DFIR / CERT / CSIRT @google - nice person - All opinions are mine... . Doing @TimesketchProj stuff. 🏊♂️ 🚲 🏃♂️
Time matters
| https://twitter.com/alexanderjaeger | |
| Blog | https://www.alexanderjaeger.de/news/ |
Python developers, be careful! Someone tries to phish PyPI accounts using the domain pypj[.]org.
https://discuss.python.org/t/pypi-org-phishing-attack/100267/7
Help request. My brother has Stage 4 colorectal cancer.
His life insurance has refused to pay out on a technicality, meaning he and his loved ones cannot afford the mortgage on their home.
I've never asked for anything in return for infosec stuff, but if you have anything spare, please chuck it this direction instead:
As malware authors increasingly adopt .NET for its ease of development and stability, they rely on sophisticated obfuscation techniques to thwart analysis. Traditional static deobfuscation approaches often fail against modern protections that incorporate runtime integrity checks. This presentation introduces a framework that leverages .NET profilers to perform dynamic binary instrumentation at the MSIL level. We demonstrate how this approach can bypass dynamic checks in obfuscation schemes, extract encrypted strings, and trace execution flows—all without modifying the original binary. Through real-world case studies and live demonstrations, we show how this technique provides reverse engineers with a powerful new tool to analyze obfuscated .NET malware.
Thomas Patzke
Kevin Beaumont
Chris John Riley 
Tillmann Werner
CERT-EU
FIRST.org