@Splintersfuryi
iAccount based inSingapore
About this account
- Account based in
- Singapore
- Connected via
- Singapore App Store
Account-level information from X, not a live location or the device used for a specific post.
Malware analyst and cybersecurity professional focused on Windows kernel internals and reverse engineering.
Singapore
Joined October 2021
- Tweets18.3K
- Following1.7K
- Followers396
- Likes21.5K
Pinned Tweet
Replying to @Splintersfury
Ihsan comes from the root word "Husn" (beauty). It means to do something so well that it becomes beautiful.
KernelSight is an interactive knowledge base that maps how Windows kernel drivers get exploited. It tracks 156 CVEs across 64 drivers, organized as a pipeline that mirrors how exploitation actually works: identify a driver, find its attack surface, classify the bug, convert it into a primitive, and escalate to SYSTEM.
Refer them here:- splintersfury.github.io/Kern…
Driver Buddy Reloaded is an IDA Pro Python plugin that helps automate some tedious Windows Kernel Drivers reverse engineering tasks.
Blog:- voidsec.com/driver-buddy-rel…
Github tool: github.com/VoidSec/DriverBud…
By Paolo Stagno aka @Void_Sec
I had a brief discussion with @k0mkc about how to help LLVM to further optimize the code from each one of the handlers from the VMProtect protected binary. This time, it was possible to recover the whole CFG, and have a function with exactly same semantic.
#VMProtect
As promised, here is a thread about the research I've done in VMProtect!
First, the decompiled version with Binja (@vector35) from the original binary, the vm_entry of VMProtect and finally a lifted version after the analysis! A total of 256 handlers analyzed
Follow here!🧵
Splintersfury retweeted
Here is how OpenAI’s CISO fumbled the situation (in my personal opinion)
🧵 1/X
Really nice lab. Learned some new techniques. Big thanks to @mpgn_x64 and @mael91620 for running this.
@ippsec and I got started a few hours late (it started at 5am), but we managed to finish. ctrlzero came through big when he was able to join for the last few flags!
Splintersfury retweeted
🚨 Mustang Panda Uses OIC Invitation to Deliver PlugX
The infection begins with OIC_Invitation_General_Official.lnk, which launches PowerShell to download an archive, extract its contents, and execute GRrte.exe. 📦
🎭 The malware displays an OIC-themed PDF decoy in Adobe Acrobat while a Jarte-derived executable is abused to load the attacker-controlled ssce5532.dll through DLL side-loading.
🔍 The side-loaded DLL searches the local payload set and works with irun.dat — an XOR-obfuscated payload that decrypts with key 0x72, exposing an embedded PE image associated with the final PlugX stage.
⚙️ The malware installs its operational components under C:\Users\Public\JartePortable\ and establishes persistence through:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\JartePortable
🌐 The persisted Jarte.exe communicates over TCP/443 with infrastructure associated with castanaksa[.]com, providing capabilities including remote execution, file management, process control, host discovery, registry manipulation, and network communications.
🎯 The OIC-themed lure may indicate an attempt to attract recipients interested in Organization of Islamic Cooperation-related affairs, although the analyzed sample alone does not establish the exact victim profile.
🔎 Full analysis:
buff.ly/xZo9K7f
#MustangPanda #PlugX #Malware #ThreatIntel #CyberSecurity #APT #DFIR
It looks like all it took to bypass Opus's guardrails was to make it think it was attempting a CTF during a /goal
Splintersfury retweeted
🚨 Great research from @Unit42_Intel on ZionSiphon - an OT-focused threat targeting industrial environments.
We took a deeper look at the sample with Joe Reverser 🔬⚙️
🔗 Unit 42:
buff.ly/j5i3AZO
🔗 Joe Reverser analysis:
buff.ly/akXbCWd
Interesting capabilities include SCADA/OT discovery, configuration manipulation, PLC/Modbus activity, USB propagation and anti-forensic behavior. 🏭🛡️
Splintersfury retweeted
Another Windows kernel LPE got full public source!!
CVE-2026-42980: integer underflow in the NT OS Kernel lets a low-priv local user reach SYSTEM. Researcher dropped complete source, build scripts, and write-up. Ready-to-compile public material changes the risk overnight.
cybersecuritynews.com/poc-wi…
#Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #WindowsInternals #PrivilegeEscalation
Splintersfury retweeted
🛰️ Reverse Engineering: IDA Pro Local Types
Stop fighting the structs window and use Local Types instead. Paste your C code directly into the Local Types view to propagate types across the disassembly
👉 youtube.com/watch?v=jlWHt0e4…
Reported a Critical to MSRC. Someone else found the same bug hours earlier, so it landed as duplicate. Got a special mention anyway, severity doesn't downgrade for being second.
The bug: Invoke-WebRequest and Invoke-RestMethod derive the output filename from the redirect target's URL, decode it, and never strip path traversal. A malicious server can write files anywhere on disk your account can reach, Startup folder included. Works under Constrained Language Mode too, since AppLocker blocks execution, not file writes.
Fixed now in PowerShell 7.x.
Splintersfury retweeted
QQSpeed/QQ飞车 desktop one-click RCE. TTBOMK theres millions of concurrent users. Could publish 系统消息 (System Messages) in public/game chat chaining a sanitization bypass + unsafe PV canonicalization + a weird unrestricted Lua execution sink into arb cmd. Was paid out $515 🤷♂️
Splintersfury retweeted
We found some stuff. Actually, quite a lot of stuff.
Back in July, our team @rootxharsh, @S1r1u5_, and @iamnoooob managed to compromise multiple OpenAI employees’ ChatGPT accounts.
In theory, any ChatGPT connector can be affected. This includes Slack, github, email, and other services. 🧵
Finally sharing the first of the 5 unreleased projects I’ve been working on 👀
TL;DR: Phalanx, the fully automated AI blue team we built, took 1st place in defense/availability score among all 10 blue teams at APEX 2026.
APEX is an international cyber attack & defense exercise jointly conducted by NATO CCDCOE(@ccdcoe) and the Republic of Korea’s National Intelligence Service(NIS). This year, I participated both in developing Phalanx, our AI blue team, and as part of the red team.
Phalanx is an AI-based automated blue team system that detects attacks inside a virtual national infrastructure environment and handles response, defense, and recovery with minimal human intervention.
It was built over roughly 4 months by a 6-person team made up of ppl from the military, government agencies, and private-sector organizations. We deployed it in the actual exercise, and ended up taking 1st place in system defense/availability score among the 10 blue teams by a pretty wide margin!
There was a lot of trial and error along the way, so watching a system we had spent months building actually stop real attacks was honestly a pretty special feeling.
I wrote a much more detailed post about it on LinkedIn. (automatic translation is ridiculously good these days, so I just wrote the whole thing in Korean lol)
And I still have 4 unreleased projects left 👀
Could be AI, could be vulnerability research. I’m planning to reveal one of them around the end of this year.
Turns out there are a lot of fun things to do in security even without grinding CTFs all the time lol.
And no, I haven’t quit security yet. I’ll keep posting proof that I’m still alive 😆
lnkd.in/p/gH_ydArc
Splintersfury retweeted
damn, @brutecat got $100k from Google for an arbitrary file read 🔥
interesting writeup to see how he approached the bug starting from analysing Google's RPC endpoints and deep diving into them 👇
bughunters.google.com/blog/b…
This work was done by our team @HacktronAI led by @rootxharsh along with me and @iamnoooob.
We have published the full details of the exploit chain, as well as how we discovered it, on our blog here:
hacktron.ai/blog/hacking-ope…
Don't worry, many guys has 200+ cases with the same sitituation, they are worrier than you :-)
two months ago, I reported a critical bug to @msftsecresponse, but it has received no attention since. It's disheartening. I still appreciate the company, but there's no denying that their bug bounty program requires improvement 💔.
Splintersfury retweeted
Good series on Pwning AI Agents
Part 1: Exploiting AI Coding Agents m10x.de/posts/2026/04/pwning…
Part 2: RCE and Data Exfiltration m10x.de/posts/2026/06/pwning…
Part 3: Read Only Bypass m10x.de/posts/2026/07/pwning…
Part 4: Exploiting MCP Hosts with a Malicious MCP Server m10x.de/posts/2026/08/pwning…
Splintersfury retweeted
Day 1 #BlueHatAsia 2026 has ended. @MSFTBlueHat has really high quality talks, and no, I dont think i will ever look at XSS bugs the same way anymore T.T Its really interesting because of the joint presentation between MVR and MSRC representative to show the bug + the side of the triagers.
Also thanks to @spaceraccoonsec ‘s super entertaining bug which I and @ultimat3hg can definitely relate too!
Also, reconnected with others including the GOAT @scwuaptx which we met some time back in Korea :D
Talking to MSRC personnels definitely changed my perspective on triaging, and they were super helpful in resolving some issues. Looking forward to Day 2!