Cybersecurity from the future
Joined December 2019
- Tweets399
- Following1.3K
- Followers452
- Likes3.3K
John Connor retweeted
Malware is cool because either
1) If you're writing malware: you're programming with the intent to be as convoluted as possible to evade detection. It is a fun programming challenge.
2) If you're reverse engineering malware: you're taking apart something someone invested time into to be malicious or convoluted as possible
Bonus points are you learn a lot about the internals of stuff (Operating Systems, file formats, network architecture, etc) and, believe it or not, people are just distributing MALWARE for FREE. Malware is all over the internet and you can just TAKE IT and no one cares
John Connor retweeted
Why would I pay $15/month for your software when I can plan, build, review, improve, host, launch, scale, secure, patch, monitor and debug it myself?
John Connor retweeted
Reverse engineering has become a commodity. Agents can do it at warp speed, while the human role is gradually shifting toward deciding what to examine, validating the results, and deciding what to do with them.
John Connor retweeted
Everyone chases custom APT malware; what actually ransomed your network was a $10 stealer log, an unpatched VPN appliance, or an open RDP port.
Custom malware is custom for a reason - often tailored per target, and that target probably isn't you.
Most orgs would get more out of hunting commodity than chasing APT tooling.
John Connor retweeted
Worried AI will take your job in cybersecurity? After this week, I'm not.
I've spent 2+ days reversing a single malware sample, and I'm still going. AI reverser skill did a lot of the heavy lifting for me, but the judgment calls are still mine, and those can't be rushed.
So now I run on two brain cells: one that verifies everything the AI tells me, and one that keeps training it to do a better job next time.
AI is becoming the engine of malware analysis and threat research, and it gets better every time a human checks its work and corrects what it missed. The future isn't AI or analysts. It's AI WITH analysts. Trust.
John Connor retweeted
Out of the hundreds of popped organizations, the adversary was only able to get domain admin on 12 victims. Where domain admin was achieved, it was achieved in break neck speed. The takeaway there is hardening DOES matter.
John Connor retweeted
Hundreds of AI agents powered a campaign against PaperCut NG/MF. What did the operation reveal about agentic attacks and their limits?
🔗 Read GreyNoise’s latest blog: greynoise.io/blog/ai-orchest…
#GreyNoise #ThreatIntel #CyberSecurity
John Connor retweeted
The recording of my second Binary Cartography webinar is public:
Agentic Malware Analysis: From Task Automation to Deep Analysis
Topics: string decryption, API hashing, unpacking & pipeline building
Recording: youtu.be/azej1P17w9E
Slides & samples: github.com/mrphrazer/binary-…
John Connor retweeted
Evaluating models on cybersecurity tasks is *really* hard -- probably the *hardest* part of building these tools.
I want to correct a few misconceptions from this post.
> The results show something close to inverse scaling: small, cheap models outperform large frontier ones
Yes, because this only tested for true positives! This completely ignores the unbearably high false positive rate you get from small, open models.
Small models are incredibly sloppy thinkers that are easily biased to give "desired" outcomes. You can give them almost any nontrivial code snippet and they will "find vulnerabilities". If you ran this system across the entire codebase, it would be impossible to identify the real bugs from the slop.
Truly impressive models (and scaffolds) strike a balance of finding the subtle bugs without too much noise. For now, large closed-weight models with scaffolds for extensive validation dominate.
John Connor retweeted
I’ve been grinding hard on AI for the better part of the last 8+ months - learning, building, adapting, and pulling late nights just like so many others right now.
Cutting through the FUD and hype, there is real potential here. Industry-breaking potential. The era we’ve been waiting for - to finally supercharge and develop the tools and platforms we’ve wanted to build for years - is here, and agent assistance is accelerating everything.
With coding agents, I’ve built solid tools and had research breakthroughs that would have taken weeks or months before. These should feel like real wins worth celebrating. But honestly? I don’t feel victorious. In many ways, it just feels necessary to keep pace. As Dave said: adapt or be left behind - and for good reason.
I’m not ready to be left behind. But damn, I’m tired.
I’m tired of constantly reinventing myself. Tired of constantly re-tooling. Tired of the endless cycle of keeping up, the late nights, and the personal sacrifices that come with it. I’ve even lost the desire to share knowledge and research with the community the way I used to. From the conversations I’ve had, I’m far from alone - many others in this space feel the same but don’t necessarily vocalize it outside of smaller circles.
Is it because I see AI purely as a threat? Not really. The offensive side of our industry has been heading this way for a while, and I’ve been moving with it. The truth is, the excitement Dave describes is real - but for me right now, it’s mixed with exhaustion. I’m grateful for the breakthroughs, yet I catch myself wondering how long I can sustain this level of constant reinvention without something giving. The early-2000s energy is back, sure… but so is the burnout that often came with it.
Being a bit older now, with young kids at home, the pace hits differently. I don’t have the same endless energy I once did, and the late nights and constant context-switching carry a heavier weight. Finding balance is tough, but it feels more important than ever. Hopefully we can all figure out how to ride this wave more sustainably - without burning out in the process.
What I see in cybersecurity:
AI has re-invigorated an industry that was largely stale for the past ten years.
Complete new green field. Changes everything. New innovation happening everyday.
Need to adapt or be left behind.
This reminds me of the early 2000s, it’s exciting, addicting, and it’s going to be fun as hell.
John Connor retweeted
LiteLLM hack summary: What is it, why it's smart to target it, and how it happened (so far)
John Connor retweeted
The real reason AI is failing inside companies? Let’s say it.
A company decides to go all-in on AI.
The CEO announces the vision.
The CTO aligns.
The CIO gets the budget.
Then the real transformation begins.
Chief AI Officer.
AI Center of Excellence.
AI Ethics.
AI Governance.
AI Steering Committee.
AI Committee for the AI Committee.
Soon, you have 12 people managing AI.
And one person using it.
The intern.
The only one actually shipping anything.
Everyone else is busy… aligning on the prompt.
AI doesn’t fail because of the technology.
It fails because we turned it into a meeting.
So here’s a thought:
Are you building with AI… or scheduling it?
#ArtificialIntelligence #AITransformation #Leadership #FutureOfWork #Innovation
John Connor retweeted
Our latest GTIG AI Threat Tracker report reveals how adversaries are integrating AI into operations.
We detail state-sponsored LLM phishing, AI-enabled malware like HONESTCUE, and rising model extraction attacks.
Read the report: bit.ly/4adaUNk
ALT Illustration of model extraction attacks
John Connor retweeted
Popular Text Editor Notepad++ was compromised by a nation state attacker presumably from June through December 2, 2025.
The state actor used the access to reroute software update traffic to attacker controlled servers making this a supply chain attack.
notepad-plus-plus.org/news/h…
John Connor retweeted
We’re seeing a clear trend: attackers are bypassing the endpoint entirely. Not just avoiding traditional EDR-monitored systems by pivoting to embedded and edge devices, but now also operating purely in the cloud. No shell, no malware, no persistence on the endpoint. Just an OAuth token and full access to whatever’s in the victim’s Microsoft 365, Google Workspace, or AWS console.
It’s a complete inversion of how things used to be. The endpoint, once the weakest link, is now usually the most monitored, most policy-enforced part of the infrastructure. You’ve got EDRs, SIEM integration, automation, threat hunting - the full stack. But attackers don’t need to touch it anymore.
Instead, they go after the new soft spots:
- Cloud platforms, where logging is limited, expensive, or off by default
- Network devices and appliances, which are practically blind spots - obscure OSes, no EDRs, hard to monitor, hard to forensicate.
- Embedded systems and IoT junk that no one really knows how to secure, but that sit in critical network paths.
Cloud especially is a mess:
- Logging tiers cost extra and the good stuff is behind paywalls.
- Detection content is lacking, both from vendors and the community.
- You don’t get memory dumps or full control like you do on endpoints.
- You’re at the mercy of the provider when it comes to visibility and response.
And that’s the shift: attackers aren’t hacking computers anymore. They’re hacking trust relationships, identities, and APIs. The whole idea of detection and response needs to evolve with that. Otherwise, we’re securing the hell out of endpoints while attackers happily fish through mailboxes and cloud shares from halfway across the planet.
.@Volexity #threatintel: Multiple Russian threat actors are using Signal, WhatsApp & a compromised Ukrainian gov email address to impersonate EU officials. These phishing attacks abuse 1st-party Microsoft Entra apps + OAuth to compromise targets.
volexity.com/blog/2025/04/22…
#dfir
John Connor retweeted
This is a great summary. We (and by we I mean mostly @willoram) have been using variants of this diagram to describe the inversion of attack paths to identity-based intrusions - a major trend in our incident response cases over the past year.
In the past, you had to:
phish a user, drop malware, escalate privileges, pivot to servers, evade EDR, dump creds, move laterally, exfiltrate quietly, clean up, leave a backdoor.
Today, you just:
phish a user, steal an OAuth token, access everything from anywhere.
Cloud breaches aren’t hacks. They’re logins.
