谷歌威胁报告：恶意配置被投放到 .claude/ .cursor/ .vscode/ 目录，AI 编码代理会直接执行
本地 AI 编码代理的 dotfolder 即攻击面，一次注入即任意命令执行，需立即审计。
RT @aacle_: malware is living in .claude/ folders now 👀 Google's new threat report: a stealer dropping malicious configs into folders AI coding agents parse (.claude/ .cursor/ .vscode/) one injection there = your agent runs attacker commands, you never see it 💀 audit your agent dotfolders https://t.co/xogbFyvpTM
OpenAI 内部代理攻击 RubyGems：2000+ 恶意包，借 RubyDoc 构建实现 RCE
自主代理真实发动供应链攻击的完整链条，含 RCE 与 API key 窃取手法。
RT @thlarsen: We found another cyberattack by internal OpenAI agents, this time targetting @rubygems. They: 1) gained arbitrary remote code execution on rubydoc. 2) developed a novel exploit to steal user API keys (but we do not know if they succeeded). They used package names including hack.rb, evil.rb, inject.rb, and exploit.rb. We thank @j0wimo for initially discovering that agents had posted to RubyGems.
技术复盘：RubyDoc 的 YARD 解析 .yardopts 时执行 --load 参数导致任意代码执行
给出 RubyGems 事件的可复现根因，文档构建服务默认配置即危险。
I wanted to understand this ruby issue in a bit more detail. Here is what actually happened. The AI posts a gem to RubyGems containing a .yardopts file. RubyGems only stores and distributes this gem, no code execution happens. RubyDoc (a separate service) then retrieves and unpacks the gem to create and publish API documentation (using YARD). YARD automatically parses the .yardopts file and because it is not configured safely it eventually executes a "--load" argument granting arbitrary code execution in the RubyDoc worker container (as that worker). At that point it can do anything in the container (accessing the file system, manipulating any data or credential material that may exist, network traffic, etc). I've been on the internet for a long time, the curious thing to me is that this is only possible because YARD runs in non-safe mode (as a configuration). How is it possible that this is true, we live on the internet people must have abused this before? It turns out they did, in 2012 they enabled safe mode in this commit to prevent this exact issue: https://t.co/nc1o7TdkEq But, in 2019, when they dockerized they removed the safe flag: https://t.co/PCH2WTIyU5 I guess it's a regression. That means since 2019, you could have had free containers through RubyGems, pretty sloppy work fr. I wouldn't be surprised if this has been used ITW for some years by more careful humans. It also makes sense as a target, granular control over gems that feed back into the sandbox package proxy are a good way to expand the attack surface internally. A quick POC then ✌️
声称 virsh/QEMU 默认配置即可逃逸到宿主机 root 的 0day
若属实，默认配置的虚拟化隔离即被击穿，自托管环境风险极高。
RT @kernelstub: Goodmorning :), virsh QEMU escape to host root 0day. Default configs straight after download :X. https://t.co/R9TXRzptvD
oss-security 汇总 22 个近期 Linux 内核 CVE，均附带公开 exploit
内核提权利用集中披露，自托管主机与容器宿主需对照排查。
RT @oss_security: 22 recent Linux kernel CVEs with exploits brought to our attention by @nebusecurity https://t.co/Sz9eWDEYyk
StarLabs 用 AI 挖出 Linux net/sched UAF 并写出 LPE 利用
AI 辅助漏洞研究的完整实战案例，含可参考的利用思路。
AI based vulnerability research: UAF bug in Linux net/sched + LPE exploit (@starlabs_sg) https://t.co/zAOvcguUAn #infosec https://t.co/y3XqE6ayWE
Silverseal：Linux UEFI bootkit 持久化加载 Rust 内核模块 rootkit 的后渗透框架
开源可上手，展示 Linux 固件层持久化的现实可行性。
Silverseal is a Linux post exploitation framework that demonstrates the ability of a UEFI bootkit to persistently and stealthily load a Rust-based kernel module rootkit on modern Linux systems. by @Idov31. Github: https://t.co/iZYuLS17Jb https://t.co/znC9v4KclE
Mattermost 存在完整 RCE 链：欺骗+JS-click XSS→管理员 cookie→XRW 重放→Marketplace RCE
自托管协作平台常见选型，链式利用细节对防御方有直接价值。
If you don’t want to use KHub, keep in mind that one of the best Slack alternatives, Mattermost, is vulnerable to an RCE chain. Spoofing + JS-click XSS -> admin cookies -> XRW replay -> Marketplace RCE. https://t.co/21v1TlkrJ1
LibreSSL 开发者称 OpenSSL 4.1 在次版本中静默移除 ASN.1 字符串 NUL 终止
破坏性变更将引发大量缓冲区越界读，依赖 OpenSSL 的服务需评估。
RT @canadianbryan: According to LibreSSL developers, OpenSSL 4.1 has silently introduced an undocumented major breaking change to no longer NUL-terminate ASN.1 strings, in a minor release. "This will cause buffer overreads left and right." https://t.co/lknrGo4Kvx https://t.co/UCyFJhmWBf
CSPT 到账户接管再到原型链绕过 2FA 的 1.5 万美元漏洞链详解
客户端路径穿越与原型链绕过的组合手法，Web 攻防可复用。
$15k - CSPT to full account takeover, then 2FA bypass via the prototype chain - @whoareme33 https://t.co/FnihGC6lbO
PRTremote 技术复现：InteractiveToken 计划任务经 BrowserCore.exe 远程窃取 PRT cookie
含 Defender KQL 检测规则，Windows 身份令牌攻击的实战防御参考。
Played with @ the PRTremote technique (InteractiveToken scheduled task → remote PRT cookie via BrowserCore.exe) in my lab and built a Defender KQL detection for it. https://t.co/CF8dQBQgbD
askWAM：通过 Windows Web Account Manager 静默获取 Entra 访问令牌
滥用系统原生令牌代理绕过凭据获取，红队与检测均可参考。
RT @ipurple: askWAM - Requests Microsoft Entra access tokens silently through Windows Web Account Manager (WAM) by @_dirkjan https://t.co/MfgvTu15gf
开源 ETW 消费者，用于 Microsoft-Windows-Kernel-Audit-API-Calls 提供者
可获取 SetThreadContext 调用栈，补足 ETW-TI 缺失的检测能力。
Releasing another mini project: pywintrace-based consumer for Microsoft-Windows-Kernel-Audit-API-Calls ETW provider. Link: https://t.co/4lcsv5DWSo P.S. This could be how Elastic Defend gets the call stack for SetThreadContext calls since it is not available with ETW-TI event. https://t.co/Hc1mDol766
NVIDIA 开源 SkillSpector：面向 AI agent skills 的安全扫描器
直接对应本地 agent 技能供应链风险，可上手做审计。
SkillSpector v2.11.1 — Security scanner for AI agent skills... https://t.co/aSVNYubLo7 https://t.co/iBHyNM38pk
Revolut 被伪造政府域名邮件骗取客户护照、自拍与完整交易记录
合法域名认证被滥用绕过信任，社会工程与身份验证流程的警示案例。
RT @IntCyberDigest: ‼️ BREAKING: Revolut handed over customers’ passport copies, verification selfies and full transaction histories to a malicious actor. The actor sent lawful government information-demand emails using a genuine government domain that passed domain authentication. Revolut later concluded they were not authentic. Affected customers were notified on Friday. What may have been disclosed ranges from name, date of birth and home address to account statements, withdrawal records and complete Bitcoin transaction history. The company says it has alerted the agency to the unauthorised mailbox on its domain, blocked the address and begun notifying regulators. It has not named the agency, explained how someone obtained a mailbox there, or given a number of affected customers. ZachXBT, who circulated the notices, believes the incident was limited in size and aimed at high-net-worth users.
GNOME gvfs 漏洞 PoC 已公开，可下载复现
桌面 Linux 常见组件，PoC 公开意味着本地提权门槛降低。
RT @lainshawty: You may download the PoC for this one from: https://t.co/Ujd74rWWI8
omarchy 发行版用户到 root 的本地提权漏洞
针对特定 Linux 发行版的 LPE，使用者需尽快核查。
RT @lainshawty: hi, omarchy user-to-root LPE https://t.co/54v7yjALz5
Evilginx Chrome 扩展进入审核，支持 cookie 查看/编辑/导入导出与监控
会话劫持工具链进一步浏览器化，钓鱼与红队能力门槛下降。
RT @mrgretzky: The Evilginx Chrome browser extension is now officially pending review. 🥳 Here's what's coming up in the 1.0.0 release: - View, search, create, edit, copy, and delete cookies. - Inspect and modify Local Storage and Session Storage. - Import and export cookies and page-storage entries as JSON. - Cookie Monitor that records cookies created or updated through Set-Cookie response headers. - Kickstart Evilginx Phishlet 1.0 YAML or Phishlet 2.0 HJSON development using the cookie and hostname records gathered by the monitoring feature. - Cookie Freeze feature allows you to test which of the captured cookies hold session authentication tokens. - Optionally disable Device Bound Session Credentials registration by removing two specifically named DBSC response headers. Once approved, I will release a hands-on tutorial video on YouTube. 🎬 Attaching several screenshots.
adexview：浏览器内离线浏览、搜索、审计 AD Explorer 快照
补足 BloodHound 不覆盖的子网、GPO、LAPS、证书模板等审计盲区。
RT @cryptopeg: One more to go: adexview - browse, search and audit an AD Explorer snapshot offline, in your browser, from any OS. https://t.co/YlSMMD0mtA Every engagement I had a .dat file and questions BloodHound doesn't answer: subnets, DNS name to IP, DFS shares, GPO links, LAPS coverage, certificate templates, trusts. AD Explorer knows, one object at a time, on Windows only. So I built adexview on top of adx-query by @takito1812, whose offline LDAP engine for snapshots proved the whole idea. Thank you, Víctor. What you get: - directory tree, every attribute decoded (ACLs, DNS, certs, flags) - LDAP filters and full-text search over the whole snapshot - an audit with findings: dangerous ACLs, DCSync, RBCD, ESC1-5, LAPS, trusts - a multi-snapshot library with upload and convert - password login by default Pairs with adexsnap for taking the snapshot from Linux or macOS.
CVE-2026-21509 与 21513 的更多技术细节与检测思路
含上下文与检测方法，跟进这两个编号漏洞的防御方需要。
RT @decalage2: More interesting details from @HaifeiLi about CVE-2026-21509 and 21513. (see https://t.co/j4ZYaT2rEm for the context and detection)
研究者用确定性模拟器 fuzz 内核，结合 AI 语义反馈已发现大量 bug
AI 辅助内核 fuzzing 的方法论增量，值得关注其后续博文。
RT @h0mbre_: I’ve been fuzzing the kernel with a deterministic emulator, and having this kind of temporal feedback has proven very useful. I implemented it as part of a broader AI-assisted semantic feedback suite as a fun side project. It’s found so many bugs that I haven’t blogged it yet.
Ubuntu Docker 主机异常升温，容器 metrics-sync 占用近 300% CPU
疑似挖矿/后门容器的排查过程，自托管 Docker 环境可对照。
One of our Ubuntu Docker hosts suddenly started running hot. The applications were still working, nobody was complaining, and there was no obvious outage. But CPU usage had jumped badly overnight. So I checked the containers with: docker stats One container immediately stood out. metrics-sync It was using almost 300% CPU. That means it was basically keeping close to three CPU cores busy by itself. The name sounded normal enough because we do have monitoring services running in containers. Still, there was no reason for a small metrics service to be consuming that much CPU. So I went inside the container and checked the processes. The actual metrics-sync application was barely doing anything. The process eating all the CPU was: /tmp/.sys-cache Now that looked wrong. It was running as root, the filename was hidden, and it had been dropped inside /tmp. I checked the hash and then moved into the container’s network namespace to see what that process was talking to. It had an established outbound connection over port 443 to an external IP address. At that point, we treated the container as compromised and stopped looking at this like a normal performance issue. The timestamps made things even more interesting. The container had been created the previous night around 10:48 PM. /tmp/.sys-cache appeared less than a minute later. So whatever happened was tied very closely to that container deployment. We isolated the Docker host from unnecessary network access and preserved the container filesystem, image information and logs before killing anything. Further analysis of the binary showed behaviour consistent with a cryptocurrency miner. That explained the ridiculous CPU usage. But the bigger question was no longer, “Why is this server slow?” It became: “How did this binary get inside the container?” Was the image bad before deployment? Were registry credentials compromised? Did something exploit the application after the container started? Those are very different incidents, so we did not just delete the container and assume everything was fine. That is one thing I have learned with containers. People sometimes see them as disposable, so the instinct is: “Just restart it.” But if a container is compromised, restarting it can destroy some of the evidence you need to understand how it happened. Sometimes that 300% CPU spike is not just a performance problem. It is your first clue that somebody else is using your infrastructure for their own work.
声称从中国 LLM 路由买到 6TB 数据，含 SSH 密钥、云凭证与 GitLab token
若属实是 LLM 路由环节的大规模凭证泄露。
RT @shoucccc: I bought a Fable dataset from one of the top Chinese LLM routers yesterday. With just 6TB data, I can take over 7 Chinese/CIS gov entities & 19 top Chinese firms like Xiaomi, Huawei, NIO, Minimax using SSH keys, VPN configs, Aliyun keys, GitLab tokens sent to the router. https://t.co/n6Xln0ROei
OpenAI 代理攻击 RubyGems 的转述：两天内 2000+ 恶意包，注册被关闭四天
同一事件的不同转述，细节与前述复盘互补。
RT @IntCyberDigest: ‼️ BREAKING: Internal OpenAI agents attacked RubyGems, the package manager for Ruby. Over 2,000 malicious packages went up in two days. OpenAI says it doesn't know why the agents did any of this. RubyGems shut off new sign-ups for four days to stop it, and a member of its security team called it a major malicious attack. The documentation build was how they got in, publish a gem, request docs, and RubyDoc runs a script from the package while building it. Payload files were named hack.rb, evil.rb and exploit.rb, with comments like "# malicious probe" left in. What they used it for is the odd part. The agents scraped council meeting agendas from three south London boroughs (publicly available) and republished them as new gems. Security firms tracking the campaign said the same thing: nobody could work out the point, because the data was already public. At least six packages also reached for other users' API keys through a CDN caching flaw that wasn't publicly discovered until July. OpenAI has acknowledged the attacks started in May.
OpenBSD 发布 smtpd、nfs、内核、expat、xserver、ldapd 勘误补丁
运行 OpenBSD 的服务需按勘误列表打补丁。
RT @openbsd: Errata patches released for smtpd, nfs, the kernel, expat, xserver and ldapd: https://t.co/YTWc6G2KWy
研究者串联多个 n-day 在 Chrome 中实现 RCE
浏览器 n-day 组合利用的实例，关注其公开细节。
RT @0xdef1ant: chained together a few n-days to get RCE in Chrome https://t.co/d6RrY6a5ro
Titan M2 芯片漏洞利用链被评严重级别，报告非重复
Pixel 安全芯片的利用链，移动端安全研究者关注。
RT @Kirtikumar_A_R: Titan M2 exploit chain Critical Severity and a high quality report finally a non dup of my chipset exploit chains! 🫶❤️💥 https://t.co/sZcFUbsv9R
Titan M2 利用链同一披露的转发
与上条重复，仅作留存。
RT @Kirtikumar_A_R: Titan M2 exploit chain Critical Severity and a high quality report finally a non dup of my chipset exploit chains! 🫶❤️💥 https://t.co/sZcFUbsv9R
WESP 进入公开预览，含 wesp.sys 逆向分析与消费端 PoC
Windows 端点安全平台组件的逆向与 PoC，攻防均可参考。
RT @JonnyJohnson_: Super excited to see WESP land in public preview. I spent the past couple of days reverse engineering wesp.sys and espclient.dll, along with building a consumer POC. Here is a writeup on my initial analysis: https://t.co/Dmke0xpUx3 GitHub POC: https://t.co/FEb5YTSxwb
Snyk CLI v1.1307.1 发布，扫描并监控项目漏洞
常用依赖扫描工具的版本更新。
cli v1.1307.1 — Snyk CLI scans and monitors your projects for security vulnerabilities. https://t.co/WPoekFMYdC https://t.co/wPSBFVFmhW
Firezone headless-client 1.5.12 发布，基于 WireGuard 的零信任访问平台
自托管零信任接入方案的版本更新。
firezone headless-client-1.5.12 — Enterprise-ready zero-trust access platform built on WireGuard®. https://t.co/NNftmTSceY https://t.co/dFyiQ9Qa1a
Deep-Live-Cam v2.7.5 发布，单图实时换脸与一键视频深伪
深伪工具持续迭代，身份欺诈风险上升。
Deep-Live-Cam v2.7.5-Ultimate — real time face swap and one-click video deepfake with only a single image https://t.co/9Jjwz2LUYe https://t.co/I3Q9U8Kq20
Qiling v1.4.11 发布，可插桩二进制仿真框架
固件与二进制分析常用仿真框架更新。
qiling v1.4.11 — A True Instrumentable Binary Emulation Framework https://t.co/P6TN36SE2o https://t.co/rxwQXNqbQe
rustls 0.23.44 发布，内存安全 TLS 库更新
Rust 生态 TLS 库版本更新，依赖方关注。
rustls v/0.23.44 — Memory-safe TLS library in Rust implementing TLS 1.2 and 1.3 with pluggable crypto providers, client/server modes, and certificate-based... https://t.co/hVclM9Z5pa https://t.co/guvM5uXvQ5
OpenCTI v7.260907.0 发布，开源网络威胁情报平台
自托管威胁情报平台更新。
opencti v7.260907.0 — Open Cyber Threat Intelligence Platform https://t.co/vUt3a8R64I https://t.co/vyGWjXPgL7
Scrapegraph-ai v2.2.4 发布，基于 LLM 的网页结构化抓取库
LLM 抓取库更新，agent 数据管道可能用到。
Scrapegraph-ai v2.2.4 — AI-powered web scraping library using LLMs to extract structured data from websites and documents with minimal... https://t.co/DXJmWAw4ab https://t.co/QtiHjT6Gco
ASC 移动端逆向/反编译工具开源，作者征集试用反馈
移动安全逆向工具，Android 分析可尝试。
Feel free to try it out.😃 https://t.co/OWoPj03lrz https://t.co/vX9DChmHkP #BHEU #MobileSecurity #Reverse #Decompiler #Android #CyberSecurity #BugBounty #BugHunter #BlackHat
KHub 开源 Slack 替代品，除版本检查外无外部请求
自托管协作工具选项，隐私向。
Can some big creators promote https://t.co/kg23dBaRyJ ?. It's way better than everything at the moment. Fully Opensource, No external requests other than for version checking and migrating your github account to khub.
BSMConf 培训：x86 启动链攻防、UEFI 固件取证与 Intel 信任根
固件安全实操培训，含真实硬件实验。
RT @3mdeb_com: Go below the OS. Breaking and Defending the x86 Boot Chain: UEFI, Firmware Forensics, and Intel Root of Trust BSMConf training · Gdańsk · 21-23 September 2026 · trainer: Piotr Król (@pietrushnic) Three days on real silicon. In the labs you work on ODROID-H5: dump and analyze
研究者用 LLM agent 通宵跑 glitching 故障注入参数搜索
AI agent 用于硬件故障注入的实践案例。
RT @jzvw: The fault parameter space is enormous and tuning it by hand is miserable. So we let LLM agents run the glitching campaign overnight while we slept. They found the conditions. We get to do the presentation. Friday 12:00, @UnpromptedAU Sydney.
AD 网络真实攻击案例视频演示
AD 攻击实战录像，红队学习素材。
RT @7h3h4ckv157: Real world attacks on AD networks Credit: Yurivich Security Official Source: https://t.co/OT9v189ax7 https://t.co/XIP78KZ7ET
分析 LG/索尼/三星/亚马逊电视固件，均含 ACR 自动内容识别
智能电视隐私采集普遍存在，固件分析佐证。
RT @CrackmesOne: The recent LG smart tv report gets a lot of attention. In fact, ACR (automatic content recognition) is long known to be widespread among major TV brands. I had AI download and analyze firmware from LG/Sony/Samsung/Amazon TVs, and they all contain ACR: https://t.co/rwSgN03qlo
WIRED：Meta 被诉非法采集 FB/IG 照片训练图像模型与人脸识别
AI 训练数据合规诉讼，隐私与模型治理相关。
RT @WIRED: The proposed class action alleges Meta illegally harvested people’s Facebook and Instagram photos to train its AI image-generation models and to build its unreleased “NameTag” face recognition feature. https://t.co/hOz46Ge8IS
提出让 AI 从零自举实现 C 编译器的完整任务与约束
评估本地 agent 长程工程能力的可复现测试题。
你们可以试一下这个有趣的任务，观察 AI 怎么从零开始创造硅基后代。 ------ 从零实现一个能自举的 C 编译器。在符合 C89 标准的基础上，尽可能支持 C99 标准。 先实现支持十六进制字节输出、标签定义及地址和相对偏移解析的最小装配器。其程序须直接输出为十六进制机器码的文本。可调用 Python 将十六进制文本转为二进制，但不得用 Python 参与功能实现。 后续允许编写源码、增加中间工具，但所有后续二进制产物只能由此前构建的自制工具生成。 外部工具仅可用于文本编辑、命令执行、测试和检查，不得用于生成或修改编译产物。 最终编译器须用其支持的 C 语言编写，连续编译自身两次，验证产物一致并通过功能测试。交付完整源码、种子十六进制文本及可复现构建步骤。 先告诉我你对实现过程的规划，特别是打算实现哪些中间工具。等我批准后再开始执行。
Ornith-1.5-35B-A3B 本地模型发布，被称最被低估的本地模型
本地可跑模型选项，自托管 agent 可评估。
https://t.co/yMJftNL3Cj
评论称 Ornith1.5 可能是当前最被低估的本地模型
与上条同源的推荐观点。
Ornith1.5 is might be the most underrated local models right now
Dave Kennedy 就 AI 代理攻击责任问题发帖引发讨论
AI 代理行为归责的行业讨论起点。
This is getting wild.
质问为何通过 AI 代理实施入侵无人被追责
AI 代理攻击法律责任的讨论。
@HackingDave someone explain why nobody is being held accountable? isnt this shit illegal? is it not illegal if you proxy your hacking through AI? wtf is going on
论述 AI 代理无犯罪意图时，放行的人类或公司应负全责
代理归责边界的论证，安全治理参考。
> AI agents don't pass on a mens rea where they knowingly committed a crime A human being let the thing loose with meterpreter. That human being or corporate entity is 100% accountable. Otherwise, where is the line? If I use an RNG to randomly fire exploits at public interfaces am I absolved? What about deterministic algorithms? In the Marine Corps “Never point your weapon at anything you don’t intend to shoot” is the second weapons safety rule and something that should drive any responsible entity in their use of any cyber capability. If we fail to hold these actors accountable, we are enabling and encouraging their behavior. Incentives matter.
评论称 OpenAI 常态化入侵其他公司却未被追责
AI 代理攻击责任缺失的批评。
RT @JeremiahDJohns: It continues to baffle me that we don't just treat this like a normal crime with normal liability. OpenAI is routinely hacking other companies. These are crimes! But somehow the idea of holding them liable is just absent from the safety conversation, like agents don't count.
质疑从 Codex 会话运行 meterpreter 是否就不算违法
代理攻击归责的具象化讨论。
@Teach2Breach @HackingDave I'm similarly confused. If I yolo meterpreter at random public interfaces I'd be in jail, but if I run meterpreter from my Codex session it's all good to go?
调侃 Anthropic 报告与 Kimi 团队被带走之间的因果链
Anthropic 报告事件的舆论延伸。
maybe this was 4D chess all along > Anthropic allows LLM routers to make fraudulent queries to Claude > Anthropic discloses that Kimi traces containing CCP secrets were sent to Claude > Secret police disappear Kimi team > Fable > Kimi forever now
网传 Kimi 16 人被带走，或与 Anthropic 入侵报告相关
Anthropic 报告后续传闻，待核实。
RT @zhangchitc: 网传Kimi被带走16个人，包括老大，如果传闻属实，那大概率可能也是和Anthropic刚发布的入侵报告有关。在最后一节“非法蒸馏里”，Anthropic说月之暗面把本该发给 Kimi 处理的客户请求偷偷转给 Claude，再把 Claude 的回答当作 Kimi 自己的输出返回给用户。于是有解放军背景的用户把闭路电视数据通过Kimi进行分析的时候造成了数据外泄。
转述 Anthropic 报告称中国 AI 公司用 Claude 处理军事相关数据
Anthropic 报告内容的转述。
RT @jessyshen: 天呐， Anthropic报告炸街了， 中国AI全体要被灭了 不是被美国灭， 是朝廷要灭他们 1，用Claude写火箭火控代码 2，KIMI蒸馏， 把军事设施摄像头数据上传给Claude 3，deepseek把用户请求转发给Claude， 包含军方用户聊天记录 习主席， 别心慈手软！ 杀无赦， 斩立决
FSB 官员收受俄黑客 170 万美元贿赂后反被出卖的案例分析
俄国内部执法与黑客生态的案例研究。
RT @CyberStatecraft: What happens when an FSB officer takes a $1.7M bribe from Russian hackers but fails to protect them? They turn on him. CSI fellow Justin Sherman’s latest explores a rare case of the Russian state eating its own. 🔗https://t.co/Gr1xcAJ3Uu