← Feed

Posts

• Post #3820824

  I used to spend hours finding wrong answers to Linux issues on Reddit before giving up and figuring it out myself. Now, an LLM gives me the wrong answers instantly, boils the ocean, and forces me to manually solve the problem sooner. I feel so productive!

• Post #1617603

  A lot of folks have reached out about Socket's recent report on a supply chain attack using malicious NuGet packages to target Siemens S7 protocol and other PLCs. This is not a supply chain attack in the traditional sense. No legitimate projects were compromised, and no S7, Sharp7, or Siemens codebases were modified. Socket identified packages published by a separate user ("shanhai666") containing code that probabilistically kills host processes and causes database wr...

• Post #1617602

  Had a great time presenting at LSU this week on hunting and analyzing Go and Python malware samples while hunting for ICS malware. For those who couldn't make it, you can catch a recording of this talk from Hou.Sec.Con last month with @secureloon https://www.youtube.com/watch?v=R8xFGz-AGEE #ICS #malware #otsecurity #malwareanalysis

• Post #1617601

  We have a job opening in our Community Defense Program (CDP) which gives small utilities free access to the Dragos Platform. This opening is a chance to do some truly meaningful work for the community. Job Description: https://job-boards.greenhouse.io/dragos/jobs/4976260008 CDP Description: https://www.dragos.com/community/community-defense-program #otsecurity #ics

• Post #1617600

  I spent a couple months arguing with Claude and Copilot while building FrostyGoop variants for DNP3 (and Modbus), keeping detailed notes on what worked and what didn't. At S4, I'll share my honest assessment: where these tools actually help, where they fail, and how much skill an attacker needs to make them useful. See you in Miami! #ICS #malware #otsecurity

• Post #1617599

  This is the first known attack on DERs. Attackers compromised RTUs at 30 different sites. The report has an overview, defensive guidance, and a comparison to past ELECTRUM ops. Hats off to CERT Polska for leading the charge, and kudos to our Intel team for the hard work. https://hubs.la/Q040Bwpg0 #ICS #otsecurity

• Post #1617598

  I know I'm feeling stressed out when I go back to reading Thich Nhat Hahn. His teachings calm me, and I need that reminder that happiness is available in any moment despite circumstance. I'm not even Buddhist. or maybe I am? He'd probably say the distinction isn't important.

• Post #1617597

  CERT.PL's report on the coordinated attacks against Polish infrastructure. Adversaries used all manner of destructive techniques: firmware corruption, wipers, SSH commands, FTP deletes, factory resets, even booted Tiny Core Linux on KVM to DD-wipe servers. They targeted a grid connection point, CHP plant, and a manufacturing site. The forensic reconstruction and malware analysis is excellent. Worth a read for the technical depth. https://cert.pl/en/posts/2026/01/incident-report-energy-...

• Post #1617596

  I've spent a lot of time reversing ICS malware. Recently, I've been building it with AI tools. While there's been plenty of commentary and news about AI and malware, I'm excited to share what I learned actually trying to build some at S4x26. Stage 2, Feb 24, 12pm.

• Post #1617595

  The Dragos 2026 Year In Review Report is live: 3 new threat groups, updates from 3 of our more active threat groups, and (my personal favorite) coverage of a subset ICS-related capabilities that we found last year. https://www.dragos.com/ot-cybersecurity-year-in-review

• Post #1617594

  I earned my first CVE credit (CVE-2025-7676) for helping with a Windows ARM vuln. So, to commemorate the credit, @reverseics presented me last week with a Trophy of Perpetual Futility, because there’s always more work to do. https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/refs/heads/main/2025-04.txt

• Post #1617593

  If you're trying to run Remnux on KVM by loading the OVA: To get network access: KVM changes the network adapter name, so you've got to change the config in /etc/netplan, replacing the old vmware adapter (like enss0) with whatever the new one is and then reboot. You can use networkctl to find the non-loopback adapter name (like en1ps0) The Remnux docs also say to run "remnux install" after loading into KVM to install spice and other tools. When I do that, it m...

• Post #1617592

  I had a great time on Jim's podcast discussing malware analysis, reverse engineering, working at Dragos, and a little bit of my personal history. https://www.youtube.com/watch?v=qCgnIMbgs3Y

• Post #1617591

  Folks are giving AI way too much credit. "AI wins CTF" "Claude hacks government" Sound as silly as saying: "Metasploit hacked a hospital!" or "Hammer builds a house!" Blaming AI shifts responsibility away from the humans who orchestrate it, and confuses defenders into thinking they're up against some vague AI supervillain. AI hasn't changed the fundamental problem. Capable attackers are still the threat,...

• Post #1617590

  TIL FLARE distributes educational content for free on GitHub. https://github.com/mandiant/flare-learning-hub

• Post #1617589

  This blog nails some real problems with bringing AI into an organization in any industry, not just cybersecurity. The article brings up a human training issue that I've been pondering a lot. What does it look like to train a new reverse engineer with AI tools available? https://www.sentinelone.com/blog/the-implementation-blind-spot-why-organizations-are-confusing-temporary-friction-with-permanent-safety/

• Post #1617588

  Ironically, S4 dropped my talk on vibe coding ICS malware on the same day that non-functional AI-slop OT "malware" is making headlines. It’s hype “malware” distracting us from real threats. More to say, but it's Friday :) In the meantime, I hope you enjoy the talk. https://www.youtube.com/watch?v=v0grXXc5zgw

• Post #1596607

  ZionSiphon is an AI-generated, non-functional attempt at ICS malware. Malicious intent doesn't imply ability, and broken malware like this is a distraction when we have proven threats like VOLTZITE/Volt Typhoon out there hitting water utilities.: https://www.dragos.com/blog/zionsiphon-ot-malware-analysis #ICS #malware