TheoLens LowGeek: Biblical Reverse Engineering. Series 7: The Job Case Study.

Inside FortiBleed: Reverse Engineering the CyberStrike Harvester Behind a Global FortiGate Credential Factory

Arctic Wolf Labs reverse-engineered the CyberStrike Harvester v1.5 binary (a Go-based Linux ELF) used in the FortiBleed campaign — a large-scale credential compromise operation targeting internet-facing Fortinet FortiGate firewalls across 194 countries. The campaign operates as a closed-loop credential pipeline: credential stuffing and password spraying gain initial access, FortiGate configurations and traffic captures are exported, the CyberStrike Harvester parses pcap/pcapng/FortiGate text to extract NetNTLM, Kerberos, cookies, and cleartext credentials, a Telegram-bot-orchestrated Hashcat/Hashtopolis GPU cluster cracks hashes, and Impacket-based tools then perform AD enumeration, SMB validation, and DFS file-share exfiltration (one logged run collected 121 GB). The operators prioritize targets by revenue and geography. Attribution remains low-confidence Russian-speaking based on tool branding, an operator handle, and Russian-language UI strings. Remediation requires immediate session termination, credential rotation, MFA enforcement, and specific FortiOS password-policy steps to eliminate legacy SHA-256 hashes from configuration exports.

Hacking Amazon Echo Show 8 3rd Gen Via UART And EMMC

Một hacker phần cứng đã root và tái sử dụng Amazon Echo Show 8 3rd Gen bằng cách truy cập vật lý vào chip eMMC và các pad UART trên bo mạch chủ. Phương pháp này yêu cầu mở thiết bị, hàn dây mỏng vào eMMC và UART, sau đó sử dụng eMMC programmer để sửa đổi trực tiếp hệ thống, cho phép root FireOS hoặc thay thế firmware bằng Debian Linux. Quá trình phức tạp nhưng chứng minh thiết bị có thể được tận dụng ngoài mục đích ban đầu của Amazon.

Lập trình viên nên đọc bài này để khám phá cách mở rộng khả năng của thiết bị IoT thông minh bằng cách tận dụng kiến thức về firmware và hardware, giúp tạo ra giải pháp mở rộng hoặc tùy chỉnh hệ thống không giới hạn bởi các hạn chế của nhà sản xuất.

Documenting The IR Protocol Of The PumpSaver Plus Device

Elizabeth Camporeale reverse-engineered the undocumented infrared communication protocol used by the SymCom/Littelfuse PumpSaver Plus 233P pump monitor. The device uses a 5,000 baud NRZ, MSB-first IR protocol originally designed for a discontinued handheld display unit. The protocol is now fully documented on GitHub, along with a Python-based decoder and an ESPHome integration using an ESP32-C6 module and a phototransistor, enabling the pump monitor to be tied into broader home automation and monitoring systems.

Reverse Engineering And Self-Hosting The OBI Smart Energy Tracker

The OBI Energy Tracker is a €15 device pair sold by German DIY store OBI that reads electricity meters via IR and transmits data over 868 MHz LoRa to an ESP32-C3 gateway, which by default sends data to AWS via secure MQTT. Aaron Christophel reverse-engineered the gateway and documented two ways to self-host it locally: a no-flash reprovisioning method involving fetching the 32-bit TEA key, generating your own PKI, and running a local MQTTS broker with a provided Python script; and a custom firmware flash for the ESP32-C3, though UART/JTAG is disabled by the manufacturer. Both approaches and supporting code are available on GitHub, with accompanying English and German video walkthroughs.

Dive Into Malware Forensics: A Walkthrough of REMnux, The Redux

A walkthrough of the REMnux Linux-based malware analysis toolkit, structured around the TryHackMe MAL: REMnux — The Redux lab. Covers three core investigative phases: document and delivery vector analysis (malicious PDFs and Office macros using pdfid, pdf-parser, oletools/olevba), static binary inspection via entropy analysis to detect packed executables, and live memory forensics using Volatility to analyze a Jigsaw Ransomware-infected RAM dump. Includes an incident response triage checklist and highlights key REMnux utilities for each phase.

Cavern Manticore: Exposing Iran-Linked Modular C2 Framework

Check Point Research exposes Cavern Manticore, an Iran MOIS-linked APT group targeting Israeli IT providers and government organizations. The group uses a modular post-exploitation C2 framework called Cavern, built on .NET but deliberately compiled into three different binary formats (.NET Framework IL, Mixed-Mode C++/CLI, and .NET 8 NativeAOT) to force analysts into multiple toolchains. The framework deploys via SysAid software update abuse and DLL sideloading through a trojanized uxtheme.dll. Modules include file management with DPAPI decryption, SQL database browsing, LDAP/AD reconnaissance with brute-force, network recon with SMB credential spraying, and a SOCKS5/WebSocket tunnel. The communication module uses XOR-encrypted HTTPS and WebSocket transport. The research details reverse engineering techniques for NativeAOT binaries, including a ported IDA Pro plugin. Human authorship fingerprints include profanity-laced debug strings, typos, and bespoke naming conventions. The framework evolved from an older 'Cav3rn' monolithic design and is linked to the OilRig subgroup Lyceum based on infrastructure, targeting patterns, and TTP overlaps.

The Two-Minute Exploit: How AI Closed the Skills Gap for App Attackers

AI tools like LLMs have dramatically lowered the skill barrier for attacking mobile applications. A motivated attacker with no special credentials can now extract API endpoints from a mobile app binary in under two minutes. This compression affects both ends of the attacker spectrum: novices gain capability faster, and skilled attackers work faster. The resulting attacks are often invisible to server-side monitoring because extracted credentials produce traffic indistinguishable from legitimate users. Effective defense requires runtime detection inside the app itself, combined with hard-coded reactive consequences (not just alerts) such as step-up authentication or app shutdown. AI also helps defenders by automating app hardening configuration, reducing the window of exposure across release cycles. Proprietary obfuscation techniques create gaps that publicly available LLMs cannot bridge, giving defenders a structural advantage if they move quickly.