Lightnews — Scholar-powered news

Reposted by 🇺🇦 Xorhex 🇺🇦

Kyle Ehmke @kyleehmke.bsky.social · 2h

Suspicious domain ms-driversync[.]com was registered through Njalla on 10/14/25 and resolves to 192.166.82[.]94.

1 1

Reposted by 🇺🇦 Xorhex 🇺🇦

Kyle Ehmke @kyleehmke.bsky.social · 2h

Suspicious domain mfa[.]directory was registered through Njalla on 10/15/25 and resolves to 149.33.2[.]67.

2 3

🇺🇦 Xorhex 🇺🇦 @xorhex.bsky.social · 17h

I like the idea. It would remove the need to use a regex or needing to remember to list both possibilities (especially if there are multiple sets of ` or " in the string being matched).

🇺🇦 Xorhex 🇺🇦 @xorhex.bsky.social · 1d

One place to RULE them all 😁

Alexandre Dulaunoy @adulau.infosec.exchange.ap.brid.gy · 1d

One year, I had a chat with the fine people @suricata during the @cert_eu conference, and they were wondering why we didn't create an open source website for all the different rules (YARA, Suricata, and many others) — a place to allow comments, reviews […]

[Original post on infosec.exchange]

rulezet.org screenshot of a Suricata rule.

rulezet.org screenshot of a list of rules.

Reposted by 🇺🇦 Xorhex 🇺🇦

Tim Blazytko @mrphrazer.bsky.social · 4d

The new version of my #BinaryNinja plugin Obfuscation Analysis (v1.2) adds recursive function inlining in the decompiler.

It collapses call-heavy code into a single function; analysis, constant propagation, DCE and other analyses work across boundaries.

github.com/mrphrazer/ob...

1 3 5

🇺🇦 Xorhex 🇺🇦 @xorhex.bsky.social · 4d

Virus Exchange down or just me?

Reposted by 🇺🇦 Xorhex 🇺🇦

Brian Baskin @bbaskin.bsky.social · 5d

The Binary Ninja 5.2 dev release is showing some amazing work with their new Time Travel Debugging (TTD) interface. This makes a huge impact on analysis!

(and fits well on my UW monitor)

1 2 7

🇺🇦 Xorhex 🇺🇦 @xorhex.bsky.social · 6d

When walking a zip file's central directory structure using #yara-x, `math.max` and `with` are your friends.

1 1

🇺🇦 Xorhex 🇺🇦 @xorhex.bsky.social · 8d

Time to update: cargo install-update -i yara-x-cli

Wesley Shields @wxs.bsky.social · 8d

Two things:

YARA-X 1.8.0 is out with some nice features if you use the various bindings and a bug fix involving an edge case in PE signatures. Congrats to all involved!

To be more useful I wrote a small PR to display filenames in console.log() output when using yr scan.

github.com/VirusTotal/y...

Release v1.8.0 · VirusTotal/yara-x

Implement block scanning API for Rust and C (#459, 185c2ee). Implement Golang and C APIs for setting global variables of type array and structure (#449). Add iterator for Rules object in Python (#4...

github.com

🇺🇦 Xorhex 🇺🇦 @xorhex.bsky.social · 8d

Yet again, you're providing god tier support on this open source project. Thank you! 🙇

1 2

Reposted by 🇺🇦 Xorhex 🇺🇦

Hexacorn @hexacorn.bsky.social · 10d

Using .LNK files as lolbins

www.hexacorn.com/blog/2025/10...

1 3 7

🇺🇦 Xorhex 🇺🇦 @xorhex.bsky.social · 11d

Custom String Types 🫶

Reposted by 🇺🇦 Xorhex 🇺🇦

Binary Ninja @binary.ninja · 11d

Binary Ninja 5.2 feature stream starts now! Join us to get a sneak peak of what's coming in the new stable: www.youtube.com/@vector35/live

Binary Ninja: 5.2 Feature Stream!

Let's check out all the new major headlining features coming soon in 5.2! Try Binary Ninja: https://binary.ninja/demo/ Check out Sidekick at https://sidekick...

www.youtube.com

1 1 3

Reposted by 🇺🇦 Xorhex 🇺🇦

StrikeReady Labs @strikereadylabs.com · 12d

Quite a bit of CN APT activity in europe in the past week

strikeready.com/blog/cn-apt-...

As always, if you're interested in tuning your skills, download the samples here github.com/StrikeReady-...

CN APT targets Serbian Government

Mustang Panda continues targeting European governments

strikeready.com

7 9

Reposted by 🇺🇦 Xorhex 🇺🇦

The Banshee Queen 👑 @cyberoverdrive.bsky.social · 13d

A thread of great questions from @greg-l.bsky.social and fantastic answers (and nuance) by @invisig0th.bsky.social, about the legendary APT1 report and way more.

Greg Lesnewich @greg-l.bsky.social · 14d

HI @invisig0th.bsky.social been enjoying your recent media appearances with KZ and TBP!

Was wondering two things

1. You’re obviously the lead singer of the APT1 report “band” - Without burning names, can you talk about the make up of the team (skills, backgrounds, etc) +
& what made it special?

3 6

Reposted by 🇺🇦 Xorhex 🇺🇦

Greg Lesnewich @greg-l.bsky.social · 13d

Great piece from
@strikereadylabs.com
on a continuation of Operation Roundpress - both a great finding and walkthrough how to find, and analyze, these types of XSS phishes

strikeready.com/blog/0day-ic...

0day .ICS attack in the wild

Earlier in 2025, an apparent sender from 193.29.58.37 spoofed the Libyan Navy’s Office of Protocol to send a then-zero-day exploit in Zimbra’s Collaboration Suite, CVE-2025-27915, targeting Brazil’s m...

strikeready.com

1 2 6

Reposted by 🇺🇦 Xorhex 🇺🇦

PIVOTcon @pivotcon.bsky.social · 13d

📣 🔥 🛋️ SAVE THE DATE 🛋️ 🔥 📣
The next #PIVOTcon will be on 6-8 May 2026, in Malaga, ES!!!

You favorite ;) #ThreatResearch conference is coming back and we are planning to bring you the usual experience and content of utmost quality. Follow us + #StayTuned for more info
#CTI #ThreatIntel #PIVOTcon26

10 16

🇺🇦 Xorhex 🇺🇦 @xorhex.bsky.social · 13d

Thanks!! That means a lot. Hoping to drop an update with another feature one of these days. So many ideas and not enough time 😅

1

🇺🇦 Xorhex 🇺🇦 @xorhex.bsky.social · 13d

#MustangPanda

2

🇺🇦 Xorhex 🇺🇦 @xorhex.bsky.social · 14d

Doesn’t look like they are on bsky.

1

🇺🇦 Xorhex 🇺🇦 @xorhex.bsky.social · 14d

Know if it’s Yara or Yara-X? When I quickly went through the blog, I got the feeling it was Yara.

1 1

Reposted by 🇺🇦 Xorhex 🇺🇦

Tim Blazytko @mrphrazer.bsky.social · 15d

We at @emproofsecurity.bsky.social open-sourced a free firmware reverse engineering workshop for self-study.

Topics: ELF analysis, cracking, malware triage, embedded-Linux, bare-metal, crypto-key extraction, anti-analysis. Docker setup and solutions included.

github.com/emproof-com/...

GitHub - emproof-com/workshop_firmware_reverse_engineering: Workshop on firmware reverse engineering

Workshop on firmware reverse engineering. Contribute to emproof-com/workshop_firmware_reverse_engineering development by creating an account on GitHub.

github.com

2 5

🇺🇦 Xorhex 🇺🇦 @xorhex.bsky.social · 15d

Why is it so hard to get software over the last mile stone to make it usable for more than just me? I've a new #BinaryNinja ( #yarax ) plugin sitting in the wings needing to be polished for release and another release of #BinjaExtras with additional features close, but not close enough for release.

2

Reposted by 🇺🇦 Xorhex 🇺🇦

Julian-Ferdinand Vögele @julianferdinand.bsky.social · 16d

Excited to join a discussion on the second edition of The Mythical Beast by Jen Roberts (@atlanticcouncil.bsky.social), exploring the complex networks behind the spyware ecosystem. This kicks off the new Colloquium series by @virtualroutes.bsky.social: virtual-routes.org/event/mythic...

Mythical Beasts and Where to Find Them: Diving into the Depths of the Global Spyware Market - Virtual Routes Colloquium

The first session of the Virtual Routes Colloquium Fall/Winter series hosts Jen Roberts from Cyber Statecraft Initiative. Jen will present her research on "Mythical Beasts and Where to Find Them: Divi...

virtual-routes.org

10 11

Reposted by 🇺🇦 Xorhex 🇺🇦

ESET Research @esetresearch.bsky.social · 19d

#ESETresearch has observed #Gamaredon exploiting CVE-2025-8088 (#WinRAR path traversal) in an ongoing spearphishing campaign. This vulnerability allows arbitrary file write via crafted RAR archives. 1/6

1 9 16