левиафан🔻

How we do tabletop exercises: - made a web app that generates a random scenario (via Claude) - pick the initial response, add a few words, then roll a d20 - the effectiveness of this step’s response is determined based on your roll (by Claude) - eg a 1 means, our logs show nothing, and the attacker pivots further etc. - you then write into a text box how you’d respond again, roll again, etc In the future, could add items and spells based on your “class”, eg security analyst vs SRE vs IT admin etc Super fun

To bypass age restrictions, kids will look up “free vpn” to sign up in a diff country, opening them up to further risks. So make sure to ban VPNs too, and computers and math and thinking. Just kill the children.

@vxunderground Reading non-tl,dr > learning malware tricks

This is a tricky question and, in a bit of irony, there is a kind of like ... an unspoken ... or poorly documented philosophy of malware development. You kind of learn tricks of the trade as you write malware and witness malware campaigns operating in the wild. tl;dr idk it depends on wtf ur doing bro non-tl;dr To be direct, malware that works is not necessarily good malware. You can write a simple Windows batch script that deletes every file in an important directory and (technically) this would be "wiper" malware. This does not make it good, or sophisticated. Additionally, what defines "good" has changed over time. There tends to be trends with malware development. Malware tricks that used to work in the 90's are old news. Malware tricks from 2025 are old news (sort of). However, some malware tricks from the 90's are still applicable and can still be evasive. It's weird. You'll also see old tricks the 90's suddenly reappear and catch everyone off guard because... people simply forgot it even existed... The trick is usually only identified from industry veterans (or as the kids say, "unc" or "old heads") who are also surprised the trick has re-emerged. What's old is new. What's old is also old. What's new will eventually be old. Anyway, "good malware" also depends on the objective. State-sponsored malware (malware written by governments, or written for government or military usage) has extremely strict rules of engagement (usually, not always, but usually). State-sponsored is usually extremely narrow in scope and designed for a very small and limited audience. State-sponsored may not necessarily be super advanced and cutting edge, but because it is so narrow in scope it is difficult to identify. Conversely, financially motivated Threat Actors (malware developed for ... crime ...) is usually designed to be ass blasted in your face and sprayed across the internet. Financially motivated Threat Actors will typically (if it's "good malware") design malware to be modular. In other words, because it is being blasted all over the internet it will be detected quickly, hence their malware needs to be broken down into almost like ... plugins ... and they need to have it so their malware can quickly replace one segment of code with another (and quickly). If you've ever seen racing like NASCAR or F1, you'll notice vehicles can be torn apart in basically seconds and re-assembled, parts effortlessly replaced so it can quickly get back in the race. Likewise, modular malware needs to be able to change quickly to avoid it's inevitable detection. If you're curious, look up TrickBot, Emotet, or QakBot. They kind of defined what it means to be modular. They also kind of gave birth to what's known as "MaaS" (Malware-as-a-Service). State-sponsored Threat Actors malware is trickier because it needs to be designed for a target. For example, when the United States (allegedly) targeted the Chinese government (allegedly) as APT NightEagle (allegedly) the malware was developed to work almost exclusively for specific Chinese infrastructure and (allegedly) contained exploits which would work in ideal scenarios which (allegedly) were that of Chinese critical infrastructure. This can also be seen with what the Russian government alleges the United States and Israel (allegedly) did with Operation Triangulation whereas the malware (allegedly) only worked for specific sets of hardware (allegedly). Furthermore, this can also (allegedly) be seen with the United States (allegedly) purchasing cell phone malware from Israeli companies (allegedly) which were developed and sold to ICE (allegedly) to spy on people critical of ICE (allegedly). These companies are called NSO Group and Intellexa Alliance. Of course, the United States and Israel government vehemently deny the allegations from the Chinese and Russian government. Okay, I have to stop writing and schizo ranting for the time being. I have to go back to watching a baby and stuff.

@_JohnHammond @_ContinuumCon_ This con will never end?

happy @_ContinuumCon_ day to all who celebrate youtube.com/watch?v=uQ4An3…

@techspence This is why I follow you, thanks

If you're an IT Admin and you follow this list, and you put in the work to fix the findings, your environment will be more secure.

@NathanMcNulty Who doesn't like friends?

To be fair, when you see Suzie in finance running ripgrep, you might want to check that out Either Suzie was compromised, or you just found a new best friend

@ZackKorman @akses_0x00 You mean automated?

@akses_0x00 This needs to be repeated more.

People responding to my post from yesterday “dude IT knows everything you’re using AI for they can see everything” brother most don’t even know what skills and MCP servers you’re using.

@IceSolst Morning pages no

Do people read their own notes, at what cadence? Or is the process of writing in itself a method to internalize the info, so you wouldn’t need to read it?

One of the characteristics of a strong security program is that no one thing can bring you down. A user clicking a link cannot bring you down. An end-user device compromise cannot bring you down. A compromised edge device cannot bring you down. Layered defense/defense in depth is kind of a tacky saying but there's real meaning behind it.

The only useful cert is a TLS cert

@endingwithali Hi vulnerable, I'm Levi

new vulnerability just dropped its me im vulnerable

@thedawgyg It's like reading books of knowledge

One of the ways I have been learning a ton lately is just simply watching Claude and Codex work on a problem together and reading through their 'thought' processes, rationales, and results. its incredible how much you can learn just by doing this.

@vxunderground Came here for malware stayed for cat memes

Hi vx-underground is 7 years old, as of 2 days ago. I forgot my own website birthday. Some of you who found vx-underground as early to mid teenagers are now adults. Some of you who found vx-underground while attending university are now in the work force. Some people who follow this account have unfortunately passed away. Some followers have been arrested. Some followers have already been released from prison. Some of you (including myself) have had children. A lot has changed over the past 7 years. The only thing that hasn't really changed is the website: free malware source code, samples, and papers, forever. Thank you for letting me serve the community. It has been a pleasure. I look forward to serving all of you for another ... unknown duration of time, probably a long time, I don't know. I'm not sure how long I'll do this, but I'm already 7 years deep.

Gave a version of this workshop at HOPE, NorthSec, HackSpaceCon, and improve it each time. So you’ll get to see the best version of it yet!

@hetmehtaa 24 chrono specifically Chloe O'brian

what made you enter cybersecurity?

@hranikasz @AaronBastani

@AaronBastani Born to close Hormuz, forced to park the bus.

The Alans, a nomadic Iranian tribe, settled in parts of France, Spain and Portugal. There was even an Alan kingdom spanning both Iberian countries. This is why Jose Mourinho resembles an IRGC Brigadier.

@IntCyberDigest I like the icon

The internet is outraged at Spotify's designer for creating an app icon that's totally off. They're calling for Spotify to fire the designer. What do you think? 👀

@hetmehtaa All roads lead to cybersecurity

If you had a choice back then, would you still choose to get into cybersecurity?

@ZackKorman @skeptrune @0xTib3rius Zack is talking about skills again!

@skeptrune I’m convinced that fewer people would do this if they weren’t called skills. Who doesn’t want more skills?! Add a markdown file and now your AI is more skillful!

the dumbest software engineer you know is proudly adding their 43rd skill, 16th MCP, and thousandth line to their agent.md right now

@L0rd5ud0 @m19o__ #0" target="_blank" rel="nofollow noopener">codelabs.developers.google.com/onramp/instruc…

@m19o__ Any resources you would recommend?

If you still haven’t explored agents yet, start now. This knowledge matters right now. Learn how to architect agents, pick a framework, build a solid RAG setup, understand the limits, then work around them to get reliable results. Trust me, it’s worth it.