- Security Researcher - Incident Responder - Lethal Forensicator - Reverse Engineering Enthusiast [Tweets are my own and not the views of my employer]

Bonn
Joined June 2017
I've decided to finally release my vulnerability hunting methodology that I've been using for several months now, both in testing as well as live engagements with great success. I was inspired by (and huge congrats to) the @Blackfrost_AI team open-sourcing Cyber-Frost Harness, their reproducible security-agent runtime with procedural skills, an evidence ledger, and isolated Docker targets for red/blue/purple work. 🎉 If you like the Cyber Frost Harness, and want some out of the box vulnerabilty hunting and POC development kit to go along with it - check out my VulnHunter. It's already loadable: their harness reads standard SKILL.md skills. Point skill_dir at VulnHunter's (or run its installer), and the hunting, falsification, and PoC disciplines load immediately. Repo: github.com/nealbridges/VulnH… CREDITS: This is fork of @CapitalOne original repo. I simply took it a step further on POC development and model agnostic. I'm also actively developing in my forked repo as I make more changes to it and welcome the contributions from the community as well. I think I'm doing the whole "respect who you give credit to" drama, and I asked my model to double and triple check it. So i can blame the model if its wrong. Otherwise, dont put me on blast on X if i suck at credits. /s Looking forward to developing on this further with the community.
31
220
9
1,562
104,293
Want to know what exploits were used by specific actors? #MalwareAnalysis #CTI
30
Introducing ARES 🛡️⚔️ Open-source autonomous red team & security validation platform built with FastAPI + React. Features: • Autonomous Attack Graph (DAG) • MITRE ATT&CK Mapping • Scope Firewall & Instant Reports GitHub: github.com/Mafifrizi/ARES #RedTeam #CyberSecurity
3
208
2
1,155
46,677
Jan retweeted
How to use LLMs for vulnerability research by @ZephrFish MCP: blog.zsec.uk/bullyingllms/ Harness: blog.zsec.uk/harnessing-harn… #cybersecurity #llm
8
154
906
47,800
Update on CVE-2026-12569 / Cl0p / PTC Windchill It is likely that Cl0p is actively exploiting CVE-2026-12569 in PTC Windchill. The deployed webshells use a custom HTTP header (X-windchill-req) as their authentication mechanism, running within Windchill's own process context to blend into legitimate application traffic, while spawning background SQL threads that enumerate the full Windchill file vault to map data ahead of exfiltration. A built-in custom Java class loader allows attackers to execute arbitrary compiled code server-side via Base64-encoded ZIPs, without ever modifying the webshell again. The webshell also harvests and decrypts LDAP credentials directly from Windchill's keystore, enabling follow-on access well beyond the initial foothold. Given Cl0p's history of rapid, widespread campaigns and the speed at which copycat actors replicate their techniques, organizations using PTC Windchill and PTC FlexPLM should treat this CVE with the highest priority.
1
2
11
1,295
Stix Viewer Visualize and explore STIX data for threat intelligence and analysis. stix-viewer.threatlandscape.… All tools available at osintrack.com #OSINT #CTI #DATAVISUALIZATION
8
33
1,914
Targets and statistics for the threat actor tracking: #MalwareAnalysis #CTI
52
Linking indicators from samples to campaigns and actors. #MalwareAnalysis #CTI
44
I am including some malware config extraction too: #MalwareAnalysis #CTI
48
Moving forward with my static analysis platform: #MalwareAnalysis #CTI
1
55
new blog post: shrun, apiwatcher, and argus: three malware analysis tools built with Claude antonioparata.blogspot.com/2… #MalwareAnalysis #ReverseEngineering
6
14
805
Foresiet identified and analyzed Lucid Stealer, a Node.js SEA wrapper delivering a credential stealer and remote-access Trojan with persistence, wallet theft, keylogging, HVNC, and DDoS capabilities. foresiet.com/blog/lucid-stea…
1
3
12
1,817
Follow every Mythos discovery through our coordinated vulnerability disclosure dashboard. red.anthropic.com/2026/cvd/
9
136
7
635
61,607
hmm what to do when machine thinks it knows better than me:
41
Just waiting for AI to include hidden advertisement in their responses, e.g. when asking for summary of incident response actions depending on LLM it will point out that it is best to use tool or service of a certain company 🤣
1
39