Boris Larin

We analyzed the Coruna exploit kit and found intriguing code overlaps with Operation Triangulation https://securelist.com/coruna-framework-updated-operation-triangulation-exploit/119228/

The root cause of the Chrome 0-day logical vulnerability CVE-2025-2783, which we discovered used in attacks with sophisticated malware, also affects the Firefox! New CVE-2025-2857 has just been fixed in Firefox 136.0.4 https://www.mozilla.org/en-US/security/advisories/mfsa2025-19/

The HackingTeam is back! New name, new malware, new exploits https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/

We have discovered a new Google Chrome 0-day that is being used in targeted attacks to deliver sophisticated spyware 🔥🔥🔥. It was just fixed as CVE-2025-2783 and we are revealing the first details about it and “Operation ForumTroll” https://securelist.com/operation-forumtroll/115989/

I'm getting dopamine from this guy /cc @opa334@infosec.exchange

I don't know what I feel more: amazement at how good these AI-generated images look, or disgust at the ethics and behavior of the people behind this technology.

We managed to find this 0-day twice! First as a description of a vulnerability, then as a real exploit used by attackers. https://securelist.com/cve-2024-30051/112618/

In Thailand, or more precisely in Patang in Phuket, a very crazy tourist place, on the way to the hospital with a suspected bone fracture, I realized what I hate the most - Songkran

@tiraniddo I guess this is what happened:

1. You created NtApiDotNet and used it in dozens of PoCs submitted to MSRC
2. Defender team was tasked with creating detection for your PoCs, and the easiest way was to detect the use of NtApiDotNet, since it was mainly used for exploitation?