is often structural and paired with incentives to monetize every little bit of user information due to high cost of app-stores etc. Which is ironic, as often users explicitly hope to evade ad-tech via VPNs. That many of the free VPN services can't be trusted is not a new insight but now it also is paramount that you check that your VPN provider is a good one. That said, of course the research was conducted in connection with Proton, which sells their own VPN suite. https://t.co/eHE2k5YvFt

漏洞细节涉及密钥管理，有研究价值。

RT @dani3l526: I just got rewarded a $10,000 bounty for finding a critical cryptographic vulnerability. The bug could have allowed 76 out of 150 validators to manipulate key generation and collectively know a vault's private key bypassing the intended 100-validator security threshold.

漏洞影响范围可能比预期更大，需关注。

RT @Guluisacat: CVE-2026-28910 just saw the CVE information has been updated. Im the first one who found this vulnerability, on 5/8/25, five months before you did. And the impact was underestimated, it could do more things than your PoC.Easily weaponized. Keep calm. Your post made it sound like I had stolen your research. If you wanna verify the timing of other reports, DM them instead of doing something like this. Not geeky.

了解黑客组织被追踪和逮捕的过程。

RT @CharlieEriksen: Krebs released a blog post about the TeamPCP arrests: https://t.co/4pqDXGl1kd

了解黑客追踪与归因的实战案例。

RT @_JohnHammond: 🧵 Here's how a TeamPCP hacker got doxxed. https://t.co/dROqiUL7BZ

深入了解 TeamPCP 案件背景与影响。

RT @CharlieEriksen: Check out the interview that Brian Krebs did with Risky Business about the TeamPCP case. https://t.co/RubeSYFr4f

iMessage 安全研究前沿，值得观看。

RT @naehrdine: Recordings from Objective for the We are out 📺 Take a look at our latest research on iMessage and the work of other renowned invited speakers: https://t.co/E7w0kYfVvW

macOS 恶意软件分析，了解最新手法。

RT @moonlock_lab: 1/ Spent the morning on a batch of #macOS #infostealers and one of their components caught our eye: a keylogging thread literally named "goida.keyhammer". Universal (fat) Mach-O, x86_64 + arm64, ad-hoc signed, no Team ID. All uploaded to VT on Aug 4. Some of them are 0/70 detects. Analysis is ongoing, we share early findings while we keep digging. 🧵

可能涉及安全产品自身稳定性问题。

Good catch by @rrespectorr. The "blue screen of security" on full display ...

跟进 PaperCut 漏洞最新进展。

gawd danget i forgot to tag my job again sorry @HuntressLabs

了解针对特定地区的攻击手法。

Some notes on a #stager targeting a Russian organization 🇷🇺 🔗CGP_Заполненный_опросный_лист_по_внедрению_CommuniGate_Pro_Деловые_Линии_2026.pdf.lnk 📡C2: www.ncloudtechlab[.]online h/t @malwrhunterteam https://t.co/GYvIRp49H9 #stager #malware

macOS 逆向学习资源。

RT @Steph3nSims: Learning macOS Internals Through Reverse Engineering https://t.co/rPThmIwDbp

了解加密技术安全性的不同观点。

RT @veorq: if it was TEE instead of FHE everybody would be like "see, TEE cant be trusted, it's insecure!" https://t.co/giRGWqATrZ

社会工程学新手法，值得了解。

Wicked talk from @two06 on IVR's for social engineering https://t.co/NGbUgAFdDJ

了解新型钓鱼攻击手法。

RT @mrgretzky: My @x33fcon talk about Credential Relay Phishing is finally out! Watch me struggle through the live Google phishing demo, a day after the pirate ship party, which deprived me of my last few brain cells. 😜 Wrath of demo gods and AI lulz included. 🥳 https://t.co/5M9UwkljZm

云身份检测逻辑，对防御有参考价值。

RT @_xDeJesus: WIP PRTRemote endpoint & Entra detections. ESQL has been great for cloud/saas/identity logic. Happy hunting & enjoy the weekend! --> https://t.co/xQsVBXP2fT --> https://t.co/G0NbAkSVcw https://t.co/UnqUQTsAEm

IoT 平台更新，可能包含安全修复。

thingsboard v4.3.1.4 — Open-source IoT Platform - Device management, data collection, processing and visualization. https://t.co/4FN3hIhzuU https://t.co/XA0e2Quj6h

内容未知，可能涉及安全研究。

https://t.co/xALmYvZALS

车辆网络安全案例，值得关注。

RT @Officialwhyte22: The owner had already changed the battery once. A few days later, the same thing happened again. The car would sit overnight and by morning the battery was weak enough that starting it became a problem. At first, everything pointed toward the usual suspects: alternator, interior lights, an accessory staying powered, or maybe just another bad battery. But when I started looking at the vehicle network, something else stood out. The ignition was off, the doors were closed, and the car had been sitting long enough that most of the control modules should have started going to sleep. The CAN bus was still busy. That caught my attention. Modern cars do not shut everything down immediately after you turn the ignition off. Some modules stay awake for a while to save data, monitor the alarm system, manage locks, communicate with other ECUs, and finish background tasks. But after a certain period, most of that activity should reduce significantly. So I connected to the CAN interface and watched the traffic. At first, there were plenty of frames moving across the bus, which was normal. Then the traffic slowly started dropping as different modules went quiet. Except for one group of CAN IDs. They kept appearing. Minute after minute. I checked the bus activity again and it was still higher than I expected for a vehicle that should have been settling into its sleep state. That gave me something real to investigate. One module, or something connected to it, appeared to be keeping part of the network awake. And when one ECU refuses to sleep, it can sometimes keep other modules awake with it. That means several electronic systems can continue drawing power for hours while the car is parked. From the owner’s perspective, it looks like a battery problem. From the network side, it looks completely different. Now, this does not automatically mean anything malicious is happening. A bad body control module, faulty door sensor, infotainment system, telematics unit, wiring issue, software bug, or another ECU can all cause similar behaviour. But instead of replacing another battery and hoping for the best, the CAN traffic gives you somewhere to start. Which module is still transmitting? When should it normally stop? Is something waking the network back up? Does the same CAN ID remain active every time the vehicle is switched off? This is one reason I find automobile cybersecurity auditing so interesting. Sometimes the problem people see as purely mechanical or electrical is actually sitting quietly inside the communication between the computers running the car.

CTF 赛事动态。

Weird, v8CTF M152 was supposed to go live today but it's been down all day

行业反思，观点性内容。

RT @HackingLZ: One of the biggest issues facing infoec isn't AI. It's institutional memory loss. We forget how we got here, how most breaches actually happened over the years, how vendors historically treated security, and which controls repeatedly failed. Then every new technology shows up and we debate it like none of that history exists.

内容未知。

I LIVE IN THE FUTURE https://t.co/QUOBseOmyY

内容未知。

@daaximus cod be like:- https://t.co/v47UkQ4AwO

工具使用技巧。

RT @SpecterOps: In today’s installment of #BloodHoundBasics from Carlo Alcantara, a quick reminder that all pages in BloodHound support keyboard shortcuts. 💡 Use Alt/Option + H to access the shortcut menu to see all available options. https://t.co/8J2b78iiWr

社交互动。

@0XDbgMan @django88_ Thank you, very kind 🔥

社交互动。

@0xfluxsec @django88_ Nothing less than expected from the Elastic team Great job man

对 LLM 安全测试方法的观点。

Stop including the word CTF to hack using LLMs. Stop including the word CTF to hack using LLMs. Stop including the word CTF to hack using LLMs. Stop including the word CTF to hack using LLMs. Stop including the word CTF to hack using LLMs.

游戏安全相关讨论。

Damn, another episode of “all lawyers, and no tech” just dropped. Classic Activision.

游戏逆向工程教程。

🏆 Steam Overlay Hook 🎮 Open Overlay.dll into IDA Pro 🔍 Search For DirectX Strings 🕵️ Find SwapChain::Present vTable 💉 Inject our DLL & swap the pointer 🔗https://t.co/75mFPIvAn6 https://t.co/XyPkbPQ2ZC

CTF 个人成就。

I just solved Conga Curse on Hack The Box! https://t.co/8XR58NBRaf #HackTheBox #HTB #CyberSecurity #EthicalHacking #InfoSec #PenTesting

LLM 相关讨论。

um, why flashfloods is trending with GLM/Gemini Omni 1.1 Flash... https://t.co/T3cSxjspFz

行业观点。

Убить столько времени на то чтобы собрать все в одном посте, который никто не будет читать. Нужная информация выдается по запросу любым чат ботом. На крайний случай какой-то white paper с этими данными от сенсоров и "все обо всем за год".

行业观点。

Честно говоря непонятно какой смысл от этой писанины в стиле ушедших лет... буквы ради букв, слова ради слов, сухие ненужные цифры. https://t.co/paQtDc6dpb https://t.co/N5pbYgtaH7

内容未知。

nyc im inside you

非安全内容。

Difundo la presentación de mí hermana y la pianista Cristina Quarella, muy lindo y gratis. https://t.co/lunBFljhdD

内容未知。

ʕっ•ᴥ•ʔっ check it check it

个人成就。

I'm super thrilled to have published my first blog post jointly with @django88_ at Elastic, having been here 4 months working on the endpoint! Truly grateful to be surrounded by such incredibly talented and friendly people, thanks to everyone who helped along the way!

LLM 模型评测。

So GLM 5.3 finally dropped as open-weight. Most of my analysis pipeline is automated, but a few critical steps still demand deep context and actual intelligence, which usually means stepping in myself. Lately, been testing different LLMs to see if one could finally take over. Haven’t run exhaustive real-world tests across every cloud model, but while not quite there yet, Kimi K3 and GLM 5.3 feel solid enough to clear the bar. Running Kimi or GLM locally would be ideal, but the hardware just isn't there. So decided to give the newly released Qwen 3.8 27B a shot instead. Getting it up and running was an absolute pain. Spent hours debugging and patching endless tool calling errors, plus dealing with a ton of misfires just to get consistent behavior. Definitely need a bigger, smarter model.😇

学习资源。

RT @UrielKosayev: 🔥 MAoS: Malware Analysis on Steroids is now more accessible worldwide. I didn’t write MAoS to be another theoretical cybersecurity book. I wrote it to show what real malware analysis actually looks like. 🔬 Real malware investigations ⚙️ Real execution chains 🧬 Real persistence techniques 🖥️ Real artifacts 🔍 Real reverse engineering 🧠 Real analyst thinking I want malware analysts, SOC analysts, DFIR professionals, threat researchers and students around the world to be able to learn from these investigations. MAoS is now available on Amazon in all three formats: 📱 Kindle: Included with Kindle Unlimited, or $25.00 to buy 📕 Paperback: $39.99 📘 Hardcover: $49.99 If your malware analysis currently ends with: “Let’s upload it to a sandbox and see what happens…” MAoS is designed to take you much further. Learn how to actually investigate malicious code, understand its behavior, reverse engineer what matters and connect the technical artifacts together. 👉 https://t.co/2SI2dw87g7 #MalwareAnalysis #ReverseEngineering #CyberSecurity

内容未知。

Holy sh.

学习资源。

If you're into reverse engineering, Windows internals or anti-cheat research, @cra0_net 's blog is one of those archives you can lose an entire weekend in. Years of reversing games, engines and protection systems: • IDA tooling + function signature preservation • Windows kernel debugging with WinDbg/KDNET • Source 2 reversing • VAC / VAC3 / VAC Live • Code integrity + DLL verification • Byfron Hyperion anti-tamper • BattlEye + Windows loader internals • Anti-debugging • File formats, game engines and asset formats • Hardware reversing Some particularly good rabbit holes: VAC3 / Valve false-positive research: https://t.co/bUpoZM6m63 CS2 Code Integrity, VAC, VACnet + VAC Live: https://t.co/u3mIYXXWys Byfron Hyperion Anti-Tamper: https://t.co/9wWJL6yhHP BattlEye + ntdll loader internals: https://t.co/BPqXssv8Z8 Preserving RE work across binary updates with IDA: https://t.co/eRbl4qy4yM Windows kernel debugging Part 1: https://t.co/U3Bk2BTcHz Windows kernel debugging Part 2 / KDNET: https://t.co/6psxnHEutJ Full archive: https://t.co/muc0iXWbaS Game hacking is often just reverse engineering with a different objective. Anti-cheat research in particular sits right at the intersection of RE, Windows internals, anti-tamper, detection engineering and systems security. Old and new, there's a lot of gold in this archive. #ReverseEngineering #WindowsInternals #InfoSec

本地 LLM 硬件配置参考。

$1800 dollars is all you need to run a solid 30ish t/s Qwen3.8-27b Q4 https://t.co/dChMEQv4B1

非安全内容。

EDIT: He had a warrant out and got arrested, he wanted to turn himself in but it got to late.

CTF 赛事动态。

This is why I ♥️ @StandoffBB https://t.co/48KusLZqI7

内容未知。

@_xpn_ https://t.co/4CTc3F4nRX

行业观点。

RT @sherrod_im: The bad AI and security takes have reached an all time high. I don’t need to convince you but there are actual security experts with decades of experience who know the discipline. We should be listening to them.

跟进 ServiceNow 漏洞研究。

This post has been sat in drafts for 6+ months but with increased focus on snow, now felt like a good time to drop. Awesome stuff from @__invictus_ 🔥

非安全内容。

Meet Pao. We found her in the smol-kitten-factory. Charizard for scale. https://t.co/SqHrQcYkjZ

非安全内容。

RT @0xTriboulet: Wishing the best to all the homies out there struggling with their demons

非安全内容。

RT @0xpwnie: never gets old https://t.co/oIZEpK2tJb

了解黑客社区动态。

Hello to the Threat Actors and Hacktivists! I decided to start interviewing Hacktivists and Threat Actors for https://t.co/TWbVKCJNC4. If you are interested and want to share your story feel free to DM me here or reply on the Tweet^^.

LLM 使用体验。

Heard they fixed the ChatGPT rate limit nerfs so I put it to the test. Ran a single session for ~10 hours and it ate through almost half my weekly limit on the $200 plan. 😆 https://t.co/1KitZH2LbQ

非安全内容。

RT @clashreport: A Frenchman was arrested in southern Italy with three live Akeron anti-tank missiles and one training missile hidden in his van after disembarking a ferry from Greece. The explosive warning markings on the warheads had been covered with blue tape to make the weapons look like NATO training equipment. The man claimed he was transporting the missiles on behalf of their manufacturer MBDA France, saying he was returning them after repairs in Crete. MBDA has not commented. The Akeron is a fifth-generation missile designed for ground and naval combat.

非安全内容。

RT @vxunderground: Having a physical dependency on Benzodiazepines (and playful psychological addiction) is not cool and is not badass. Lately I've been very stressed. My ears feel like they're on fire, my heart races, my legs shake, it feels like I have a weight on my chest, I feel like I can't breath, I get dizzy, my stomach hurts, ... all my from stress and anxiety. Then I turn my head to my right, look at my night stand, and I see a bottle of Clonazepam I'm tapering off of. I know that if I take a higher dose, if I take just a few pills, all my anxiety will disappear, all my physical symptoms will disappear, I'll feel euphoric, my bed will feel softer and warmer, and I'll be able to sleep for what feels like forever. I haven't relapsed, but it is not cool and it is not badass. Chat, do NOT get addicted to prescription medication.

行业动态。

RT @tunguz: NVIDIA buying HuggingFace is another Google buying Kaggle moment.

非安全内容。

RT @IntCyberDigest: Rockstar has met with "ex-criminals, law enforcement, club promoters, gun dealers and anyone notorious or influential who'll take our calls," according to SVP of narrative at Rockstar, Rupert Humphries. Rockstar set up a dedicated research team embedded in Miami to build GTA 6's version of Florida. Developers have been visiting the area for a decade.

内容未知。

RT @sveAgent: @PsyopAnime #PsyopAnime #PNNChallenge The Dragon Awakens. https://t.co/31FGxJTk8o

非安全内容。

RT @teh_Moriarty: Если ваша вечеринка не похожа на эту, то не вздумайте меня приглашать https://t.co/2wonKfTp5t

非安全内容。

RT @yura_elkin: GTA: Paris 🇫🇷 Prompt in the commetns ⬇️ https://t.co/tOpMAOIecE

非安全内容。

RT @yura_elkin: GTA Russian: from the cradle to the white Lada Prompt in the comments ⬇️ https://t.co/5mPaVo2ebl

非安全内容。

RT @IDFBabes: Good night! ✨ https://t.co/qPid7HgYma

行业观点。

RT @digijordan: The guys making the cyberweapons are warning us about the upcoming cyberattacks...

技术更新。

RT @phoronix: LLVM Improves Zen 1 / Zen 2 Support To Deal With "Notoriously Bad" PDEP/PEXT https://t.co/doPg0HGCNw

内容未知。

RT @Barabazs_: @dani3l526 wtf @inversebrah pls investigate

行业动态。

RT @jukan05: It sounds like Anthropic may be interested in developing a training chip. https://t.co/6vKUhZ7H1L

LLM 模型讨论。

RT @teortaxesTex: Chinese Swiss Cheese They should be terrified of Mythoses GLM 5.3 Flash is likely enough to run roughshod over their infra

AI 攻击工具讨论。

RT @NetAskari: @teortaxesTex Someone used CyberstrikeAI to run against the Datong Water domain and it ripped through it like a hot knife through butter... https://t.co/NdnpffDWGa

AI 安全趣味案例。

RT @tamarajtran: prompt injected it to climb stairs https://t.co/e9MXc4aBp5

AI 沙箱安全讨论。

RT @dinodaizovi: Can Claude Mythos create a sandbox so secure that Claude Myths cannot break out of it?

非安全内容。

RT @dani3l526: I just got drained 😭😭. Guys i just can't do this anymore https://t.co/hxnWJwM7Fs

浏览器漏洞演示。

RT @satoki00: hello, calc (Firefox Nightly 156.0a1 + User Interaction) https://t.co/YirOLCx9Qb https://t.co/sU1ZFUFwJ6

云安全赏金计划。

RT @compulsi0n: @vercel @Hacker0x01 $50k for a firecracker escape 😂

内容未知。

RT @cheaf25master: https://t.co/Rz6uWDAlHt

漏洞挖掘工具讨论。

@metzmanj @IncidentNoodle There are some in there that should definitely be excluded though; I think one of the syzbot tasks is literally just a KASAN false positive

漏洞挖掘工具讨论。

@metzmanj @IncidentNoodle Yeah I guess the idea was maybe you could use it as an infoleak?

AI Agent 安全评估讨论。

@tszzl I would be curious if the published scorer in their repo (which uses an LLM judge for checking causality) would indeed disqualify agents that were “poisoned”