Casperinous retweeted
We asked GPT-6 Astra to edit Qwen3.5-0.8B weights to improve math.
It directly changed only 0.016% of weights, fixing 0.8B's reasoning loops & improving math up to 6x and even instruction following 3x, without gradients or training.
We call this Weight-Space Programming: frontier LLMs can now natively read/write neural network weights! 🧵
Blog: rikiyat.github.io/blog/weigh…
Casperinous retweeted
#VoltTyphoon operational network for 0-day exploitation uncovered.
Very insightful research from the people
@lumentechco .
Kudos for using the insights on this network over a 3 year timespan to inform victims/targets before major impact.
lumen.com/blog/en-us/silent-…
Casperinous retweeted
Just dropped a new blog post! 🔥
blog.orange.tw/posts/2026-10…
Casperinous retweeted
In an international law enforcement operation 👮, the US Department of Justice 🇺🇸, in cooperation with private sector partners, have taken down notorious bulletproof hosting provider Virtualine 💥
➡️ justice.gov/usao-edva/pr/bul…
Operating as AS202412 (Omegatech LTD), Virtualine received upstream connectivity from German 🇩🇪 providers aurologic GmbH (AS30823) and Pfcloud UG (AS51396), as well as French 🇫🇷 PEERXY NETWORKS SAS (AS213382), as bgp .tools shows. This network connectivity is now gone, currently making it impossible for Omegatech to operate 🛑
Omegatech announced 24x /24 IPv4 CIDRs, totaling 6,144 IPs. Out of these, hundreds were seen daily participating in spamming, internet-wide scanning, and botnet C2 hosting ⤵️
🌐 URLhaus tracked over 10,000 malware distribution sites at Omegatech: urlhaus.abuse.ch/asn/202412
📡 ThreatFox logged 2,000+ community-shared IOCs tied directly to Omegatech: threatfox.abuse.ch/asn/20241…
The hoster primarily served malicious infrastructure associated with RATs 🖥️ (e.g., PureRAT and OverlordRAT), rogue ScreenConnect servers 🔌, and social engineering malware campaigns like ClickFix and ErrTraffic 🖱️. While internet abuse for sure can happen, Virtualine was not reacting on abuse reports at all and advertised their "bulletproof hosting services" on the darkweb, as investigation shows 🕵️♀️
The takedown of Omegatech is welcome news. However, its long-term impact remains uncertain. Bulletproof hosters commonly re-brand and resume operations under new ASNs quickly 🔃
Furthermore, Omegatech is just the tip of the iceberg. Other active bulletproof hosters include:
➡️ AS219502 (STORMCLOUD)
➡️ AS207043 (DEDIK-IO)
➡️ AS214351 (FEMOIT)
What do they all have in common? According to bgp .tools, they all receive upstream connectivity from German provider aurologic GmbH (AS30823) as well 🔍👀
If you don't want to worry about the threats posed by bulletproof hosters, just block any CIDRs and ASNs listed on @spamhaus 's Don't Router Or Peer List (DROP):
🛑 spamhaus.org/blocklists/do-n…
ALT bgp.tools showing historic BGP upstream connectivity of Omegatech LTD provided by AS213382 PEERYX, AS30823 aurologic GmbH and AS51396 Pfcloud UG
Casperinous retweeted
This is absolutely nuts and only hitting German papers so far: leaked emails show that seven politicians from Germany's far-right AfD travelled to Syria to meet with Assad regime officials... facilitated by Hezbollah AND Russian intelligence.
handelsblatt.com/politik/deu…
Casperinous retweeted
Another day - another Stealer: MopsStealer 🐶
Active botnet C2s, hosted at Podaon SIA 🇳🇱:
📡 mops .to
📡 45.91.202.47:408
📡 45.91.202.47:1488
📡 45.91.202.146:408
📡 45.91.202.146:1488
Malware samples ⤵️
bazaar.abuse.ch/browse/signa…
IOCs ⤵️
threatfox.abuse.ch/browse/ma…
Casperinous retweeted
#ESETresearch uncovered #MythicRatatoskr, an undocumented Go backdoor hiding its C&C server inside the #Yggdrasil mesh network. It was used against a Ukrainian 🇺🇦 grain logistics firm in an intrusion that ended in a destructive #Sandworm attack.
welivesecurity.com/en/eset-r… 1/6
Casperinous retweeted
Every single person you meet in your daily life is fighting a hidden battle that you know nothing about
Send them a Zoom meeting link for an 8 AM call on Monday morning to finish them off
Casperinous retweeted
Wrote up my attempt at deobfuscating Luraph-protected Lua: lifting Lua to LLVM IR , then using AI + partial evaluation to strip the VM, and checking it against the original.
nac-l.github.io/2026/10/12/d…
Casperinous retweeted
🦠 ThreatLabz has identified an x64 variant of GuLoader. The sample uses similar anti-analysis methods as GuLoader x86 samples. However, the following anti-analysis features have been added:
- Huge stack frames in order to break IDA's decompilation.
- Direct syscalls to call Windows native API functions. GuLoader chooses a different syscall address that is chosen randomly.
- The registered Vectored Exception Handler (used to obfuscate the control flow) points to a location within NTDLL's memory region, making the exception-driven control flow appear legitimate.
- Use of the Windows API function TrySubmitThreadpoolCallback to execute callbacks and avoid detection.
Sample hash: dc5021a0e1d00fb1da9eef2b5d5ac3f9a5906e5c3c17470807c3845083ac5a6d
Malicious Google Drive URL: hxxps://drive.google[.]com/uc?export=download&id=1Zynj-CzTxaYpQr5aniRGE5gUqs26k-t5
Casperinous retweeted
This semester I am teaching a new course on Agentic Systems, which explores the full stack of AI systems: from building and optimizing agent harnesses to serving and optimizing LLM serving infrastructure.
Students learn by building, measuring, and optimizing real agents and systems, balancing capability, latency, and cost.
Our goal is not just to teach today's AI technologies, but to prepare students to build tomorrow's.
All lectures, readings, and assignments are publicly available at cs2680.seas.harvard.edu
Casperinous retweeted
The final post of my decompilation project is out.
83% of the functions are byte exact. We're hitting diminishing returns. The game runs flawlessly, so we're calling it done here.
For obvious reasons, no code will be shared.
momo5502.com/posts/2026-10-0…
Casperinous retweeted
Check out our new VMProtect (v3.0 - v3.10 latest) unpacker 👀
More to come…
Emulation-based unpacker and import resolver for Windows x64 VMProtect 3.x binaries: github.com/x86rc/vmp-lazy-un…
Casperinous retweeted
poteto's cursor profile is public. She's used 1.5T tokens in the last 30 days.
Assuming an avg rate of $8/M that's $384k/day or $11m. In the last 30 days. Per year thats $132M.
Let's assume Cursor has some insane deal with Anthropic and gets 90% off. That comes out to $38k/day or $1.1M in Sept/Oct.
$13m will get me 26 sassy staff-level all stars for $500k/yr
Readers added context they thought people might want to know
The Cursor profile at cursor.com/@lauren shows 1.5T tokens used. Cost estimates at $8/M do not account for prompt caching common in agent coding, where cache reads are billed at ~10% of input rates per analyses of Anthropic pricing. This results in lower effective costs.
cursor.com/@lauren chudi.dev/blog/claude-pr… carlosaragon.online/blog/anthropic…