kurt baumgartner
LightNews LightNews
banner
kurtisj.bsky.social
kurt baumgartner
@kurtisj.bsky.social
71 followers 98 following 51 posts
independent cybersecurity researcher.
I have many leather-bound books and my apartment smells of rich mahogany. thanks for all the xor
Posts Replies Media Videos
Reposted by kurt baumgartner
dieworkwear.bsky.social
Let me show you the difference between a $40 hoodie and a ~$100 hoodie. 🧵
Someone on Twitter writes: "Why are we normalizing $85-90 hoodies?" The attached photo shows a woman who looks exasperated.
November 12, 2025 at 10:54 PM
Reposted by kurt baumgartner
pinkflawd.bsky.social
Squeeeee 🥳 I'll be teaching my Advanced Linux Malware Reverse Engineering class at RE//verse conference in 2026!! MORE Linux APT insides and peculiarities😍🥰🤩Pls share if you can🙃
shop.binary.ninja/products/re-...
RE//verse 2026 Training - Advanced Linux Malware Reverse Engineering with Marion Marschalek
This fast-paced 3-day training explores Linux internals and Linux binary analysis techniques, before jumping right in with common Linux malware. Work through advanced samples, Linux software protectio...
shop.binary.ninja
November 12, 2025 at 6:59 PM
kurtisj.bsky.social
The spyware is delivered through malformed DNG image files exploiting CVE-2025-21042...

The exploit chain possibly involved zero-click delivery using maliciously crafted images, similar to recent exploit chains seen on iOS and Samsung Galaxy.

unit42.paloaltonetworks.com/landfall-is-...
LANDFALL: New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices
Commercial-grade LANDFALL spyware exploits CVE-2025-21042 in Samsung Android’s image processing library. The spyware was embedded in malicious DNG files.
unit42.paloaltonetworks.com
November 7, 2025 at 3:00 PM
Reposted by kurt baumgartner
saffronsec.bsky.social
New Iran drop from me tracking an attribution nightmare - UNK_SmudgedSerpent! A little Charming, a little Muddy, and a lot C5. Targeting policy experts with benign conversation starters, health-themed infra, OnlyOffice spoofs, and RMMs. Check out the full story www.proofpoint.com/us/blog/thre...
Crossed wires: a case study of Iranian espionage and attribution | Proofpoint US
Proofpoint would like to thank Josh Miller for his initial research on UNK_SmudgedSerpent and contribution to this report.  Key findings  Between June and August 2025,
www.proofpoint.com
November 5, 2025 at 1:37 PM
Reposted by kurt baumgartner
perryodontal.bsky.social
the password to the louvre surveillance server was "louvre"

www.thesocialpost.it/2025/11/02/f...
according to the liberation newspaper, documents dating back to a 2014 inspection by the French National Agency for the Security of Computer Systems reported a staggering detail: "the password of the louvre's video surveillance server was simply " louvre. "
November 3, 2025 at 5:56 PM
kurtisj.bsky.social
another jabberzeus roundup!
krebsonsecurity.com/2025/11/alle...
Alleged Jabber Zeus Coder ‘MrICQ’ in U.S. Custody
A Ukrainian man indicted in 2012 for conspiring with a prolific hacking group to steal tens of millions of dollars from U.S. businesses was arrested in Italy and is now in custody in the United States...
krebsonsecurity.com
November 3, 2025 at 6:34 PM
Reposted by kurt baumgartner
hultquist.bsky.social
If you’ve been laid off from a cyber threat intel position, and you want a ticket to CYBERWARCON, please reach out.
October 23, 2025 at 1:27 PM
Reposted by kurt baumgartner
sekoia.io
After our initial #PolarEdge #botnet write-up, we’re happy to announce the second part: “Defrosting PolarEdge’s Backdoor,” a full technical deep-dive into its TLS-based implant.

blog.sekoia.io/polaredge-ba...
October 14, 2025 at 1:35 PM
Reposted by kurt baumgartner
swiftonsecurity.com
October 9, 2025 at 11:01 PM
Reposted by kurt baumgartner
malware-traffic-analysis.net
2025-10-01 (Wed) I've posted #malware samples and a #pcap of the post-infection traffic from an infection by possible #Rhadamanthys malware at www.malware-traffic-analysis.net/2025/10/01/i...

This is from a file disguised as a cracked version of software, and I usually see #LummaStealer from this.
Screenshot of the page from my website with the post for this information. Example of path to download the initial 7-zip archive for the malware. Page with the download for the initial 7-zip archive. Traffic from the possible Rhadamanthys malware, filtered in Wireshark.
October 6, 2025 at 6:52 PM
Reposted by kurt baumgartner
malware-traffic-analysis.net
2025-10-02 (Thursday): #pcap and some images from an Android malware infection at www.malware-traffic-analysis.net/2025/10/02/i...
Screenshot of icon for the malicious app on a cell phone. Screenshot of the login screen for the malicious app on a cell phone. It's asking me to place a credit card on the phone. Traffic from an infection filtered in Wireshark.
October 7, 2025 at 2:59 AM
Reposted by kurt baumgartner
wxs.bsky.social
Two things:

YARA-X 1.8.0 is out with some nice features if you use the various bindings and a bug fix involving an edge case in PE signatures. Congrats to all involved!

To be more useful I wrote a small PR to display filenames in console.log() output when using yr scan.

github.com/VirusTotal/y...
Release v1.8.0 · VirusTotal/yara-x
Implement block scanning API for Rust and C (#459, 185c2ee). Implement Golang and C APIs for setting global variables of type array and structure (#449). Add iterator for Rules object in Python (#4...
github.com
October 6, 2025 at 8:13 PM
kurtisj.bsky.social
"the awesome thing about cisco equipment is that they run forever", sending me uptime...

sec.cloudapps.cisco.com/security/cen...
Cisco Event Response: Continued Attacks Against Cisco Firewalls
sec.cloudapps.cisco.com
September 26, 2025 at 7:33 PM
Reposted by kurt baumgartner
josephcox.bsky.social
New: 404 Media is suing ICE. We have filed a lawsuit demanding ICE release its $2 million contract with Paragon, a company that makes powerful spyware to break into phones and read encrypted messages. This is expensive for a small outlet but this info is important
www.404media.co/were-suing-i...
We’re Suing ICE for Its $2 Million Spyware Contract
404 Media has filed a lawsuit against ICE for access to its contract with Paragon, a company that sells powerful spyware for breaking into phones and accessing encrypted messaging apps.
www.404media.co
September 22, 2025 at 4:26 PM
Reposted by kurt baumgartner
pwnallthethings.bsky.social
A Cyberattack on Jaguar Land Rover Is Causing a Supply Chain Disaster www.wired.com/story/jlr-ja...
A Cyberattack on Jaguar Land Rover Is Causing a Supply Chain Disaster
The UK-based automaker has been forced to stop vehicle production as a result of the attack—costing JLR tens of millions of dollars and forcing its parts suppliers to lay off workers.
www.wired.com
September 22, 2025 at 11:09 PM
kurtisj.bsky.social
Jubair is charged with computer fraud conspiracy, two counts of computer fraud, wire fraud conspiracy, two counts of wire fraud, and money laundering conspiracy. If convicted, he faces a maximum penalty of 95 years in prison

www.justice.gov/opa/pr/unite...
United Kingdom National Charged in Connection with Multiple Cyber Attacks, Including on Critical Infrastructure
A complaint filed in the District of New Jersey was unsealed today charging Thalha Jubair, a United Kingdom national, with conspiracies to commit computer fraud, wire fraud, and money laundering, in r...
www.justice.gov
September 19, 2025 at 12:26 PM
Reposted by kurt baumgartner
theonion.com
Congress Plays Keep-Away With Child’s School Lunch
Congress Plays Keep-Away With Child’s School Lunch
WASHINGTON—After entering a school cafeteria in D.C. and wrenching a brown paper bag from the hands of a small child, U.S. senators and representatives taunted a 7-year-old student and played keep-awa...
theonion.com
September 8, 2025 at 4:00 PM
Reposted by kurt baumgartner
theonion.com
Rudy Giuliani Awarded Presidential Medal Of Incest
Rudy Giuliani Awarded Presidential Medal Of Incest
WASHINGTON—Lauded as a generational advocate for sexual contact between relatives, former New York City mayor and man who married his cousin Rudy Giuliani was awarded the Presidential Medal of Incest ...
theonion.com
September 7, 2025 at 4:00 PM
kurtisj.bsky.social
"about a billion downloads prior"
September 8, 2025 at 5:06 PM
kurtisj.bsky.social
Fahrenheit 45
malwarejake.bsky.social Jake Williams @malwarejake.bsky.social · Sep 8
Slightly diminish a book

20 Feet Under the Sea.
thepacketrat.net Sean Gallagher @thepacketrat.net · Sep 8
Slightly diminish a book

The Hitchhiker’s Guide to the Solar System
September 8, 2025 at 5:47 AM
kurtisj.bsky.social
Eaton Corp employee convicted for deploying malicious code
www.justice.gov/usao-ndoh/pr...
Chinese National Sentenced to Prison for Deploying Destructive Computer Code on Ohio-based Company’s Global Network
A Chinese national who inflicted severe damage to the computer network systems of a global corporation where he was formerly employed has been sentenced to prison.
www.justice.gov
September 2, 2025 at 6:38 PM
Reposted by kurt baumgartner
cyberwarcon.bsky.social
CYBERWARCON is coming!!! Registration and CFP are now open for this year's #CYBERWARCON! This year's keynote speaker will be @dmitri.silverado.org!!
We are back in Arlington, VA this year on November 19th.

www.cyberwarcon.com
CYBERWARCON
www.cyberwarcon.com
August 28, 2025 at 5:35 PM
Reposted by kurt baumgartner
cyberwarcon.bsky.social
August 28, 2025 at 5:10 PM
kurtisj.bsky.social
this anthropic report goes into great depth in its reporting, and is not avoiding tough discussion of claude misuse...
including, heh, "vibe hacking"

www-cdn.anthropic.com/b2a76c6f6992...
www-cdn.anthropic.com
August 27, 2025 at 7:02 PM
Reposted by kurt baumgartner
briankrebs.infosec.exchange.ap.brid.gy
A 20-year-old Florida man at the center of a prolific cybercrime group known as “Scattered Spider” was sentenced to 10 years in federal prison today, and ordered to pay roughly $13 million in restitution to victims.

Noah Michael Urban of Palm Coast, Fla […]

[Original post on infosec.exchange]
A Twitter posts from Urban today around the time of his sentencing shows a cat with its back against the wall slumped forward in a dejected splayed pose. The tweet directly before that one just says "fuckfuckfuckfuckfuckfuck" A mugshot of then 19-year-old Noah Michael Urban. He has brown hair, combed over the right side of his face. He is somewhat unshaven and wearing a green t-shirt.
August 21, 2025 at 2:48 AM