@Splintersfury

Malware analyst and cybersecurity professional focused on Windows kernel internals and reverse engineering.

Singapore
Joined October 2021
Replying to @Splintersfury
Ihsan comes from the root word "Husn" (beauty). It means to do something so well that it becomes beautiful.
6
1,112
Splintersfury retweeted
KernelSight is an interactive knowledge base that maps how Windows kernel drivers get exploited. It tracks 156 CVEs across 64 drivers, organized as a pipeline that mirrors how exploitation actually works: identify a driver, find its attack surface, classify the bug, convert it into a primitive, and escalate to SYSTEM. Refer them here:- splintersfury.github.io/Kern…
1
13
103
2,965
Splintersfury retweeted
Driver Buddy Reloaded is an IDA Pro Python plugin that helps automate some tedious Windows Kernel Drivers reverse engineering tasks. Blog:- voidsec.com/driver-buddy-rel… Github tool: github.com/VoidSec/DriverBud… By Paolo Stagno aka @Void_Sec
3
10
86
2,911
Splintersfury retweeted
I had a brief discussion with @k0mkc about how to help LLVM to further optimize the code from each one of the handlers from the VMProtect protected binary. This time, it was possible to recover the whole CFG, and have a function with exactly same semantic. #VMProtect
As promised, here is a thread about the research I've done in VMProtect! First, the decompiled version with Binja (@vector35) from the original binary, the vm_entry of VMProtect and finally a lifted version after the analysis! A total of 256 handlers analyzed Follow here!🧵
3
48
1,839
Here is how OpenAI’s CISO fumbled the situation (in my personal opinion) 🧵 1/X
17
81
32
698
142,627
Splintersfury retweeted
Really nice lab. Learned some new techniques. Big thanks to @mpgn_x64 and @mael91620 for running this. @ippsec and I got started a few hours late (it started at 5am), but we managed to finish. ctrlzero came through big when he was able to join for the last few flags!
The CTF is now over! Congratulations to the winners: Team Gogoplata - kenolab 🏆🥇 Team DTB 🥈 Team Gold or Hack 🥉 Team Sub5 warriors Team Eagles Only these five teams finished the lab, mad respect and what a run! Congratulations again ! 🎉
5
7
93
7,273
Splintersfury retweeted
huge if true. // great job @moyix. easily my favourite talk at @UnpromptedAU.
2
9
125
6,307
Splintersfury retweeted
🚨 Mustang Panda Uses OIC Invitation to Deliver PlugX The infection begins with OIC_Invitation_General_Official.lnk, which launches PowerShell to download an archive, extract its contents, and execute GRrte.exe. 📦 🎭 The malware displays an OIC-themed PDF decoy in Adobe Acrobat while a Jarte-derived executable is abused to load the attacker-controlled ssce5532.dll through DLL side-loading. 🔍 The side-loaded DLL searches the local payload set and works with irun.dat — an XOR-obfuscated payload that decrypts with key 0x72, exposing an embedded PE image associated with the final PlugX stage. ⚙️ The malware installs its operational components under C:\Users\Public\JartePortable\ and establishes persistence through: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\JartePortable 🌐 The persisted Jarte.exe communicates over TCP/443 with infrastructure associated with castanaksa[.]com, providing capabilities including remote execution, file management, process control, host discovery, registry manipulation, and network communications. 🎯 The OIC-themed lure may indicate an attempt to attract recipients interested in Organization of Islamic Cooperation-related affairs, although the analyzed sample alone does not establish the exact victim profile. 🔎 Full analysis: buff.ly/xZo9K7f #MustangPanda #PlugX #Malware #ThreatIntel #CyberSecurity #APT #DFIR
23
2
58
3,505
Splintersfury retweeted
It looks like all it took to bypass Opus's guardrails was to make it think it was attempting a CTF during a /goal
They used Opus 5 to pull off the hack. It appears they had access to the loosened cyber-guardrail version of Opus. They successfully accessed the OAI internal monorepo. The question that will be asked is, if these three guys can pull this off, what can a nation state do.
8
14
4
293
22,514
Splintersfury retweeted
🚨 Great research from @Unit42_Intel on ZionSiphon - an OT-focused threat targeting industrial environments. We took a deeper look at the sample with Joe Reverser 🔬⚙️ 🔗 Unit 42: buff.ly/j5i3AZO 🔗 Joe Reverser analysis: buff.ly/akXbCWd Interesting capabilities include SCADA/OT discovery, configuration manipulation, PLC/Modbus activity, USB propagation and anti-forensic behavior. 🏭🛡️
29
1
78
28,934
Splintersfury retweeted
Another Windows kernel LPE got full public source!! CVE-2026-42980: integer underflow in the NT OS Kernel lets a low-priv local user reach SYSTEM. Researcher dropped complete source, build scripts, and write-up. Ready-to-compile public material changes the risk overnight. cybersecuritynews.com/poc-wi… #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #WindowsInternals #PrivilegeEscalation
1
42
143
6,180
Splintersfury retweeted
🛰️ Reverse Engineering: IDA Pro Local Types Stop fighting the structs window and use Local Types instead. Paste your C code directly into the Local Types view to propagate types across the disassembly 👉 youtube.com/watch?v=jlWHt0e4…
11
83
3,422
Splintersfury retweeted
Reported a Critical to MSRC. Someone else found the same bug hours earlier, so it landed as duplicate. Got a special mention anyway, severity doesn't downgrade for being second. The bug: Invoke-WebRequest and Invoke-RestMethod derive the output filename from the redirect target's URL, decode it, and never strip path traversal. A malicious server can write files anywhere on disk your account can reach, Startup folder included. Works under Constrained Language Mode too, since AppLocker blocks execution, not file writes. Fixed now in PowerShell 7.x.
4
3
52
2,967
Splintersfury retweeted
QQSpeed/QQ飞车 desktop one-click RCE. TTBOMK theres millions of concurrent users. Could publish 系统消息 (System Messages) in public/game chat chaining a sanitization bypass + unsafe PV canonicalization + a weird unrestricted Lua execution sink into arb cmd. Was paid out $515 🤷‍♂️
6
5
73
10,011
Splintersfury retweeted
We found some stuff. Actually, quite a lot of stuff. Back in July, our team @rootxharsh, @S1r1u5_, and @iamnoooob managed to compromise multiple OpenAI employees’ ChatGPT accounts. In theory, any ChatGPT connector can be affected. This includes Slack, github, email, and other services. 🧵
7
18
167
8,036
Splintersfury retweeted
Finally sharing the first of the 5 unreleased projects I’ve been working on 👀 TL;DR: Phalanx, the fully automated AI blue team we built, took 1st place in defense/availability score among all 10 blue teams at APEX 2026. APEX is an international cyber attack & defense exercise jointly conducted by NATO CCDCOE(@ccdcoe) and the Republic of Korea’s National Intelligence Service(NIS). This year, I participated both in developing Phalanx, our AI blue team, and as part of the red team. Phalanx is an AI-based automated blue team system that detects attacks inside a virtual national infrastructure environment and handles response, defense, and recovery with minimal human intervention. It was built over roughly 4 months by a 6-person team made up of ppl from the military, government agencies, and private-sector organizations. We deployed it in the actual exercise, and ended up taking 1st place in system defense/availability score among the 10 blue teams by a pretty wide margin! There was a lot of trial and error along the way, so watching a system we had spent months building actually stop real attacks was honestly a pretty special feeling. I wrote a much more detailed post about it on LinkedIn. (automatic translation is ridiculously good these days, so I just wrote the whole thing in Korean lol) And I still have 4 unreleased projects left 👀 Could be AI, could be vulnerability research. I’m planning to reveal one of them around the end of this year. Turns out there are a lot of fun things to do in security even without grinding CTFs all the time lol. And no, I haven’t quit security yet. I’ll keep posting proof that I’m still alive 😆 lnkd.in/p/gH_ydArc
1
2
25
1,237
Splintersfury retweeted
damn, @brutecat got $100k from Google for an arbitrary file read 🔥 interesting writeup to see how he approached the bug starting from analysing Google's RPC endpoints and deep diving into them 👇 bughunters.google.com/blog/b…
1
39
302
11,578
Splintersfury retweeted
This work was done by our team @HacktronAI led by @rootxharsh along with me and @iamnoooob. We have published the full details of the exploit chain, as well as how we discovered it, on our blog here: hacktron.ai/blog/hacking-ope…
10
60
4
674
97,692
Splintersfury retweeted
Don't worry, many guys has 200+ cases with the same sitituation, they are worrier than you :-)
two months ago, I reported a critical bug to @msftsecresponse, but it has received no attention since. It's disheartening. I still appreciate the company, but there's no denying that their bug bounty program requires improvement 💔.
1
2
47
5,693
Splintersfury retweeted
Day 1 #BlueHatAsia 2026 has ended. @MSFTBlueHat has really high quality talks, and no, I dont think i will ever look at XSS bugs the same way anymore T.T Its really interesting because of the joint presentation between MVR and MSRC representative to show the bug + the side of the triagers. Also thanks to @spaceraccoonsec ‘s super entertaining bug which I and @ultimat3hg can definitely relate too! Also, reconnected with others including the GOAT @scwuaptx which we met some time back in Korea :D Talking to MSRC personnels definitely changed my perspective on triaging, and they were super helpful in resolving some issues. Looking forward to Day 2!
2
40
1,313