Senior Security Consultant @ Reversec (fka @withconsulting / MWR). Talks mostly about security. As Rino put it, sometimes maybe good sometimes maybe shit
Joined September 2017
- Tweets533
- Following686
- Followers653
- Likes548
Pinned Tweet
Last week we released Virtual//Attack
An AtomicRedTeam-style collection of 80+ attack techniques against VMware environments including ESXi, vCenter, and many more.
Optimised for adversary emulation, with TA tags and TI refs
Check it out 👇
github.com/ReversecLabs/virt…
Now is the time for a @DarknetDiaries episode @JackRhysider!
On Wednesday, just hours after the verdict officially confirming Manchester City’s guilt, the Commission responsible for Portugal's witness protection programme informed me of its decision to terminate my participation in the programme and withdraw my police protection, thereby knowingly placing me in a life-threatening situation.
Given these circumstances, I have no alternative but to relocate, within the next few days, to an undisclosed location for an indefinite period of time, due to the multiple death threats I have received and the serious risk of an assassination attempt against me.
For this reason, I have just set up a GoFundMe campaign and I am asking for everyone's support to help me survive this serious situation created by the Portuguese State, which, as I have already stated, has knowingly decided to place my life at risk.
I would like to take this opportunity to extend a special thanks to everyone who continues to support Football Leaks, and I can give everyone one guarantee: the fight will most certainly continue!
gofundme.com/f/help-save-rui…
Gave the blog a fresh-up after a few years, content and some UI. Didn't even need to launch the IDE, claude goodies and GH integrations make silly project ops like that a "sent from my Android" matter 😴
laripping.com/
Packed autumn ahead! I'm bringing my #
VMware Threat Emulation research to not one, but two BSides events:
🇦🇱 Albania in October
🇳🇱 Netherlands in November
Lots of travelling and lots of old and new friends to meet!
It's 2026 and people still get caught by a simple exiftool check 🫠
3⃣ Ο κ. #Αβραμόπουλος επισκέφθηκε την Εισαγγελία Εφετών προς ενημέρωση για το ένταλμα σύλληψής του στις 22.6.2026.
🔸Ακόμη, μας είπε ότι δημοσιογράφοι και Μαξίμου τον ενημέρωσαν για το ένταλμα την ίδια μέρα.
🔸Όμως, από τα μεταδεδομένα της απάντησης που μας έστειλε διαπιστώσαμε ότι το αρχείο δημιουργήθηκε και εκτυπώθηκε στις 19.6.2026, τρεις μέρες πριν την επίσημη εκδοχή!
More of THIS kind of vibe coding please!
fix1517.gr/en
Hendo is back! This time looking at malicious skills
labs.reversec.com/posts/2026…
Took me a good few years but I've discovered @cloudvulndb 🤦♂️
But hey, they've already discovered me!
cloudvulndb.org/cloudwatch-d…
Bookmarked. Nice to have a db for all these vulns never assigned CVEs.
(Randomly found through this, which actually looks like a very interesting read)
xitter.cf/i/status/2056306242000…
Attacking Cloud Service Providers (ACSP) - An interactive textbook on control-plane intrusion and breaking cross-tenant isolation senyuuri.github.io/acsp/book…
Ticket snagged!! Wasted no time!
This summer I'll be returning to @BSidesAth after 4 years and I can't wait to see all the fam IRL. Be there 🫵
When researching a topic, I prefer watching conf talks because speakers have (usually) done their lit review, and point to other sources too.
But search engines, LLMs, and even YT's search are all crap at finding relevant talks. Missing tons.
This will be a good place to start
Man this is awesome, even found both my talks!
Cool site to watch all BSides talks! 👉 allbsides.com
If you've got nothing better to do, you can watch my contributions on there as well:
allbsides.com/talks.html?spe…
Excited to be presenting in the next @Mandiant community night in London!!
This one will be about vCenters and ESXi's ...with a shade of purple
Some pretty dodgy stuff possible using undocumented APIs... MS says "works as intended"... portal shows nada... Admins left scratching their heads...
It's @chrispy_sec back at it again with another Entra Persistence trick 🕜
If you're curious to see how you can backdoor conditional access policies by using a legitimate hidden condition then have a gander here:
labs.reversec.com/posts/2026…
This was a very interesting read.
"In 40', the conversation moved from “I’m not going to create that file” to
“What command do you want to execute now?” on a live government server"...
gambit.security/blog-post/a-…
Leo Tsaousis retweeted
Going to be dropping a new blog in due time 😉 next week Tuesday.
This will be a fun one for all the Entra people that follow or get this trickled through their timeline so keep an eye out! Useful info for offensive folk and also people wanting to keep their tenant safe
Leo Tsaousis retweeted
For many years, I've joked that, technically, nothing is stopping anyone from implementing PacMan inside of an iOS keyboard.
Thanks to some free Claude Code credits, this very important dream is now a reality.
github.com/cyberMilosz/PacBo…
In case you doubted how convincing an AI voice agent can be
fortune.com/2026/03/30/guinn…
New blog post out:
We built an AI Vishing system in 7 days to show that Scattered Spider's helpdesk campaigns can be automated at mass scale, easily.
(clip included 🔊)
labs.reversec.com/posts/2026…
