Cybersecurity from the future
Joined December 2019
- Tweets399
- Following1.3K
- Followers452
- Likes3.3K
John Connor retweeted
Malware is cool because either
1) If you're writing malware: you're programming with the intent to be as convoluted as possible to evade detection. It is a fun programming challenge.
2) If you're reverse engineering malware: you're taking apart something someone invested time into to be malicious or convoluted as possible
Bonus points are you learn a lot about the internals of stuff (Operating Systems, file formats, network architecture, etc) and, believe it or not, people are just distributing MALWARE for FREE. Malware is all over the internet and you can just TAKE IT and no one cares
John Connor retweeted
Why would I pay $15/month for your software when I can plan, build, review, improve, host, launch, scale, secure, patch, monitor and debug it myself?
John Connor retweeted
Reverse engineering has become a commodity. Agents can do it at warp speed, while the human role is gradually shifting toward deciding what to examine, validating the results, and deciding what to do with them.
John Connor retweeted
Everyone chases custom APT malware; what actually ransomed your network was a $10 stealer log, an unpatched VPN appliance, or an open RDP port.
Custom malware is custom for a reason - often tailored per target, and that target probably isn't you.
Most orgs would get more out of hunting commodity than chasing APT tooling.
John Connor retweeted
Worried AI will take your job in cybersecurity? After this week, I'm not.
I've spent 2+ days reversing a single malware sample, and I'm still going. AI reverser skill did a lot of the heavy lifting for me, but the judgment calls are still mine, and those can't be rushed.
So now I run on two brain cells: one that verifies everything the AI tells me, and one that keeps training it to do a better job next time.
AI is becoming the engine of malware analysis and threat research, and it gets better every time a human checks its work and corrects what it missed. The future isn't AI or analysts. It's AI WITH analysts. Trust.
John Connor retweeted
Out of the hundreds of popped organizations, the adversary was only able to get domain admin on 12 victims. Where domain admin was achieved, it was achieved in break neck speed. The takeaway there is hardening DOES matter.
John Connor retweeted
Hundreds of AI agents powered a campaign against PaperCut NG/MF. What did the operation reveal about agentic attacks and their limits?
🔗 Read GreyNoise’s latest blog: greynoise.io/blog/ai-orchest…
#GreyNoise #ThreatIntel #CyberSecurity
“But the pursuit of novelty can't be an excuse for ignorance of proven doctrine, either.”
The number of times I’ve seen people walk by tools that work because they wanted to solve it themselves…
Sentiment is very @ImposeCost
I ask everyone who starts my Investigation Theory class, "What's a valuable trait or skill for an analyst to have?"
Many say "thinking outside the box"
And sometimes, unconventional solutions are exactly what’s needed.
But the pursuit of novelty can't be an excuse for ignorance of proven doctrine, either.
Sometimes we need folks thinking outside the box, but more often, we just need to understand the box better.
#DFIR #SOC #CyberSecurity
John Connor retweeted
The recording of my second Binary Cartography webinar is public:
Agentic Malware Analysis: From Task Automation to Deep Analysis
Topics: string decryption, API hashing, unpacking & pipeline building
Recording: youtu.be/azej1P17w9E
Slides & samples: github.com/mrphrazer/binary-…
John Connor retweeted
For most of 2025, I was skeptical that AI was already playing a major operational role in real intrusions. Most public examples seemed limited to phishing and supporting tasks.
This report by my friend Eyal Eyal lines up with what I have been hearing elsewhere, too - in recent publications and in private conversations with people seeing this stuff up close.
I think that phase is over.
AI is moving into the operational core of attacks. With stronger models, open models, and jailbroken variants circulating, the economics have changed. Tailored tooling, exploit adaptation, and large-scale analysis get cheaper and faster.
I expect AI to play a major role in future campaigns, and that means more variation, more fresh tooling, and less reliance by attackers on recycled code.
All the more reason to focus on controls and detections that do not depend only on known samples.
Worth reading.
Technical report released: The AI-Assisted Breach of Mexico’s
Government Infrastructure
gambit.security/blog-post/a-…
John Connor retweeted
Evaluating models on cybersecurity tasks is *really* hard -- probably the *hardest* part of building these tools.
I want to correct a few misconceptions from this post.
> The results show something close to inverse scaling: small, cheap models outperform large frontier ones
Yes, because this only tested for true positives! This completely ignores the unbearably high false positive rate you get from small, open models.
Small models are incredibly sloppy thinkers that are easily biased to give "desired" outcomes. You can give them almost any nontrivial code snippet and they will "find vulnerabilities". If you ran this system across the entire codebase, it would be impossible to identify the real bugs from the slop.
Truly impressive models (and scaffolds) strike a balance of finding the subtle bugs without too much noise. For now, large closed-weight models with scaffolds for extensive validation dominate.
John Connor retweeted
I’ve been grinding hard on AI for the better part of the last 8+ months - learning, building, adapting, and pulling late nights just like so many others right now.
Cutting through the FUD and hype, there is real potential here. Industry-breaking potential. The era we’ve been waiting for - to finally supercharge and develop the tools and platforms we’ve wanted to build for years - is here, and agent assistance is accelerating everything.
With coding agents, I’ve built solid tools and had research breakthroughs that would have taken weeks or months before. These should feel like real wins worth celebrating. But honestly? I don’t feel victorious. In many ways, it just feels necessary to keep pace. As Dave said: adapt or be left behind - and for good reason.
I’m not ready to be left behind. But damn, I’m tired.
I’m tired of constantly reinventing myself. Tired of constantly re-tooling. Tired of the endless cycle of keeping up, the late nights, and the personal sacrifices that come with it. I’ve even lost the desire to share knowledge and research with the community the way I used to. From the conversations I’ve had, I’m far from alone - many others in this space feel the same but don’t necessarily vocalize it outside of smaller circles.
Is it because I see AI purely as a threat? Not really. The offensive side of our industry has been heading this way for a while, and I’ve been moving with it. The truth is, the excitement Dave describes is real - but for me right now, it’s mixed with exhaustion. I’m grateful for the breakthroughs, yet I catch myself wondering how long I can sustain this level of constant reinvention without something giving. The early-2000s energy is back, sure… but so is the burnout that often came with it.
Being a bit older now, with young kids at home, the pace hits differently. I don’t have the same endless energy I once did, and the late nights and constant context-switching carry a heavier weight. Finding balance is tough, but it feels more important than ever. Hopefully we can all figure out how to ride this wave more sustainably - without burning out in the process.
What I see in cybersecurity:
AI has re-invigorated an industry that was largely stale for the past ten years.
Complete new green field. Changes everything. New innovation happening everyday.
Need to adapt or be left behind.
This reminds me of the early 2000s, it’s exciting, addicting, and it’s going to be fun as hell.
John Connor retweeted
LiteLLM hack summary: What is it, why it's smart to target it, and how it happened (so far)
John Connor retweeted
The real reason AI is failing inside companies? Let’s say it.
A company decides to go all-in on AI.
The CEO announces the vision.
The CTO aligns.
The CIO gets the budget.
Then the real transformation begins.
Chief AI Officer.
AI Center of Excellence.
AI Ethics.
AI Governance.
AI Steering Committee.
AI Committee for the AI Committee.
Soon, you have 12 people managing AI.
And one person using it.
The intern.
The only one actually shipping anything.
Everyone else is busy… aligning on the prompt.
AI doesn’t fail because of the technology.
It fails because we turned it into a meeting.
So here’s a thought:
Are you building with AI… or scheduling it?
#ArtificialIntelligence #AITransformation #Leadership #FutureOfWork #Innovation
John Connor retweeted
Our latest GTIG AI Threat Tracker report reveals how adversaries are integrating AI into operations.
We detail state-sponsored LLM phishing, AI-enabled malware like HONESTCUE, and rising model extraction attacks.
Read the report: bit.ly/4adaUNk
ALT Illustration of model extraction attacks
John Connor retweeted
Popular Text Editor Notepad++ was compromised by a nation state attacker presumably from June through December 2, 2025.
The state actor used the access to reroute software update traffic to attacker controlled servers making this a supply chain attack.
notepad-plus-plus.org/news/h…
Knowing how and when to apply different approaches to leadership is critical. A common mistake I’ve both seen and made is looking for consensus when there should have been policy
