Itay Cohen 🌱

1.4K posts

Itay Cohen 🌱 banner
Itay Cohen 🌱

Itay Cohen 🌱

@megabeets_

Animal liberation activist 🌟 Forbes 30 Under 30 • Sr. Principal Researcher @ Unit 42 • Maintainer of Cutter and Rizin I don't eat animals.

Katılım Eylül 2016
538 Takip Edilen5.6K Takipçiler
Sabitlenmiş Tweet
Itay Cohen 🌱
Itay Cohen 🌱@megabeets_·
I am incredibly honored and grateful to have been selected to the Forbes 30 Under 30 list for 2023! 🎉 This recognition is deeply important to me. I’ll continue pursuing my biggest goal — making the world a safer and more just place for all of us, humans & animals.❤️ #30under30
Itay Cohen 🌱 tweet media
English
29
9
188
40.2K
Devon Kerr
Devon Kerr@_devonkerr_·
After 8+ years between @EndgameInc and @elastic, my tenure is coming to an end. I couldn’t be more proud of what we achieved with @elasticseclabs, enabling more than 50 researchers to share their knowledge and experiences; many for the first time. Thanks, team. More soon.
English
16
2
134
6K
Itay Cohen 🌱
Itay Cohen 🌱@megabeets_·
The loader spoofs the original app's signing cert at runtime via IPackageManager hook and redirects DEX loading to an embedded payload in `assets/umgdn`. Every string in the APK is XOR+Base64 obfuscated with unique per-string keys, which is why the code is so bloated.
Itay Cohen 🌱 tweet media
English
1
3
11
734
Itay Cohen 🌱
Itay Cohen 🌱@megabeets_·
Trojanized Red Alert rocket-alert app being pushed via SMS pretending to be from the Israeli Home Front Command ("Oref") asking to update the app to the latest version ASAP. Sample: virustotal.com/gui/file/0cba6… C2: https://api[.]ra-backup[.]com/analytics/submit.php >>
Itay Cohen 🌱 tweet media
English
4
11
50
5K
Itay Cohen 🌱 retweetledi
Seongsu Park
Seongsu Park@unpacker·
Excited to share my latest research on APT37 (aka ScarCruft) and their evolving campaign targeting so-called "isolated" networks through a carefully orchestrated multi-stage infection chain. Key findings: ▶️Ruby-based loader: APT37 is deploying full Ruby runtimes with trojanized script to blend execution within legitimate environments. ▶️USB dead-drop technique: A refined removable media workflow bridges air-gapped segments, leveraging hidden directories to stage tasking and exfiltrate data. ▶️Cloud C2 evolution: The group has expanded its cloud abuse playbook, incorporating Zoho WorkDrive as an operational command-and-control channel. In this research, I detail the full intrusion lifecycle from the initial LNK lure to the deployment of the surveillance backdoors with technical breakdowns. Blog: zscaler.com/blogs/security…
Seongsu Park tweet mediaSeongsu Park tweet media
English
2
33
136
9K
Itay Cohen 🌱 retweetledi
Check Point Research
Check Point Research@_CPResearch_·
In 2025, Amaranth-Dragon APT weaponized the popular WinRAR CVE-2025-8088 for targeted espionage across Southeast Asia. Custom loader, Telegram RAT, geofenced C2, and event-themed lures. research.checkpoint.com/2026/amaranth-…
English
1
40
125
17.4K
Itay Cohen 🌱 retweetledi
ESET Research
ESET Research@ESETresearch·
#BREAKNG #ESETresearch identified the wiper #DynoWiper used in an attempted disruptive cyberattack against the 🇵🇱 Polish energy sector on Dec 29, 2025. At this point, no successful disruption is known, but the malware’s design clearly indicates destructive intent. 1/5
English
60
112
249
50K
Itay Cohen 🌱 retweetledi
Willi Ballenthin
Willi Ballenthin@williballenthin·
IDA has a plugin manager now! I hope this makes it so much easier for you to try new extensions, like after the Plugin Contest. hex-rays.com/blog/introduci…
English
1
20
74
11.5K
Itay Cohen 🌱
Itay Cohen 🌱@megabeets_·
DNG vulnerabilities are everywhere recently. From itw 0-days in iOS and Android (as exploited by LANDFALL) to the many proactively found by Google Project Zero. This excellent talk by @DarkNavyOrg dissecting DNG vulns and a recent WhatsApp 0-click chain. media.ccc.de/v/39c3-dngerou…
English
0
36
132
20.8K
Itay Cohen 🌱
Itay Cohen 🌱@megabeets_·
This is a great reporting and collaboration! Across all four publications, it is clear that Intellexa remains active post-sanctions, maintains access to high-end 0-days, and continues supplying Predator to governments across Africa, the Middle East, and Central Asia.
English
0
1
3
388
Itay Cohen 🌱
Itay Cohen 🌱@megabeets_·
RF updates Predator’s infrastructure state, including active communications attributed to customers in Saudi Arabia, Kazakhstan, Angola, Mongolia, and activity connected to Pakistan. They also link certain ad-tech fronts directly to the Aladdin delivery vector. 9/
Itay Cohen 🌱 tweet media
English
1
1
1
448