← Feed

Posts

• View post

  My "Introduction to ICS Malware Analysis" workshop was accepted at the SANS ICS Security Summit. You'll learn about ICS malware by analyzing samples modeled on FrostyGoop and CRASHOVERRIDE. No prior RE experience needed. It's running twice: June 8 and June 10. Hope to see you there! https://www.sans.org/cyber-security-training-events/ics-security-summit-2026#schedule #ICS #malware

• View post

  “The AI wrote it, so it must be good” is a trap, and a poor excuse to ignore a human edit. At the very least: - Rewrite the headings - Remove useless adverbs (AI loves “actually”) - Check that the flow of ideas is coherent. - Check for accuracy. - Ask yourself “Does this sound like me?” (Or whatever voice is required) Otherwise, your writing will sound the same as all the other copy-pasted AI slop, and you risk having your work ignored.

• View post

  AI has turned into the new Excel: the 2nd best tool for a job because most folks don’t feel like looking up a better way, or asking the AI to find an established way and using that method.

• View post

  Anytime I run into a problem with a Snap package, the solution seems to be “remove the snap, install the native package”. But, when I run into an issue with a Flatpak, there seems to be a straightforward way to amend the permissions. Is this just my anecdotal experience? Are snap permissions really so limiting that most people and package maintainers would rather just not?

• View post

  We have two fully remote malware analyst positions open at Dragos! There are a lot of malware analysis jobs where your analysis, reports, or signatures disappear into the void when you're done. But at Dragos, it's really easy to see the impact of your work on the company, product, customers, and the wider ICS industry. Malware analysis works with IR, Hunt, Detections, our OT Watch service, and even Engineering, which means you get to work on all kinds of cases from all sorts of...

• View post

  Dragos has a Vulnerability Analyst position open! https://job-boards.greenhouse.io/dragos/jobs/5369221008 #vulnerabilityanalysis #ICS #ICSsecurity

• View post

  I never want to see the word “actually” again. It wasn’t great before but LLMs have ruined it.

• View post

  Polymorphism, detection evasion, obfuscation.. these sorts of things haven’t been difficult for literally decades now. If you think AI has significantly tipped the scales in these areas, you haven’t been paying attention to the field. AI isn’t upgrading these areas, it’s just providing another avenue. Like just look at Tigress. They’ve been working on this since 2012, Tigress itself came out in 2018, and that’s only a recent example. https://tigress.wtf/tigress-publications.html

• View post

  So glad someone is saying it. We've been seeing similar. LLMs are only useful for specific kinds of problems, and when applied to the wrong kind of problem, they produce garbage or waste your time. This fact doesn't change when applied to malware. https://www.darkreading.com/threat-intelligence/ai-slop-ruining-cyberattacks #malware

• View post

  Framing the php2shell story as "AI uncovered php2shell" is like hearing an awesome song and crediting the guitar instead of the player. It's just incorrect and steals credit from a good researcher. The underlying bug was discovered in 2020, a related one in 2024, and they were both rediscovered again through exploitation in 2026 by a human researcher. The researcher used LLM tech to help with parts of the process, not all of it, and says so in the writeup. https://cal...

• View post

  @ness oof. Crap like that is why programs like AI Spotlight exist. https://pulitzercenter.org/focus-areas/information-and-artificial-intelligence/ai-spotlight-series

• View post

  There's been so much hype, misinformation, and downright uninformed takes that exaggerate what LLM technology can do for malware developers. I can say that with confidence, because we've spent the past year (and more) looking at LLM-generated ICS malware to understand the reality. At DISC, we'll share what we learned from the experience. DISC takes place on Nov 4-6 in Hanover, MD. Register here: https://events.dragos.com/disc2026/12067109 #otsecurity #icssecurity #malwareanalysis

• View post

  I used to spend hours finding wrong answers to Linux issues on Reddit before giving up and figuring it out myself. Now, an LLM gives me the wrong answers instantly, boils the ocean, and forces me to manually solve the problem sooner. I feel so productive!

• View post

  A lot of folks have reached out about Socket's recent report on a supply chain attack using malicious NuGet packages to target Siemens S7 protocol and other PLCs. This is not a supply chain attack in the traditional sense. No legitimate projects were compromised, and no S7, Sharp7, or Siemens codebases were modified. Socket identified packages published by a separate user ("shanhai666") containing code that probabilistically kills host processes and causes database wr...

• View post

  Had a great time presenting at LSU this week on hunting and analyzing Go and Python malware samples while hunting for ICS malware. For those who couldn't make it, you can catch a recording of this talk from Hou.Sec.Con last month with @secureloon https://www.youtube.com/watch?v=R8xFGz-AGEE #ICS #malware #otsecurity #malwareanalysis

• View post

  We have a job opening in our Community Defense Program (CDP) which gives small utilities free access to the Dragos Platform. This opening is a chance to do some truly meaningful work for the community. Job Description: https://job-boards.greenhouse.io/dragos/jobs/4976260008 CDP Description: https://www.dragos.com/community/community-defense-program #otsecurity #ics

• View post

  I spent a couple months arguing with Claude and Copilot while building FrostyGoop variants for DNP3 (and Modbus), keeping detailed notes on what worked and what didn't. At S4, I'll share my honest assessment: where these tools actually help, where they fail, and how much skill an attacker needs to make them useful. See you in Miami! #ICS #malware #otsecurity

• View post

  This is the first known attack on DERs. Attackers compromised RTUs at 30 different sites. The report has an overview, defensive guidance, and a comparison to past ELECTRUM ops. Hats off to CERT Polska for leading the charge, and kudos to our Intel team for the hard work. https://hubs.la/Q040Bwpg0 #ICS #otsecurity

• View post

  I know I'm feeling stressed out when I go back to reading Thich Nhat Hahn. His teachings calm me, and I need that reminder that happiness is available in any moment despite circumstance. I'm not even Buddhist. or maybe I am? He'd probably say the distinction isn't important.

• View post

  CERT.PL's report on the coordinated attacks against Polish infrastructure. Adversaries used all manner of destructive techniques: firmware corruption, wipers, SSH commands, FTP deletes, factory resets, even booted Tiny Core Linux on KVM to DD-wipe servers. They targeted a grid connection point, CHP plant, and a manufacturing site. The forensic reconstruction and malware analysis is excellent. Worth a read for the technical depth. https://cert.pl/en/posts/2026/01/incident-report-energy-...

• View post

  I've spent a lot of time reversing ICS malware. Recently, I've been building it with AI tools. While there's been plenty of commentary and news about AI and malware, I'm excited to share what I learned actually trying to build some at S4x26. Stage 2, Feb 24, 12pm.

• View post

  The Dragos 2026 Year In Review Report is live: 3 new threat groups, updates from 3 of our more active threat groups, and (my personal favorite) coverage of a subset ICS-related capabilities that we found last year. https://www.dragos.com/ot-cybersecurity-year-in-review

• View post

  I earned my first CVE credit (CVE-2025-7676) for helping with a Windows ARM vuln. So, to commemorate the credit, @reverseics presented me last week with a Trophy of Perpetual Futility, because there’s always more work to do. https://raw.githubusercontent.com/reidmefirst/vuln-disclosure/refs/heads/main/2025-04.txt

• View post

  If you're trying to run Remnux on KVM by loading the OVA: To get network access: KVM changes the network adapter name, so you've got to change the config in /etc/netplan, replacing the old vmware adapter (like enss0) with whatever the new one is and then reboot. You can use networkctl to find the non-loopback adapter name (like en1ps0) The Remnux docs also say to run "remnux install" after loading into KVM to install spice and other tools. When I do that, it m...

• View post

  I had a great time on Jim's podcast discussing malware analysis, reverse engineering, working at Dragos, and a little bit of my personal history. https://www.youtube.com/watch?v=qCgnIMbgs3Y

• View post

  Folks are giving AI way too much credit. "AI wins CTF" "Claude hacks government" Sound as silly as saying: "Metasploit hacked a hospital!" or "Hammer builds a house!" Blaming AI shifts responsibility away from the humans who orchestrate it, and confuses defenders into thinking they're up against some vague AI supervillain. AI hasn't changed the fundamental problem. Capable attackers are still the threat,...

• View post

  TIL FLARE distributes educational content for free on GitHub. https://github.com/mandiant/flare-learning-hub

• View post

  This blog nails some real problems with bringing AI into an organization in any industry, not just cybersecurity. The article brings up a human training issue that I've been pondering a lot. What does it look like to train a new reverse engineer with AI tools available? https://www.sentinelone.com/blog/the-implementation-blind-spot-why-organizations-are-confusing-temporary-friction-with-permanent-safety/

• View post

  Ironically, S4 dropped my talk on vibe coding ICS malware on the same day that non-functional AI-slop OT "malware" is making headlines. It’s hype “malware” distracting us from real threats. More to say, but it's Friday :) In the meantime, I hope you enjoy the talk. https://www.youtube.com/watch?v=v0grXXc5zgw

• View post

  ZionSiphon is an AI-generated, non-functional attempt at ICS malware. Malicious intent doesn't imply ability, and broken malware like this is a distraction when we have proven threats like VOLTZITE/Volt Typhoon out there hitting water utilities.: https://www.dragos.com/blog/zionsiphon-ot-malware-analysis #ICS #malware