IRIS C2

Our business model is this: - Attract the very best vulnerability researchers and exploit developers in the world to join our company. This mostly revolves around junior engineers with raw talent/extremely high IQ. We don’t care if they have a college degree/industry experience or if they are total recluse-types who never want to attend some stupid “team building event” or whatever. This is largely an individual sport. And we want the Roger Federer(s) and Novak Djokavic(s) to work for us. We will hone their skills beyond what would be otherwise possible and polish them into absolutely deadly weapons. - Pay them so well (including serious equity), and task them with working on things so cool, that they would never even want to take an interview for a job at another firm (think Renaissance Technologies in the hedge fund world, but for computer network exploitation). We want to make these people very rich—which almost never happens to people with these skills in this industry. The only tradeoff is that they will have zero fame or public recognition, and they have to be okay with that (fame is overrated anyway) - Build the resulting primitives into the most sophisticated and powerful offensive cyber capabilities and platforms imaginable, in order to monitor, degrade and defeat the enemies of Western Civilization — If this sounds like what you’re after, reach out. Careers@IRISC2[.]com

LegacyHive : New 0day Windows LPE exploit from NightmareEclipse git.projectnightcrawler.dev/NightmareEclip…

This is an artifact of post-training they did with the aim of making it use fewer em dashes in its writing

Totally agree.

Cursor Grok 4.5 agents forgot that they could understand images and so instead spent 20 minutes screwing around with OCR tooling, before once again remembering that they could understand images 🫠

Unfortunately, the latest Gork model is yet another disappointment

Wait... You're saying Linux users don't surf the web in by curling webpage content through the CLI?

And they still charged you for the tokens This business model is fundamentally broken. When the model gets something right, and one-shot finds a clean UAF in the Linux Kernel, I pay for $5 worth of tokens. Believe it or not, this actually happens every now and again. When that same exact model, in the same exact harness, in a different context window, somehow inexplicably spins out of control, failing to find that exact same vulnerability, while managing to take up 80x as many tokens, it costs me $400. We pay OpenAI and Anthropic and SpaceX *MORE MONEY* when their models and harnesses FAIL to do what we asked of them The incentives are beyond perverse It’s hard to imagine myself rooting for the Chinese labs that produce open source models based on stolen American IP, but at this point, it’s becoming hard not to. I want GLM-6 running on a $1.3M air-gapped cluster in my basement SCIF, instead of using “fable”, an extremely censored model that is unambiguously FAR WORSE than the version of Opus 4.6 that Anthropic was serving up to us in January

It's a pretty strange phenomenon.

@drivertomtt You are literally a ChiComm.

Yet the peak of your blog was bragging about integrating a non-memory-corruption N-day into your tool. That was the best on display. And now the blog's gone, presumably once you realized it's a long way from “Dominate the Cyber Kill Chain.”

@drivertomtt We don't need to justify it to you, Tom. You are not the customer.

Jacob is obsessed with justifying why C2IRIS should be hacking the world’s worst people. He’ll write essays about it. The point is to make people forget the real question: can they actually “Dominate the Cyber Kill Chain,” like they brag on their own site?

lmao erdogan giving you a cool gun as a present and you can’t even take it home western leaders are hopeless cucks

@L33tH4xcyber The US government is far from perfect, but, on balance, has been a massive force for good around the world, while also affording our citizens civil liberties protections that are unmatched by any other country in the world.

@C2IRIS You should feel shame and you know it. You are either aiding the evil US government in oppressing and spying on the citizens who oppose them, or you're just lying frauds making fools of yourselves on the internet. Pathetic either way, no blue hair required.

I was chit-chatting with a prolific infosec blogger today who, I think, is plotting to write some kind of hit-piece about us I think he’s actually a well-meaning guy for the most part. I’ve read some of his stories about cybercrime over the years. Anyway… He said “most people in your business are far more discreet” By that, he meant that… they post generic LinkedIn-coded slop on their internet pages and pretend that they’re actually in some kind of opaque “research focused” liminal space, where the products that they develop and sell to pay their rent aren’t actually used for the purpose of hacking into the computers of terrorists and various other degenerate f*ckups around the world. But he’s right. Most of the other firms are more “discreet”. They do this mostly to avoid the ire of angry libtard bloggers and skepticism among the.. let’s just say.. “blue haired” members of this community. Most of them are very shy about the fact that they produce systems that are used to put warheads on the foreheads of sick animals who are intent on savagely killing civilians. Civilians like your mom or sister or daughter. Whether those civilians are in New York or London or Tel Aviv or Kyiv. By contrast, we aren’t shy about this. We are very open and honest about the fact that we exist for the purpose of creating turnkey tools that enable the incredible patriots in our intelligence community to understand, hamper, and even, in some cases, eliminate, the most dogged enemies of Western Civilization. And for this, we feel zero shame . Our approach comes with some tradeoffs. The downsides of which we address through selling our product in white-labeled form through many of our great partners, not to mention various other ways and means. But the upsides are also significant. Most importantly: We attract the very best mission-focused talent. Many of the best people in offensive cyber aren’t a part of the “blue hair” crowd. Many of them don’t feel an affinity with terrorists. A lot of them got into this stuff after they were sealed out of other areas of tech, because they didn’t fit in with the wannabe-snowden crowd. As a result of our approach, we have been able to attract people that are talented beyond what you can even imagine. We are very, very proud of what we build.

One of the best way to use LLMs to find exploits is to have them set up and operate highly convincing honeypots at a scale that would otherwise infeasible by hand

@natsecboogie @Warhorse74 @YukonK9 @WeaponOutfitter It has proprietary beam forming that no one else can match

@Warhorse74 @YukonK9 @WeaponOutfitter It’s a Silvus Radio, a battery powered SC4200EP. Well, minus the battery in the photo from David 🤣🤣🤣.

Hate to kick a fud hornets nest like I did a year ago, but even more so with coms! There's a reason why certain things are being used in real contested environments.

This is Eva, our Head of Security. She takes air gaps very seriously

We exist to build tools that can, hopefully, help in stopping things like this en.wikipedia.org/wiki/7_July_20…

@cpjet64 My question implies that the model conduct the checks for the certification. Do you trust it to do that?

@C2IRIS I mean yeah why not...? All software running on aerospace and rocketry needs to have certs like being fully traceable even through the compiler.

Would you fly on a plane where the safety-critical firmware was written and reviewed entirely by Mythos or whatever model? 100% of foundation lab executives and VCs would say NO That’s the only benchmark I care about