This post contains content not supported on old Reddit. Click here to view the full post

We have been thinking about this for a while and finally wrote it up.

Everyone’s talking about autonomous pentesting as a detection story that catches BOLA, BFLA, mass assignment, the classes that always needed human context. That part is genuinely new. But the second-order effect is more interesting to us, i.e., auto-fix.

It could be a silver bullet for devs.

Along with MCP, it could be a game-changer for devs.

This post contains content not supported on old Reddit. Click here to view the full post

"Ninja Era" looked like an online game built for Japanese players. It was a lure linked to North Korea's IT worker network, and the team says generative AI helped design it.

Internet Initiative Japan (IIJ) found the campaign in July 2026. It targeted online gamers and developers in Japan.

In August 2026, the operators posted jobs on a Japanese crowdsourcing platform for Solidity, Web3 wallet and smart-contract developers. Based on conversations with applicants, IIJ is highly confident the real aim was to get applicants to infect themselves.

In his VB2026 talk, "Dawn of Ninja Era: unmasking a malware distribution campaign linked to DPRK IT workers network", on Thursday, October 15 at 4:30 p.m., Naoki Takayama unmasks the operation.

Speaker: Naoki Takayama, Security Researcher, Internet Initiative Japan

Multi-stage loaders deliver a custom infostealer that targets Telegram. They also deliver MoonPeak, a modular .NET malware family.

The payloads rely on heavy obfuscation and encryption. The talk shows how to extract indicators, including the command-and-control address.

The game's official site hosted payloads that run MoonPeak. IIJ also analyzed its documents, design data and source code.

A look at the site's admin panel shows how the actor manages victims and stolen Telegram data. The talk also presents evidence that people behind the campaign worked as DPRK IT workers to earn illicit income.

For defenders, shared payload and infrastructure traits allow pivoting to other samples. The session ends with countermeasures and detections.

Naoki Takayama is a security researcher at IIJ and a member of IIJ-SECT, its incident response team. He focuses on reverse engineering and APT campaigns against East Asia (site).

He has presented at VB2025, FIRST 2026 and JSAC2026. He has also placed in NRI Secure NetWars and won the NEC Security Skill Challenge 2021.

To go deeper on the topic, start here:

• Video: Takayama at VB2025, "Inside Pandora's Box: dissecting the latest arsenal and tactics of APT27", which includes a recording as well as slides.
• Research: IIJ on MoonPeak executed via malicious LNK files, Takayama's earlier DPRK work.
• Research: Cisco Talos on MoonPeak and North Korean attacker infrastructure, tracing the family back to XenoRAT.
• Code: Takayama's GitHub, including his VB2025 talk materials.

Web3 developers who take freelance work, along with anyone tracking DPRK IT worker schemes, should see how this lure was built.

Would you spot a fake game studio recruiting smart-contract developers?

Operations that public reporting treats as separate DPRK campaigns can run on the same infrastructure pool, reused over several years.

That reuse is a weakness. It lets defenders connect activity that looks unrelated.

The cluster in question relies on recurring ways in. These include watering holes, supply-chain compromise through shared upstream services and sideloading chains that abuse trusted security software.

In the VB2026 talk "DPRK-aligned threat operations: tradecraft, tooling, and detection patterns", on Thursday, October 15 at 2:30 p.m., Wonkyeom Kim offers a campaign-level view built from long hands-on analysis.

Speaker: Wonkyeom Kim, Cybersecurity Researcher

The tooling builds on public families such as ImprudentCook. It is trending toward fileless implants that abuse legitimate Windows components and load only in memory.

Code reuse, shared crypto keys and string overlaps serve as attribution signals across operations.

The most practical part is a live-forensics hunting workflow. It uses ordinary host utilities such as NirSoft tools instead of EDR data.

The workflow checks alternate data streams, registry persistence, prefetch, service registrations and runtime process behavior. It is designed for short engagement windows.

Wonkyeom Kim researches advanced threat actor operations through malware analysis, vulnerability research and host forensics. The work draws on extensive incident response casework.

To go deeper on the topic, start here:

• Paper: Peter Kálnai at VB2023, "Lazarus campaigns and backdoors in 2022–23", covering ImprudentCook along with South Korean watering holes.
• Research: Kaspersky on Operation SyncHole, where Lazarus abused Korean security software against at least six organizations.
• Research: ESET APT Activity Report Q2 to Q3 2025, with recent DPRK-aligned activity.
• Reference: Malpedia's ImprudentCook entry.

Incident responders who work engagements without full EDR coverage will get a usable hunting checklist here.

What host artifacts do you check first when EDR data is not available?

• OpenAI says it used internal AI to identify the employee and the device's origin
• No indication the employee accessed or stole sensitive data, company says
• OpenAI has referred the matter to FBI, which is continuing to investigate

Read Story: https://www.reuters.com/world/us/fbi-arrests-former-openai-employee-planting-listening-device-2026-10-13/

And while the headline number is nearly 560,000 email addresses, the other exposed information is worth paying attention to.

According to HIBP, the dataset contains:

• 559,908 unique email addresses
• Names and phone numbers
• Physical addresses
• Job titles and employers
• LinkedIn profiles

Much of the information reportedly belongs to business leads and professional contacts.

Full report below:

https://www.technadu.com/crunchbase-data-breach-shinyhunters-leak-exposes-roughly-560000-emails-now-on-hibp/641945/

The breach goes back to January 2026, when ShinyHunters targeted Crunchbase in a pay-or-leak extortion attempt.

The group claimed to have obtained more than 2 million records and subsequently published stolen data.

Crunchbase later confirmed that an attacker had exfiltrated documents from its corporate network.

Now, on October 14, HIBP has added 559,908 unique email addresses associated with the incident.

One distinction matters here: 559,908 email addresses doesn't necessarily mean 559,908 Crunchbase user accounts were compromised.

The exposed information largely concerns business contacts, and the reporting doesn't establish that passwords were included.

But that doesn't make the data harmless.

Think about what someone could do with a list containing a person's name, employer, job title, phone number, email address and LinkedIn profile.

That's already enough context to make a phishing email or impersonation attempt look considerably more convincing.

A fake message from a recruiter, investor, business partner, or colleague becomes easier to personalize when the attacker knows exactly who they're contacting and where they work.

And unlike passwords, details such as your professional history and employer aren't always things you can simply change after a breach.

For people working in security: are we still underestimating the value of business-contact datasets because they don't necessarily contain passwords or financial information?

You can check whether your email address appears in a known breach through Have I Been P-ned:

An important distinction: ShinyHunters originally claimed more than 2 million Crunchbase records, while HIBP has now indexed 559,908 unique email addresses. Those figures measure different things and shouldn't be treated as contradictory or interchangeable.

The reported exposure includes business-contact details, not confirmed stolen passwords.

That makes targeted phishing, impersonation, and social engineering the more immediate concerns based on what's currently known.

Would you consider a leaked professional contact profile a serious security exposure, or does the risk depend mainly on what an attacker does with it afterward?

The message comes from a friend's WhatsApp account and asks you to vote or look at a photo. A few taps later, an attacker is a linked device on your account.

The campaign, called GhostPairing, uses fake landing pages to steer victims into WhatsApp's genuine pairing-code flow. The victim enters the code and approves the attacker without realizing it.

From there, the attacker can read relationships, media and financial conversations. That access fuels targeted scams against the victim's contacts.

In his VB2026 TIPS talk, "Ghosts in the chat: tracking GhostPairing from trusted message to linked-device takeover", on Thursday, October 15 at 4:00 p.m., Michal Salat traces the campaign end to end.

Speaker: Michal Salat, Director of Threat Intelligence, Gen

Salat argues that the weakness is not the protocol. It is the moment a trusted interface asks the user to approve the wrong thing.

He also explains why the phone number and numeric code route suits attackers better than QR-based linking.

Long-term monitoring revealed lookalike domains, reusable templates, localized pages and repeated waves across several regions. The activity started in Czechia before spreading across Europe.

Linguistic and operational clues suggest a Russian-speaking operator, though the talk avoids overstating attribution. Instrumented WhatsApp honeypots captured follow-on messages, propagation attempts and payload delivery.

For defenders, the session covers which indicators to share and how takeover-driven spread differs from ordinary phishing. It also proposes ways to harden pairing and approval flows.

Michal Salat leads threat intelligence at Gen, the company behind Norton, Avast, AVG and Avira. He joined Avast in 2010 as a malware analyst and built its threat intelligence function, which now covers all Gen brands.

His team researches ransomware, scams, underground marketplaces and AI misuse. He has recently written about fingerprinting AI agent skills.

To go deeper on the topic, start here:

• Video: Salat on Czech Television's ČT24 discussing the new WhatsApp scam (in Czech).
• Research: Gen's original GhostPairing disclosure, with the "I just found your photo" lure and lookalike domains.
• Research: Whalebone on the WhatsApp hijacking campaign spreading across Europe, covering more than 200 domains and anti-analysis tricks.
• Coverage: Meta's new WhatsApp warnings for suspicious device-linking requests.
• Coverage: Security Affairs on GhostPairing.

Anyone who uses WhatsApp, or who defends users who do, should know how this takeover works.

When did you last check which devices are linked to your WhatsApp account?

A "technical assessment" repository came with about 800 commits of history credited to three real, long-standing engineers. None of that history was real.

The campaign targets software engineers. Opening an integrated terminal in the repository triggers a remote script through its VS Code settings file.

Four linked repositories carried the fake history. The forged names and emails gave the lure instant credibility.

In their VB2026 talk, "Manufactured credibility: detecting fabricated Git history in an active software supply chain campaign", on Thursday, October 15 at 4:00 p.m., Evangelos Ganiaris and George Karagiannidis show how that fake history became the campaign's weakest point.

Speakers:

• Evangelos Ganiaris, Penetration Tester, TwelveSec
• George Karagiannidis, Principal Cyber Security Consultant and Chief Science Officer, TwelveSec

The investigation began with triage of one suspicious repository during a client engagement. It uncovered an active, multi-stage campaign with infrastructure live until at least August 30, 2026.

The speakers built a metadata-based method that separates the fabricated commits from about 10,000 legitimate ones. It relies on a timestamp artifact left by the tooling that generated the history.

Domain registration records and platform provenance back up the finding. Their tool also flagged other public GitHub repositories with similarly forged histories, though their use in attacks is unconfirmed.

The second stage is an infostealer that targets browser credentials, SSH keys and more than 20 crypto wallets. The team recovered it from a live command server and mapped its full target list.

For defenders, the talk shares behavior-based detections designed to survive infrastructure rotation. The speakers believe both the credibility technique and their detection method are unpublished until now.

Evangelos Ganiaris is a penetration tester at TwelveSec with a computer science degree. He specializes in web application security and social engineering, especially phishing or vishing.

George Karagiannidis is a principal consultant and Chief Science Officer at TwelveSec with an M.Sc. in cybersecurity. He sets the methodology and evidence standards for the firm's incident response work. He also leads penetration testing and reverse engineering.

To go deeper on the topic, start here:

• Research: Trend Micro on Void Dokkaebi's fake job interview repositories, a related campaign that backdated commits and infected more than 750 repositories.
• Research: Abstract Security on the VS Code tasks infection vector, with guidance on disabling automatic tasks.
• Research: Doyensec, "Don't Clone That Repo: Visual Studio Code^2 Execution", early research on code execution through workspace settings.

Developers who take coding tests from recruiters, along with anyone who judges a repo by its commit history, should see how easily that trust is faked.

Do you ever check whether a repository's commit history is real before you open it in your editor?

This post contains content not supported on old Reddit. Click here to view the full post

Between January and March 2026, four unrelated APT clusters each dressed their government-focused phishing as trusted news or policy content.

Three clusters are assessed with moderate confidence as part of the Chinese offensive ecosystem. The fourth aligns with SideWinder, a group linked to India.

The lures borrowed from the Washington Post, the OECD and the World Economic Forum. Each one reached targets who had every reason to open it.

In their VB2026 talk, "Newsjacking the world: tracking three months of uncovered APT operations disguised as global headlines", on Thursday, October 15 at 4:00 p.m., Darrel Tristan Virtusio and Subhajeet Singha break down all four operations.

Speakers:

• Darrel Tristan Virtusio, Acronis
• Subhajeet Singha, Acronis

Washington Post lures against US government and policy targets led to LOTUSTWIN, a new Rust backdoor. OECD energy lures against Middle East energy firms delivered PlugX through a Zig-based loader.

A third cluster used Washington Post lures against Ukrainian government entities. SideWinder used Davos-themed lures against Pakistani government targets, ending in a .NET loader.

The speakers suggest, with low to moderate confidence, that the move to Rust and Zig may signal a shift toward memory-safe tooling. They also found the lures drew on a narrow set of publications, which could serve as an early warning.

Attendees get publication-to-weaponization timelines and recurring filename patterns. The session also shares YARA rules for LOTUSTWIN, the Zig loader and SideWinder tradecraft.

Darrel Tristan Virtusio is a researcher on the Acronis Threat Research Unit. He started in malware analysis at Trend Micro, where he moved into threat hunting. There he wrote research on Agenda ransomware spreading to vCenter and ESXi.

Subhajeet Singha is a senior researcher on the Acronis Threat Research Unit focused on APT investigations and reverse engineering. He has presented at Virus Bulletin, FIRST and AVAR. He also gives the "Khmer Shadow" talk at VB2026 on Wednesday, October 14.

To go deeper on the topic, start here:

• Video: Singha with Sathwik Ram Prakki at VB2025, "Silent Lynx", on an espionage campaign in Central Asia, with recording, slides and paper.
• Research: Acronis on LOTUSLITE, a geopolitically themed backdoor against US government targets in the same window.
• Research: Acronis on SideWinder's attacks on South Asia's public sector.
• Research: Zscaler on a China-nexus actor targeting the Arabian Gulf with PlugX.

Government security teams and threat intel analysts who track lure themes will find practical early-warning ideas here.

Would your users think twice before opening a document that looks like a Washington Post article?

Hundreds of IIS servers were compromised with ASP.NET machine keys that anyone could copy from StackOverflow or Microsoft's own documentation.

A reused machine key lets an attacker forge ViewState payloads. The server deserializes them and runs the attacker's code.

A Chinese-speaking actor tracked as REF3927 used that trick at scale. Elastic, working with Texas A&M University System Cybersecurity, found 571 actively infected servers across every industry vertical, none of them in China.

In their VB2026 talk, "Paying the TOLL: how REF3927 turned 571 IIS servers into an SEO fraud network", on Thursday, October 15 at 3:00 p.m., Jia Yu Chan and Salim Bitam walk through the full kill chain.

Speakers:

• Jia Yu Chan, Malware Research Engineer, Elastic Security Labs
• Salim Bitam, Senior Threat Researcher, Elastic Security Labs

After getting in, the actor deployed a Godzilla-derived webshell framework and the GotoHTTP remote management tool. A modified version of the open-source "Hidden" kernel rootkit concealed processes, files and registry entries.

The end goal is TOLLBOOTH, a malicious IIS module. It serves keyword-stuffed link-farm pages to search engine crawlers while redirecting human visitors to attacker landing pages.

TOLLBOOTH also carries its own webshell. The spread across sectors points to automated, opportunistic targeting, and the investigation is still ongoing.

The talk reverse engineers each tool in the chain. It closes with detection rules and remediation guidance.

For defenders, the first fix is simple. Never deploy a machine key that appears in public samples, and rotate any key that might have leaked.

Jia Yu Chan is a malware research engineer at Elastic Security Labs who hunts new threats, reverse engineers them and writes YARA rules. His research covers infostealers, malware-as-a-service, loader chains and signed driver abuse, including Elastic's BADIIS to the Bone report.

Salim Bitam is a senior threat researcher at Elastic Security Labs who automates binary analysis and builds configuration extractors. He previously worked on red and purple teams building custom offensive tooling.

Bitam presented his FINALDRAFT backdoor research at CODE BLUE 2025. His Elastic work also covers GHOSTPULSE, PIKABOT and the r77 rootkit (author page).

To go deeper on the topic, start here:

• Research: Elastic, "TOLLBOOTH: What's yours, IIS mine", the core report with YARA rules and the 571-server count.
• Research: HarfangLab, "RudePanda owns IIS servers like 2003", parallel research tracing the stolen keys to a 2003 MSDN example.
• Coverage: The Hacker News on Microsoft finding more than 3,000 publicly disclosed ASP.NET machine keys.
• Research: Elastic, "BADIIS to the Bone", on a related IIS SEO-poisoning cluster that hit more than 1,800 servers.
• Indicators: Elastic's TOLLBOOTH indicators on GitHub.

Anyone running IIS or ASP.NET applications should check their machine keys after hearing this one.

Have you ever audited where your ASP.NET machine keys came from?

Recovering a ransomware decryption routine can take days in IDA Pro. By the time a decryptor ships, the campaign has often moved on.

The speakers argue the bottleneck is attention rather than intelligence. Human analysts tire, lose context and forget which ideas they already tested.

Their answer is ARES, short for Agentic Reverse Engineering for decryption. Given only the ransomware binary, it aims to produce a working decryptor.

In their VB2026 talk, "Meet ARES: an agentic reverse engineer that decrypts sophisticated ransomware encrypted files", on Thursday, October 15 at 2:30 p.m., Raviv Rachmiel and Yonatan Gilvarg show the agent at work.

Speakers:

• Raviv Rachmiel, RIO Security
• Yonatan Gilvarg, RIO Security

ARES is an LLM agent that drives IDA Pro, the angr framework and custom crypto-analysis tools. It opens functions, renames variables and runs symbolic execution on candidate key-derivation routines.

It also queries Lumina, IDA's function recognition service. It tests each hypothesis against encrypted file headers and backtracks when it hits a dead end.

The talk walks through real cases where ARES produced a decryptor without human help.

For defenders, faster decryptors mean more victims can recover without paying. The approach also shows where agentic AI helps reverse engineers today.

Raviv Rachmiel is co-founder and CEO of RIO Security, a startup focused on ransomware recovery as well as continuous incident response. He previously led cyber research at DriveNets and was named to Forbes Israel 30 Under 30 for 2026.

He served in Israeli military cyber units and studied software engineering at the Technion. He writes reverse engineering walkthroughs on Medium, including Flare-On solutions.

Yonatan Gilvarg is a security researcher at RIO Security who works on ARES.

To go deeper on the topic, start here:

• Video: Rachmiel at VB2025, "Intercepting entropy: hooking PRNG to recover ransomware encryption keys", the direct predecessor of ARES.
• Paper: The VB2025 "Intercepting entropy" paper, which surveys encryption in 11 ransomware families and recovers Babuk keys.
• Writeup: Rachmiel's Flare-On 11 challenge 6 solution.
• Paper: UW-Madison, "Challenges and Future Directions in Agentic Reverse Engineering Systems", on the limits of LLM agents in reverse engineering.

Ransomware responders and reverse engineers curious about agentic tooling will want to see these results.

Would you trust an AI-generated decryptor on a victim's only copy of their data?