Abdulmohsen @cppbruh

OSCP, OSCE, OSEE debugger Joined July 2017

Tweets

5K
Followers

382
Following

4K
Likes

6K

Mandiant (part of Google Cloud) @Mandiant

a day ago

🚨 Mandiant & GTIG have identified active zero-day exploitation of Citrix NetScaler appliances (CVE-2026-88772). Attackers are deploying custom tools like WHIPSHOT. Since edge devices lack EDR, use this hunting checklist to detect compromise. 📋 goo.gle/4dfZzxb

4 34 129 9K 70

View Details

Arctic Wolf @AWNetworks

a day ago

Pack Alert: Arctic Wolf Labs observed active exploitation of Citrix NetScaler CVE-2026-88771 involving payload retrieval, script execution, reverse-shell attempts, and post-exploitation tooling. The objective appears to be long-term access. Learn more: bit.ly/4rJYBiK

1 6 16 1K 3

View Details

Maurice @Maurice_Sec

4 days ago

1/4 NetScaler exploitation IOCs (CVE-2026-88771 suspected) 🚨 Sharing detection info from a failed exploitation attempt seen on 22 Sep. Unauthenticated, two-stage, fully automated. Shared for detection only, so you can check your own logs. #NetScaler #Citrix #DFIR

6 32 126 13K 108

View Details

Simo @SimoKohonen

6 days ago

Google / Mandiant linked this activity to ShinyHunters! cloud.google.com/blog/topics/th…

Defused @DefusedCyber

a week ago

🚨 We are seeing elevated Oracle PeopleSoft (CVE-2026-35273 / PSEMHUB RCE) activity in our honeypots since Sep 22 UTC, including simple WAF bypass attempts against the standard path-block mitigation. Source IPs and the full indicators are available on Defused Radar.

7 14 92 20K 24

2 11 57 7K 21

View Details

Duncan Ogilvie 🍍 @mrexodia

5 days ago

Took around 1h to solve all of the challenges with this.... 🤯

Hex-Rays SA @HexRaysSA

6 days ago

The official IDA MCP Server is here. It's free, open source, and works with any LLM. Your agent writes IDAPython, uses ~20% fewer tokens, and can share an IDB with you in real time. 𝚞𝚟𝚡 𝚒𝚍𝚊-𝚑𝚌𝚕𝚒 𝚖𝚌𝚙 𝚒𝚗𝚜𝚝𝚊𝚕𝚕 hex-rays.com/blog/hex-rays-… (copy-paste: uvx ida-hcli

34 216 1K 142K 1K

16 31 519 59K 335

View Details

Aleandro Sy @AleandroSy

3 weeks ago

EtherHiding Decrypting ClickFix C2 with CyberChef and obf-io.deobfuscate.io

0 16 53 2K 34

View Details

thaddeus e. grugq @thegrugq

5 days ago

Can you imagine? Veterans of 8200 working in an Israeli cybersecurity company?! How deep does this go????

blackorbird @blackorbird

6 days ago

Italian firm Dataflow Security, founded in 2019 by young hacker Luca Todesco, develops high-value exploits: including zero-click tools that break into computers and smartphones and has grown rapidly into a multimillion-euro supplier for governments and spyware makers. An

5 54 303 82K 273

16 55 534 62K 261

View Details

Two Seven One Three @TwoSevenOneT

5 days ago

🥷 Now we can inject a payload into a remote process without using VirtualAllocEx and WriteProcessMemory. No need to suspend the target process New technique to evade EDRs: Github: TwoSevenOneT/InjectSetConsole #redteam #pentest #antimalware

9 185 977 47K 780

View Details

Düzgün @Root0ne

5 days ago

My blog post on the Iran-backed APT group MuddyWater is out. MuddyWater uses tools from TAG-150, a Malware-as-a-Service platform run by Russian-speaking cybercriminals. In this campaign, an MSI package is distributed through Amadey, installs the Deno-based DinDoor agent and runs it in memory. The agent collects browser passwords, cookies and crypto wallet data, and the final stage of the chain connects to a CastleRAT C2 server. medium.com/@Root0ne/muddy…

6 41 197 24K 138

View Details

!Manan @0xManan

6 days ago

PoC is public. Internet-facing MikroTik SSH → full admin. No password. No key. MikroTrick: CVE-2026-67279 + CVE-2026-86060. Fresh on CISA KEV. Chain: password auth as `-2` (rejected but left sticky) → pre-auth rekey drops the auth gate → `/nova/bin/login` treats `-2` as “read identity + policy from fd 2” → all-ones mask = full admin. IoC: `login failure for user -2 via ssh` then `user added by ssh:-2@…` PoC: github.com/digiprosec/Mic… Writeup: cert.pl/en/posts/2026/… Patch: 7.23.4 / 7.24.2 / 6.49.21 - then hunt `ops` + Flagged. #MikroTik #RouterOS #CVE #PoC #InfoSec #CyberSecurity

13 122 516 39K 426

View Details

H4x0r.DZ @h4x0r_dz

5 days ago

“ Two vulnerabilities - both RCE. Unpatched, 0days. Exploited in-the-wild - discovered during forensics. “

watchTowr @watchtowrcyber

5 days ago

We have been made aware of further info, which we are sharing. We had no idea Citrix sysadmins were like GTA6 fans - so friendly 🤗 Please, direct further questions to Citrix. We are not Citrix PSIRT (despite it occasionally looking that way). Citrix comms & patches are

7 46 189 88K 83

3 2 114 15K 16

View Details

misaki @tdatwja

6 days ago

An additional Chinese APT actor (UTA0565) was observed chaining 0-day exploits in Google Chrome and Microsoft Windows via fake websites SEPTEMBER 21, 2026 volexity.com/blog/2026/09/2…

0 17 34 2K 17

View Details

Justin Gardner @Rhynorater

6 days ago

Insane bug

Faav @efaav

6 days ago

How I Could've Accessed 17 Trillion Microsoft Records blog.faav.net/how-i-couldve-… :)

69 270 2K 247K 864

1 6 153 22K 70

View Details

Elias Bachaalany @eliasbchlny

6 days ago

How do I reverse engineer these days? I don't, I let coding agents do it. For instance, if I start from a fresh VM, I simply tell the agent to go clone, build and setup *GhidraSQL* and use it to analyze and grab any adjacent specialized tools you need. That's it. Wake up the next day and the target is reversed back to source code or whatever was your original quest (answer a question, write interop code/write a bluetooth driver, reverse engineer a protocol, find backdoors, etc.). I usually start with whatever model is permissive: Opus 5.5, it downgrades to Opus 5, then I switch to GPT family, then Grok, then final resort is the cheapest among them: DeepSeek Pro/Flash. What is the success rate? I am pretty happy. Can't complain at all in fact. I don't touch UI, I don't look at UI, I don't even care if it was GhidraSQL, IDASQL or BNSQL. I pick GhidraSQL these days because it is hassle free, and is free and if there are bugs, the agent fixes them and improves the tool on the fly.

Binary Wizards @BinaryWizards

6 days ago

ghidrasql 0.0.7 is out: control Ghidra's auto-analysis from SQL. UPDATE program_options to turn analyzers off, INSERT INTO analysis_passes to re-run analysis, DELETE to cancel it. Or skip slow analyzers at import with --analyzers-off. github.com/0xeb/ghidrasql…

1 4 50 33K 43

9 28 290 32K 324

View Details

Furkan @tweetozof

6 days ago

👀 NEW | ClearFake / ClickFix (Smart Contract C2) - Observed IOCs [Compromised Injected Hosts (Initial Access)] • ubgeneraltrading[.]com (IP: 162.241.216[.]86) • unitedpowerprojects[.]com (IP: 82.25.127[.]247) • unitedtransport[.]co[.]in (IP: 2a02:4780:11:1427:0:236d:9f44:10) • www[.]vault55[.]com (IP: 69.163.179[.]165) • vbbs[.]edu[.]vn (IP: 103.90.233[.]81) [Injected Script Obfuscation Layer] • In-line Double-XOR + Base64 JavaScript Loader • Technique: fromCharCode(arr[i] ^ k1) -> atob() -> charCodeAt() ^ k2 • Function: Executes decentralized JSON-RPC query to fetch live C2 [Decentralized Blockchain C2 Infrastructure (Polygon MATIC)] • Smart Contract: 0xB6bC9e1D0b2fB96Ab7C47E04Cb0BE477410bC1f2 • Method Hash: 0xb68d1809 • Public RPC: polygon-bor-rpc.publicnode[.]com | 1rpc[.]io/matic [Resolved Live C2 / TDS Infrastructure] • hxxps://idcool[.]codes [Observed TDS / Staging Delivery URLs] • hxxps://idcool[.]codes/api.php?s=a3946e3ded820e3d2f02885bf63c8a3a176d58bb9403b402 #ClickFix #ClearFake #ThreatIntel #Malware #CyberSecurity #IOC

1 5 13 2K 4

View Details

/r/netsec @_r_netsec

a week ago

Uncensored Qwen 3.8 27b helped write a LSASS Dumper which bypassed EDR while I made myself coffee projectblack.io/blog/bypassing…

7 87 618 53K 543

View Details

Megatron @TheM3gatr0n

7 days ago

I was analyzing the one hash in the context of ShinyHunters-related infrastructure, and one part of the @urlscanio dataset stood out. I couldn’t find any vendor reporting on these domains from when they were active around 6-10 months ago. They appear to have been completely missed at the time, and apparently I missed them too 😅 Three domains in the results appear to mimic legitimate organizations: sso-justeattakeaway[.]com internal-justeattakeaway[.]com fffenterprisesinternal[.]com The first two closely imitate Just Eat Takeaway, whose legitimate corporate domain is justeattakeaway.com. The third appears designed to resemble FFF Enterprises, whose legitimate domain is fffenterprises.com. FFF Enterprises is a major U.S. specialty pharmaceutical and biopharmaceutical distributor serving hospitals, pharmacies and other healthcare providers. #malware #shinyhunters #tracking #threatactors

1 3 30 3K 22

View Details

Chris Duggan @TLP_R3D

7 days ago

🕵️ I analysed 151 days of UNC6671 registry activity: 43 domains and 120 hostnames. The pattern? 97.7% weekday provisioning, Friday peaks, micro-batches, recycled labels and a sharp pivot away from “passkey” naming. US workday or European after-hours? 👀 #UNC6671

2 9 30 2K 21

View Details

Faruk Sener @SansLimit3

7 days ago

Another root domain: mfasettings[.]com , #UNC6671 Follows the same identity/MFA-themed naming pattern, no subdomain yet. Registered on Sep 21 via NICENIC, uses Cloudflare NS, and currently resolves to 102.220.163[.]94 (VPS Dedicated LLC).

Chris Duggan @TLP_R3D

7 days ago

🚨 UNC6671 INFRA UPDATE New root domain: ssosettings[.]com Observed hostnames reference GoDaddy, Teads, ICANN + Upgrade 👀 More pivots to follow. #UNC6671

1 10 38 4K 18

0 5 15 2K 10

View Details

H4x0r.DZ @h4x0r_dz

6 days ago

WTF

pwn.ai @pwn_ai

7 days ago

We have found one zeroday that preauth RCE'd Debian 13, Google, Meta, Roundcube, Plesk, Wikimedia, Box, Dropbox, Zoom, Forminator, Elementor, WordPress Core, among many more. Details soon!