Josh Stroschein | The Cyber Yeti

🎙️ You may have heard of the Glupteba botnet, but did you know @Google didn't just disrupt it—they sued the operators? In a wild twist, the Russian operators didn't stay in the shadows. They hired a US attorney and showed up in a New York court to fight back. In the latest episode of Behind the Binary, @pmbureau discusses the wild tale of the technical and legal takedown! 🎧 Listen here: open.spotify.com/episode/0TgHyh…

The next episode of Behind the Binary is here! Jae Young Kim from FLARE/@Google joins me to discuss reversing modern languages. open.spotify.com/episode/4BLpV7… We'll also chat about languages to keep on eye on, a deep dive into Go, and the role of LLMs.

🤓 After 15 years of threat research, I am building something new! Today, @SecurityBreakAI officially becomes a company focused on AI Threat Intelligence and AI Security! The new website is live! Check it out :) securitybreak.io

New blog is out! Digging into an obfuscating compiler used in building EKZ Stealer, a CLI-based infostealer delivered after a Fortinet vulnerability was exploited. We deobfuscate it in #BinaryNinja Workflows by replacing IL expressions - solving opaque predicates, indirect jumps/calls, and control‑flow flattening, all without patching a single byte 😎 esentire.com/blog/fortinet-…

💀 Most reversing courses teach you how to tackle problems. This one teaches you how to create them, too. 🛠️ In 6 weeks at @BlackHatEvents US, we’re burning CPU cycles to build custom LLVM obfuscation passes and then dismantle them with a modern IR-driven workflow. See you in Vegas. 🌵 🔗 #syntactical-supremacy-defeating-and-designing-nation-state-obfuscation-50977" target="_blank" rel="nofollow noopener">blackhat.com/us-26/training…

New video: logon sessions explained. Every process has a token. Every token came from a logon session. But most developers never touch the session directly. Covers: what logon sessions hold, why tokens exist as a separate layer, LsaEnumerateLogonSessions in C++, and the relevant structures in WinDbg. trainsec.net/library/window…

#dnSpyEx 6.6.0 has been released. After 2 years, finally a new stable release :D github.com/dnSpyEx/dnSpy/…

New season of #OperationEndgame just dropped. This time, they targeted #SocGholish. 106 servers and domains taken down, 14.971 websites remediated. Of course, they released a movie like video for it again. Link to press release in the comments :) #OpEndgame #SocGholish

Forgot to add this to the release notes, but nibble wildcard patterns also work now! `67 6? ?7 67`

This is actually a very well-explained beginner series on #dotnet #reversing. We need more good beginner-friendly sources like these.

🎙️ Next Behind the Binary episode is now live! In this episode, I'm joined by @__sethJenkins from @Google's Project Zero to discuss a recent zero-click exploit chain in the Pixel 9—groundbreaking research he co-authored with @natashenka. We also dive into how AI features are rapidly changing the modern mobile attack surface. 🎧 open.spotify.com/episode/3XBbEx…

I recently had an interview with @jstrosch on the Behind the Binary podcast about @natashenka and I's Pixel 9 exploit chain with a bit of a bonus conversation about vulnerability research and security in the age of AI! You can find the whole episode here🎧 open.spotify.com/episode/3XBbEx…

🥵 #BlackHatUS is just around the corner - if you're looking to not only sharpen your RE skills, but understand how complex malware is constructed - here is your chance to join us for 4-days of hands-on, deep-dive learning! #the-flare-teams-advanced-guide-to-defeating-modern-malware-50978" target="_blank" rel="nofollow noopener">blackhat.com/us-26/training… @BlackHatEvents

I've been a part of this course since I joined FLARE a few years ago and it's exciting to see all of the new content. This content is largely driven by two factors - the problems the team encounters on a daily basis, and what hear from our community. This 4-day version at @BlackHatEvents US takes you through all of the core challenges facing modern re and techniques for unraveling obfuscation. 🔗 #the-flare-teams-advanced-guide-to-defeating-modern-malware-50978" target="_blank" rel="nofollow noopener">blackhat.com/us-26/training… DMs are open if you have any questions!

🤯 I've spent the last few months working on a major retooling of my workflow—specifically for tackling compiler-based obfuscations. This shift has opened my eyes to new ways of deconstructing logic, moving beyond traditional methods to leverage ASTs and IRs far more effectively (with a little help from LLMs). Curious to see what I've been working on? You can join me at @BlackHatEvents US this summer in Vegas... 🫣 #syntactical-supremacy-defeating-and-designing-nation-state-obfuscation-50977" target="_blank" rel="nofollow noopener">blackhat.com/us-26/training…

🧩 Video 2 in the .NET obfuscation series is now public! youtu.be/6rcUxmRGhlg In this video we'll explore the Global Module Constructor (.cctor) to analyze the impact of anti-debugging and anti-tamper protections.

🇨🇦 I'm finally going to be able to check @reconmtl off my conference list! And I'm not just attending, I'm helping deliver our 4 day advanced RE course. If you want to get hands on with time-travel debugging, ransomware cryptography, or deobfuscating .NET here is your chance to join us for 4 days of learning and experience sharing. 🔗 recon.cx/2026/en/traini… As always, DMs are open if you have any questions.