Roland Emmanuel Salunga @RESalunga

Proton is now publicly calling Windows spyware over the Global Device ID that Microsoft uses for every Windows installation. They say users never consent to the GDID, can't remove it, and that reinstalling Windows only partially helps since Microsoft keeps the old records. The company found exactly one mention of the identifier in all of Microsoft's public documentation. Every Windows installation carries a Global Device ID that Microsoft can hand to law enforcement, and a federal complaint against an alleged Scattered Spider hacker just showed it defeating a VPN. Per the FBI affidavit, Microsoft records tied one GDID to the creation of an ngrok account used in a May 2025 jewelry retailer breach, then gave investigators the device's full IP history. Cross-referenced against the suspect's Apple, Snapchat, and Facebook logins, the VPN didn't matter.

keyboard_arrow_left Previous keyboard_arrow_right Next

A 19-year-old hacker used VPNs, tunneling tools, and rotated IPs across 3 countries. The FBI still caught him. Here's the Windows feature that made it possible and why it should concern everyone. Peter Stokes, an alleged member of Scattered Spider (the group behind $100M+ in ransomware extortion), was arrested at Helsinki Airport this April. Court documents revealed a key piece of evidence: Microsoft's GDID. What is a GDID? GDID = Global Device Identifier. It's a unique code baked into every Windows installation. Microsoft uses it for telemetry, crash reports, feature usage, and license verification (it's why swapping your CPU can break your Windows activation). What Microsoft gave the FBI: → Web activity with timestamps → Gaming history → IP addresses used over time → Tool usage (including Ngrok, a tunneling app) → Azure account activity All tied to one persistent device fingerprint. Even though the VPN masked his IP, it didn't affect the GDID. How they connected the dots: Every time Stokes logged in to Snapchat, Apple, or Facebook from a new IP address, the GDID was there too. Investigators matched timestamps across platforms and countries: Tallinn, New York, Thailand, Germany. Different IPs. Same machine. Same person. Microsoft had already identified him in October 2024 and filed a criminal referral. He was still 17. So they waited till He turned 18. Then they moved. Yes, Stokes is accused of serious crimes. But the GDID data exists on every Windows machine, including yours. The infrastructure that handed his entire digital life to the FBI is the same infrastructure running on your laptop right now. The unanswered questions: - There's no public policy on when Microsoft shares GDID data - No known opt-out mechanism - No transparency report specifically covering GDID disclosures - What other criminal referrals has Microsoft quietly filed?

Abdulkadir | Cybersecurity @cyber_razz

a week ago

A 19 year old kid used a VPN and change his IP across 3 countries but the FBI was still able to catch him and that’s because windows was tracking a number he didn’t even know existed….

80 432 8K 2.4M 3K

Open directory, full toolkit, world-readable. 165.154.254[.]203 via @etugenio. The structure tells the story before you open a single file. Nuclei binaries and temp directories alongside a ProxyShell exploit chain, Cobalt Strike beacon artifacts, a Sliver fallback, LOLBin deployment wrappers, and a FOFA API integration for target acquisition. This isn't someone testing a PoC. The workflow is documented in the directory itself. The recon layer: FOFA API (fofa_api.py) and Nuclei (nuclei.zip, 29.8MB) handle target discovery. exchange_scan.sh and exchange_scan.log show active scanning against Exchange Autodiscover endpoints. exchange_targets.txt has 230+ URLs, raw IPs and domains, all formatted for ProxyShell exploitation. exchange_results.txt is the confirmed-hit list. The exploit chain is ProxyShell, three CVEs chained: CVE-2021-34473: Path confusion to SSRF against backend CVE-2021-34523: Privilege elevation via Exchange PowerShell CVE-2021-31207: Arbitrary file write to webshell drop Two exploit scripts present: a custom proxyshell_exploit.py and a full-featured exchange_proxyshell.py (Horizon3 variant). Both automate LegacyDN enumeration, SID extraction, token forgery, and PowerShell execution. Webshell drops to aspnet_client/ via EWS draft export abuse (ews_draft.py). Post-access payload delivery goes through Certutil LOLBin: deploy_beacon.py drop_and_run_cs.py deploy_min_cs.py loader.ps1 downloads sc.bin via WebClient.DownloadFile, allocates RWX memory via VirtualAlloc, and threads execution directly. No dropper. Straight shellcode injection into process memory. C2 architecture is dual-track. Cobalt Strike is primary: beacon.gz (11.9MB), nx_beacon.gz (9.1MB), three identical sc.bin/raw_win_x64.bin/raw_bot_relay_x64.bin at 270.5KB each, plus a full set of .cna Aggressor scripts for listener management, payload generation, and beacon tasking. Sliver is the backup: sliver_check.sh, sliver_fix.exp, sliver_commands open directory. Two C2 frameworks for resilience; both configs exposed. Tor is active on the server ([email protected] running). openssl.cnf suggests custom cert generation for C2 listener HTTPS. xray-client-test.json and associated logs point to additional tunneling tooling, likely xray-core for traffic obfuscation. Target profile is heavily Philippines-focused. Government infrastructure in the confirmed target list: dpwh.gov.ph (Dept of Public Works and Highways) gsis.gov.ph (Gov't Service Insurance System) pagibigfund.gov.ph ched.gov.ph (Commission on Higher Education) pmo.gov.ph (Presidential Management Office) philrice.gov.ph Media and private sector alongside: gmanetwork.com, tv5.com.ph, rfm.com.ph, yakult.com.ph, ucpbsavings.com.ph. Actor language indicators point to a Chinese-speaking operator. Inline comment in proxyshell_exploit.py: # Via 肉鸡 (zombie/bot machine, Chinese threat actor argot). Filename niaozun_key (鸟尊). FOFA API as primary recon tool, dominant in the Chinese-language security ecosystem. Multilingual README set in CN, ES, ID, JP, KR, PT-BR; an organized, maintained toolkit. Two credential files left in the open directory: niaozun_key (399B) vultr_key (411B) The Vultr key is significant. API access means the infrastructure footprint is queryable for attribution. IOCs: Stage server: 165.154.254[.]203:8888 Payload server: 149.28.138[.]225:8080 Payload: sc.bin (CS shellcode, ~270KB) Webshell path: /aspnet_client/.aspx C2 frameworks: Cobalt Strike + Sliver Recon: Nuclei, FOFA API, exchange_scan.sh Anonymization: Tor + xray-core If you're running Exchange 2013/2016/2019 on-prem, this operator has a working scripted chain and an active target list. Check your aspnet_client/ directory and EWS audit logs. Credit to @etugenio for the open directory discovery. #ThreatIntel #CTI #OSINT #ProxyShell #CobaltStrike #Exchange #APAC #Philippines

Recent research reveals that #ScatteredSpider is not a singular organized group but a decentralized #cybercrime collective comprised of multiple, independent subclusters. This loose affiliation of operators, connected primarily through shared TTPs and social engineering techniques, poses a unique challenge for attribution. Our latest analysis explains how this structure, akin to a hacking movement, provides inherent resilience against #lawenforcement actions. It's not a single group to track, but a persistent culture of cybercrime that evolves continuously.

keyboard_arrow_left Previous keyboard_arrow_right Next

AWS CIRT warns of active scanning for dangling Route 53 CNAME records pointing to deleted S3, CloudFront, and Elastic Beanstalk resources (T1584.001). Hunt with AWS Config custom rules checking CNAMEs against account inventory, not DNS resolution. #DFIR_Radar

Using SSH to drop files on target machine, using military movement as a filename IOC: 45[.]77[.]242[.]76 Usernames: t0, t1 Targeting: Philippines 🇵🇵🇭 Timeline: April - June 2026 @malwrhunterteam @500mk500 @smica83

keyboard_arrow_left Previous keyboard_arrow_right Next

x.com/i/article/2065…

🚨 SHOCKING: LISA SU’S $1,499 LUNCHBOX ANNIHILATES NVIDIA’S $4K AI BEAST! AMD CEO Lisa Su walked on stage, held a lunchbox sized PC in one hand, and ran a 235 billion parameter model live. No data center. No cloud. No rented GPU. The chip inside is the AMD Ryzen AI Max+ 395. It is the first x86 chip where the CPU and GPU share the same pool of memory. Up to 128GB of unified memory. That one design choice is what changes everything. An RTX 5090 gives you 32GB of video memory. A 4090 gives you 24. This box gives you more than three times either of them in a chassis you can carry in a backpack. On DeepSeek R1 inference, AMD's chip beat an Nvidia RTX 5080 by more than 3x. A desktop the size of a thick paperback outrunning a dedicated graphics card that costs over a thousand dollars on a real AI workload. Now do the math on your subscriptions. Claude Code Max is $200 a month. ChatGPT Pro is another $200. Cursor is $20. Gemini is $20. That is $5,280 leaving your account every year before you build a single thing. The 128GB version of this machine starts at around $2,399. At that run rate it pays for itself in under a year and then runs free. Install Ollama. Pull Qwen3 235B. Point Claude Code at localhost. Same interface you already use. Nothing leaves your machine. Nothing costs per request. No throttling at 3am when you finally have time to build. Lawyers stop worrying about what OpenAI does with their files. Developers stop watching the token counter. Founders stop killing prototypes because the cloud bill scared them off. Private AI just became something a normal person can own.

@AnthropicAI That's why: opensourceaimustwin.com/?share=v2

The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees. The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance. Access to all other Claude models is not affected. We apologize for this disruption to our customers. We believe this is a misunderstanding and are working to restore access as soon as possible. Read our full statement: anthropic.com/news/fable-myt…

This is what we've been seeing with every company we work with. Try justifying spending 100k on token spend when only 18k even makes it to a stable prod feature. In the rush to maximize AI token spend, companies are wasting over 44% on bug fixes

Ed Zitron @edzitron

2 months ago

Uber’s COO has said that it’s getting “harder to justify” its AI costs because there was no way to show a link between AI spend and any meaningful increase in useful features. This is the first time I’ve seen a company say this directly. businessinsider.com/uber-coo-andre…

keyboard_arrow_left Previous keyboard_arrow_right Next

355 5K 28K 2.9M 4K

I think AI coding hype follows roughly four stages: 1. Amazement You try it and can’t believe how much code it generates from a few prompts. 2. Expansion You start more and more projects because shipping suddenly feels cheap and fast. This is also the phase where people start convincing everyone around them: - coworkers - management - friends in other companies because nobody wants to “fall behind” in 6–12 months. That creates a massive snowball/FOMO effect. 3. The grind phase You realize the generated code has architectural issues, sloppy mistakes, weird abstractions, duplicated logic, broken edge cases, etc. So you start: - re-prompting - switching models - increasing reasoning effort - reviewing fixes - generating fixes for previous fixes And suddenly you spend your days reviewing AI-generated pull requests instead of building software. 4. Realization You realize AI coding increases output much faster than it increases certainty. The code still needs: - review - testing - ownership - architectural understanding - long-term maintenance Usually by expensive senior engineers. And the interesting thing is: this whole cycle can take many months or even more than a year because people become socially and professionally invested in the narrative themselves. Once teams, managers, and entire companies have been convinced that this is the future, it becomes psychologically and politically very hard to later say: “Actually, the ROI is much lower than we expected.”

Aiswarya Sankar @Aiswarya_Sankar

2 months ago

This is what we've been seeing with every company we work with. Try justifying spending 100k on token spend when only 18k even makes it to a stable prod feature. In the rush to maximize AI token spend, companies are wasting over 44% on bug fixes

125 280 2K 1.3M 1K

Chat, I don't want to be that guy, but I think Microsoft has really pissed off security researchers and we're approaching the tipping point. This Eclipse guy has really rocked the boat for Microsoft.

⚠️ WARNING - A malicious npm package was caught stealing files from Claude AI users’ /mnt/user-data directories and uploading them to attacker-controlled GitHub repositories. Check your installed packages: thehackernews.com/2026/05/malici… The package, “mouse5212-super-formatter,” used npm postinstall scripts, hard-coded GitHub tokens, and fake network logs to hide the theft. Downloaded 676 times so far.

keyboard_arrow_left Previous keyboard_arrow_right Next

Follow every Mythos discovery through our coordinated vulnerability disclosure dashboard. red.anthropic.com/2026/cvd/

@ThruntingLabs Nice. This makes me wanna sign up 👀

We are working on our first cloud intrusion investigation for Threat Hunting Labs. The lab is not live yet, but we wanted to start sharing some of the intrusion details because this case represents an important direction for THL. The intrusion began with a compromised developer macOS workstation. The workstation was infected by an infostealer. The developer had long-lived AWS access keys stored locally for a service integration and loaded them as environment variables during development. Those credentials were collected by the stealer and later used from external infrastructure to access the AWS environment. From there, the activity unfolded across 3 days and included: - enumeration - discovery - privilege escalation - lateral movement - data exfiltration This is exactly the kind of cloud intrusion we want analysts to investigate inside Threat Hunting Labs. It connects endpoint compromise, developer credential exposure, AWS access, identity activity, cloud control-plane behavior, and attacker progression across time. We are still building the lab, but we are excited about where this takes THL next. Cloud intrusions are becoming a major focus for us, and this case will be the first full cloud investigation we bring to the platform. To our knowledge, it will also be the first real cloud intrusion investigation of its kind available anywhere for hands-on analyst training.

2026-05-26 (Tuesday): Another page impersonating Claude was used to push #SHubStealer when viewed on a macOS host. Details at bit.ly/4fcekmj

keyboard_arrow_left Previous keyboard_arrow_right Next

PSA: Beyond The Dark (APPID: 3393800) on Steam is malware. Hidden in the unitydll is a dropper which then downloads more malware from a C2 based on what programs and chrome extensions you have (targeting crypto / defi wallets).