Dominic White 👾

Earlier this week I gave a talk to our internal hacking teams about the difference between good hackers and great ones that have been able to impact our field. I included three extended quotes - two from writers and one from Hamming that influenced my approach early on. Maybe some of it is useful for you.

I really like this evaluation matrix from @RoelofTemmingh’s @BSidesJoburg keynote for judging quality in a flood of AI slop. The one that resonated with me in particular was: “Has this person ever paid a cost for being wrong”

A single OPSEC mistake exposed an entire China-nexus operation. During routine monitoring, we uncovered an exposed #Alibaba Cloud staging server that provided a rare glimpse into an active threat cluster we track as #JadeProx. The exposed infrastructure revealed attacker bash history, victim paths, proxy and tunneling tools, webshell deployments, and post-exploitation tooling, enabling us to reconstruct the operation from initial access to command and control. Key highlights from the investigation: 🔹 Discovery of #TriBack Loader, a previously undocumented #malware family observed across four infection chains. 🔹 Active targeting of government, healthcare, and education organizations across Vietnam, Malaysia, Hong Kong, Honduras, and Venezuela. 🔹 Abuse of signed Microsoft and G DATA binaries for DLL sideloading and stealthy payload execution. 🔹 Use of alternative callback-based execution techniques including InitOnceExecuteOnce, TimerQueue callbacks, and EtwpCreateEtwThread to evade detection. 🔹 Deployment of AdaptixC2 and the Beagle backdoor through a shared loader architecture. 🔹 Large-scale vulnerability scanning against more than 14,000 Hong Kong-related assets alongside phishing campaigns targeting LATAM entities. 🔹 Consistent use of NameSilo-registered domains and Cloudflare-fronted C2 infrastructure across all campaigns. 🔹 Infrastructure, tooling, and tradecraft overlapping with multiple PRC-linked threat actor ecosystems while remaining distinct enough to warrant separate tracking as JadeProx. This investigation offers a rare end-to-end view of a modern espionage operation, from exposed staging infrastructure and intrusion activity to phishing operations and malware deployment. Read the full technical analysis: link.group-ib.com/44Oh1Ee

We spent months building a machine for a conference that is only 3 days long. Then we all go home. The badges keep working. The LEDs keep blinking. The firmware remembers every mistake. We made something that no longer needs us.

If the sandbox escape was so advanced then publish the details.

Orange Cyberdefense has joined the CVE program as a CVE Numbering Authority (CNA)! 🔐This means that we can now directly assign CVE identifiers to vulnerabilities discovered by our teams or reported by external parties. Learn more 👉 ow.ly/20e550ZqIVK #SaferDigitalSociety

pipetap. helps you observe, intercept, and replay traffic over Windows Named Pipes, by @leonjza github.com/sensepost/pipe…

I put up a writeup of our @sensepost annual artwork up here sensepost.com/blog/2026/sens… Free downloads if you like it.

Bring your laptop. Leave with skills. SensePost Training will be at DEF CON 34 with hands-on offensive security training. 📍 Las Vegas 📅 10-11 Aug, 2026 🔗 ow.ly/9jBl50ZfPcx #DEFCON #CyberSecurityTraining

Excited to share our research on Process Parameter Poisoning with Max Hirschberger! We detail a novel process injection technique using parameters as an attack surface & released ⁠p3-loader⁠ (PoC). sensepost.com/blog/2026/proc… github.com/Orange-Cyberde… #Malware #WindowsIntetnals

@TheXC3LL @singe @sensepost We’ve updated our undetected EDR bypass process injection technique post to reference modexp’s original work at web.archive.org/web/2024121119…

Turns out it uses the same primitive modexp blogged in 2020, but in a different way web.archive.org/web/2024121119…

Blog post: sensepost.com/blog/2026/proc… Code: github.com/Orange-Cyberde…

We've documented a new EDR-bypassing process injection technique from @z3ro2504 & Max Hirschberger on the @sensepost blog. Link to post and code in the replies.

@TheXC3LL @z3ro2504 @sensepost Good catch, absolutely looks to be the same CreateProcessW primitive modexp covered in 2020, we'll update the blog. I still think it's a useful contribution though with some important differences.

@singe @z3ro2504 @sensepost Maybe I'm wrong... but I believe it's the same concept that web.archive.org/web/2024121119… (6 years ago) or this approach that avoids NtQueryInformationProcess to find the shellcode in env vars x-c3ll.github.io/posts/GetEnvir…

@Enno_Insinuator Ah! portal.cert.orangecyberdefense.com/vulns/144892 credit to Guillaume Meunier

@Enno_Insinuator 👀🍊

OpenSSH 10.4 released openssh.org/releasenotes.h…

We cannot consider #AI to be morally neutral. In reality, every technical tool embodies choices and priorities through what it measures, ignores, and optimizes, and how it classifies people and situations. Ethical discernment cannot be limited to asking whether we are using a system for good or bad purposes. It must also examine how that system is designed and what vision of the human person and society is embedded in the data and models that guide it. #MagnificaHumanitas

Skills over noise. Join 0xCD: Wireless Attack Techniques with SensePost Training at DEF CON 34 for hands-on Wi-Fi security training built for real-world application. 📅 10-11 August, 2026 🔗 ow.ly/YzBj50Z6TSc #DEFCON #WiFiSecurity #CyberSecurityTraining

Which course fits your next move? Choose your Black Hat USA 2026 training path with SensePost Training: wireless environments, tactical hacking or hands-on fundamentals. 📍 Las Vegas 📅 August 2026 🔗 ow.ly/oBXk50Z6TPH #BlackHatUSA #CyberSecurityTraining