Antonio Cocomazzi @splinter_code
offensive security - windows internals | BlueSky: https://t.co/ytvJCoaF2c | Mastodon: https://t.co/hNIHa6L14d splintercod3.blogspot.com Italy Joined August 2016-
Tweets2K
-
Followers9K
-
Following324
-
Likes3K
> A new Project Zero blog post by James Forshaw projectzero.google/2026/02/gphfh-… Me: Oh hey, I recognize this function! UIAccess + GetProcessHandleFromHwnd / NtUserGetWindowProcessHandle were the core of my CVE-2021-31951 EoP 😋 So some fixes leading to v3 actually date a bit earlier
@decoder_it breaks down reflection attacks and their impact on enterprise security in this new talk at #INSO26. Are you interested in how modern authentication flow works? So this talk is for you! Save your spot: ow.ly/cCr450Ykak4 #Infosec #INSO26 #CyberConference
Just dropped a short post on why some classic NTLM relay tricks seems to be dead on Server 2025. decoder.cloud/2026/02/25/wha…
Just published a summary of "modern" Windows authentication reflection attacks. Turns out reflection never really died. 😅decoder.cloud/2025/11/24/ref…
Blog post about my recent CVE-2025-58726, aka “The Ghost Reflection” is out, read it here: semperis.com/blog/exploitin… 🙃
Remember the CredMarshalInfo trick? If you hadn’t applied the June 2025 patch, CVE-2025-33073 would have been critical. We know that in NTLM local auth, msg 3 is empty:You can drop sign/seal -> from Domain User to DomainAdmin escalation. 😅
my simple poc: github.com/decoder-it/pri…
Coercing machine authentication on Windows 11 /2025 using the MS-PRN/PrinterBug DCERPC edition, since named pipes are no longer used. Kerberos fails in this case due to a bad SPN from the spooler, forcing NTLM fallback.
Better socket handle visibility coming soon to @SystemInformer 🔥 When viewing a process handle table, SI will recognize files under \Device\Afd and retrieve information about their state, protocol, addresses, and more. Also works on Bluetooth and Hyper-V sockets 🤩
Apply here → sentinelone.com/jobs/?gh_jid=6… Happy to chat if you want to learn more.
The role is opened in multiple locations in Europe (we’re hiring across Italy, Spain, Poland, Czech Republic, Slovakia and France), with optional relocation support to Czechia if you'd prefer to move (must be eligible to work in the EU already at the time of applying).
I’m hiring Staff Windows Security Researchers to join my XAT (eXploits and Anti-Tampering) team at @SentinelOne! 🔥 👉 sentinelone.com/jobs/?gh_jid=6… More details 👇
In my long history of submissions, I think this is the first time one has been marked as critical😅
Another Monday. Another week of… endless emails, annoying meetings, and oh look, a three-headed monkey behind you! Now that we have your attention, we can unveil the agenda for #RomHack2025 romhack.io/romhack-confer… #infosec #securityconference
I just published a blog post where I try to explain and demystify Kerberos relay attacks. I hope it’s a good and comprehensive starting point for anyone looking to learn more about this topic. ➡️decoder.cloud/2025/04/24/fro…
Microsoft has discovered post-compromise exploitation of CVE 2025-29824, a zero-day elevation of privilege vulnerability in Windows Common Log File System (CLFS), against a small number of targets. msft.it/6019qIVV9
NTLM relay is still a major threat and is now even easier to abuse. We just added new NTLM relay edges to BloodHound to help defenders fix and attackers think in graphs. Read my detailed post - the most comprehensive guide on NTLM relay & the new edges: ghst.ly/4lv3E31
We (me + @2igosha) have discovered a new Google Chrome 0-day that is being used in targeted attacks to deliver sophisticated spyware 🔥🔥🔥. It was just fixed as CVE-2025-2783 and we are revealing the first details about it and “Operation ForumTroll” securelist.com/operation-foru…
Check out our new blog post!
🍎🚨🕵️♂️ The notoriously elusive macOS malware, ReaderUpdate, is back — stealthier than ever. @philofishal and @syrion89 uncover how ReaderUpdate Reforged blends Go, Crystal, Nim, and Rust into a potent mix. 📄 This new research from SentinelOne exposes how these new variants are
vx-underground @vxunderground
455K Followers 386 Following The largest collection of malware source code, samples, and papers on the internet. Password: infected
Florian Roth ⚡️ @cyb3rops
225K Followers 3K Following Head of Research @nextronsystems #DFIR #YARA #Sigma | detection engineer | creator of @thor_scanner, Aurora, Sigma, LOKI, YARA-Forge | always busy ⌚️🐇 | vi/vim
Justin Elze @HackingLZ
74K Followers 5K Following CTO @TrustedSec | Former Optiv/SecureWorks/Accuvant Labs/Redspin | Race cars
chompie @chompie1337
91K Followers 1K Following hacker, exploit developer/weird machine mechanic head of X-Force Offensive Research (XOR) @IBM
Grzegorz Tworek @0gtweet
39K Followers 2K Following My own research, unless stated otherwise. Not necessarily "safe when taken as directed". GIT d- s+: a+ C++++ !U !L !M w++++$ b++++ G-
Adam Chester 🏴�... @_xpn_
40K Followers 560 Following TRACE at @SpecterOps | Blog at https://t.co/tjfTOllCEu
Oliver Lyak @ly4k_
9K Followers 268 Following Yet another security researcher 🔦 Github: https://t.co/7WFOFz17KI
mgeeky | Mariusz Bana... @mariuszbit
15K Followers 1K Following 🔴 Offensive Security Developer @ Outflank, Red Team operator, ex-AV dev, ex- malware researcher 🫖 Green tea lover
sn🥶vvcr💥sh @snovvcrash
12K Followers 492 Following Sr. Penetration Tester / Red Team Operator @ptswarm :: Author of the Pentester’s Promiscuous Notebook :: He/him :: Tweets’re my pwn 🐣
Andrea P @decoder_it
9K Followers 323 Following Security Consultant @semperistech . Independent Security Researcher. Cyclist & Scubadiver. MSRC MVR 2022. "So di non sapere"
an0n @an0n_r0
14K Followers 734 Following CRT(E|O|L) | OSCP | @RingZer0_CTF 1st (for 2yrs) | HackTheBox Top10 | RPISEC MBE | Flare-On completer | GoogleCTF writeup winner | SSD research | Math MSc |🇭🇺
Josh @passthehashbrwn
10K Followers 294 Following Adversarial Simulation at IBM, tweets are mine etc.
Filip Dragovic @filip_dragovic
8K Followers 1K Following My research unless stated otherwise. My opinions are my own and do not represent the views of my employer. Red Team @MDSecLabs
Will Dormann is on Ma... @wdormann
27K Followers 1K Following I play with vulnerabilities and exploits. I used to be here on Twitter but now I'm here: @[email protected] https://t.co/hXggdAVkSQ
Yarden Shafir @yarden_shafir
27K Followers 332 Following A circus artist with a visual studio license
n00py @n00py1
14K Followers 966 Following Retweeter of InfoSec/Offsec/Pentest/Red Team. Occasional blogger/Independent security research.
Edwin @EdwinBeecroft
0 Followers 68 Following
Daniel Novaes @HolyGraylIntel
0 Followers 74 Following
𝙷𝚊𝚙𝚙𝚢�... @HappyQQ_AI
21K Followers 19K Following 为 AI 飞速发展助力，打造 AI 相关的好用的软件平台， 为实现财务自由而努力。 爱读书、爱分享、有大爱 💖之心。 公众号：移动互联网。 微信号：HappyQQ_AI。(商务洽谈合作专用，交朋友点👇的链接) 纯AI技术交流请添加Discord社区：https://t.co/yNQuB0qs24
B33k33p33r @b33k33p33r
16 Followers 2K Following Mors certa, Vita incerta Liberal en lo economico, autista en lo social
Hu Uhha @HuUhha67265
0 Followers 74 Following
CL @maybeCLD
1 Followers 56 Following
Alex @sil3n70bs3rv3r
1 Followers 24 Following
Habib @_habib_313_
33 Followers 38 Following
0x27A8D @0x27A8D
33 Followers 1K Following You either die an Arch user or you live long enough to see yourself BECOME a MacOS user
Poor4ΞvΞr.docx.exe @0xPoor4ever
397 Followers 985 Following Noob/Script kiddie/Smart Contract Security Enthusiast
Cailloux @Cailloux968499
22 Followers 3K Following
0dgt @0dgt_
5 Followers 140 Following
wuji zhang @wujizha76522599
4 Followers 2K Following
Vermin @Verminctsp
0 Followers 65 Following
bill @billtill123321
4 Followers 109 Following
Eric @Ericddo_
2 Followers 817 Following
Cesar @kggcesar
3 Followers 943 Following
yifeng zheng @youdiscovered1t
5 Followers 241 Following
Roei Hadashi @roeihadashi
12 Followers 828 Following I break in for a living — and I'm the one they call after someone else did. Head of Red Team & AI Security @ HackersEye
RedDev Sec @redghosthive
298 Followers 6K Following FSW 🌐| Exploring Cloud ☁️ & Cybersecurity | Future DevSecOps Pro 🚀 | Bug Bounty Hunter on the side hustle 🐞 | Building skills, breaking barriers.
caverserinne @caverserinne
2 Followers 52 Following
secball @secondball419
10 Followers 116 Following started from the helpdesk now we here (we're at the helpdesk) i like boring malware and the Arsenal
Luckipy @luckipy
0 Followers 40 Following
Jão @joaocanestraro
120 Followers 435 Following
aye @Nurulyasoniq1
1 Followers 483 Following
0x1nf0s3c @0x1nf0
156 Followers 892 Following a WannaBeHacker suffering from duplicates and poor vulnerability disclosure policies from the vendors and maintainers.. fuck this shitty bio #EWPTx #CRTP
Dan @DanIskandarov
25 Followers 4K Following
Nadav Frenkel @NadavFrenkel
4 Followers 123 Following
Mehrdad @MehrdaDev
0 Followers 75 Following
bmate @bmatexz
14 Followers 11 Following
g0ldenCert @g0ldenCert
0 Followers 20 Following
Ahmed Mirahusain Alvi @Ahmeduke2
1 Followers 6 Following
Kevoenos @Kevoenos
1 Followers 31 Following
M Z @mrzhmud
16 Followers 573 Following
Daniel Bertoni @pikeredlabs
27 Followers 156 Following Co-Founder @ Pikered | Offensive Security Developer: C2 implants, Red Team tools & EDR evasion
Tom bucher @tom_bucher97103
1 Followers 27 Following
vx-underground @vxunderground
455K Followers 386 Following The largest collection of malware source code, samples, and papers on the internet. Password: infected
Florian Roth ⚡️ @cyb3rops
225K Followers 3K Following Head of Research @nextronsystems #DFIR #YARA #Sigma | detection engineer | creator of @thor_scanner, Aurora, Sigma, LOKI, YARA-Forge | always busy ⌚️🐇 | vi/vim
Justin Elze @HackingLZ
74K Followers 5K Following CTO @TrustedSec | Former Optiv/SecureWorks/Accuvant Labs/Redspin | Race cars
chompie @chompie1337
91K Followers 1K Following hacker, exploit developer/weird machine mechanic head of X-Force Offensive Research (XOR) @IBM
Grzegorz Tworek @0gtweet
39K Followers 2K Following My own research, unless stated otherwise. Not necessarily "safe when taken as directed". GIT d- s+: a+ C++++ !U !L !M w++++$ b++++ G-
Oliver Lyak @ly4k_
9K Followers 268 Following Yet another security researcher 🔦 Github: https://t.co/7WFOFz17KI
sn🥶vvcr💥sh @snovvcrash
12K Followers 492 Following Sr. Penetration Tester / Red Team Operator @ptswarm :: Author of the Pentester’s Promiscuous Notebook :: He/him :: Tweets’re my pwn 🐣
Andrea P @decoder_it
9K Followers 323 Following Security Consultant @semperistech . Independent Security Researcher. Cyclist & Scubadiver. MSRC MVR 2022. "So di non sapere"
an0n @an0n_r0
14K Followers 734 Following CRT(E|O|L) | OSCP | @RingZer0_CTF 1st (for 2yrs) | HackTheBox Top10 | RPISEC MBE | Flare-On completer | GoogleCTF writeup winner | SSD research | Math MSc |🇭🇺
Josh @passthehashbrwn
10K Followers 294 Following Adversarial Simulation at IBM, tweets are mine etc.
Filip Dragovic @filip_dragovic
8K Followers 1K Following My research unless stated otherwise. My opinions are my own and do not represent the views of my employer. Red Team @MDSecLabs
Will Dormann is on Ma... @wdormann
27K Followers 1K Following I play with vulnerabilities and exploits. I used to be here on Twitter but now I'm here: @[email protected] https://t.co/hXggdAVkSQ
Yarden Shafir @yarden_shafir
27K Followers 332 Following A circus artist with a visual studio license
x86matthew @x86matthew
23K Followers 206 Following system emulation / reverse-engineering / binary analysis. @the_secret_club
Dirk-jan @_dirkjan
30K Followers 208 Following Hacker at @OutsiderSec. Researches AD and Azure (AD) security. Likes to play around with Python and write tools that make work easier.
Dr. Nestori Syynimaa @DrAzureAD
21K Followers 2K Following Principal Identity Security Researcher at Microsoft. Ex-Secureworks. (MSc, MEng, PhD, CITP, CCSK). And yes, opinions are my own ;)
Marcello @byt3bl33d3r
30K Followers 1K Following CyBeRsEcUrItY | Not afraid to put down with some THICC malware on disk | AI Research @PaloAltoNtwks | former purple team | Ex @spacex
Haifei Li @HaifeiLi
9K Followers 151 Following For contact in the security community. NOTE: All the tweets are totally my personal opinions, not about any of my current employer stuff.
Ács Dávid @acsdavid97
34 Followers 393 Following Computer Science student, interested in all things Red & Blue team.
Koby Kahane @kobyk
123 Followers 263 Following
Josh Stroschein | The... @jstrosch
12K Followers 1K Following Reverse engineer and content creater | 😱 1M+ views on YT | 🎙️ Host of Behind the Binary podcast 👇
Luigi Martire @luigi_martire94
731 Followers 555 Following Malware Analyst, Threat Researcher, Cyber Security Addicted. Opinions are my own.
Polymarket @Polymarket
2.0M Followers 6K Following The World's Largest Prediction Market. Trade politics, news, crypto, sports, & more. Available in the US: https://t.co/gZvEnIqUQy - DM @PolymarketHelp for support
Clement Rouault @hakril
1K Followers 530 Following Python (ab)user / Security / Windows internals / @ExaTrack
mr.d0x @mrd0x
45K Followers 301 Following Security researcher | Co-founder https://t.co/QxBlzp9A8w | https://t.co/zqMXQRZjQN | https://t.co/Fq7WSqTBva | https://t.co/eKezFcO6nd
Johnathan Norman @spoofyroot
4K Followers 333 Following Security research and engineering lead at @microsoft. on mastodon: https://t.co/YfJkktByFv and @spoofy.bsky.social not posting here anymore.
SinSinology @SinSinology
13K Followers 778 Following Pwn2Own 20{22,23,24*2,25*3,26*3}, i look for 0-Days but i find N-Days & i chase oranges 🍊
Raffaele Sabato @syrion89
586 Followers 649 Following macOS Detection Engineer at @SentinelOne. Offensive Security, Malware, Reverse Engineering and Apple Security. Opinions are my own. @syrion89.bsky.social
Justin @br0k3ns0und
2K Followers 977 Following detection engineering | security research | agent shepherding | @ S1, former @elastic/@elasticseclabs @endgameinc etc. | lifts
Nick Powers @zyn3rgy
2K Followers 269 Following Adversary Simulation @SpecterOps | Previously @Rapid7 & @Protiviti
sixtyvividtails @sixtyvividtails
4K Followers 399 Following Currently working as an independent GUID merchant. Fully licensed. I acquire, produce, and sell high-quality GUIDs.
Panos Gkatziroulis �... @ipurple
27K Followers 824 Following Red/Purple Teamer | Blogger | Mod @ https://t.co/f4RyUGl0zb | https://t.co/nLrzzAcQw9
Vaclav Kotyk @vaclavkotyk
197 Followers 1K Following 🕵🏼♂️🌐Tech communities & Cyber talent sourcing by day 👨🏼💻Returning to my geek roots by night 📚🏌🏼♂️🏞️🥃☕📈🎮🎲 In my free time | Opinions are my own
Alice Climent @AliceCliment
3K Followers 280 Following Malware and EDR stuff @harfanglab 🤓 || PTC || Sister of @h313n_0f_t0r & @lauriewired
crazy hugsy @_hugsy_
4K Followers 939 Following == ReadOnly account == OffSec dev • exploit dev • kernel • hypervisor GH: hugsy Discord: hugsy#0766 BS: @blah.cat MS: [email protected]
Andrew Thompson @ImposeCost
42K Followers 2K Following SVP of Adversary Operations @GreyNoiseIO. Former @USMC and @Mandiant. There's no finish line in security.
Dennis @DennisF
6K Followers 1K Following ΣΧ, co-founder of @DecipherSec. New novel BE GONE available NOW: https://t.co/bVFJcL9PdF. Worst-selling author. Friend of hackers. @duosec forever.
Securityblog @Securityblog
12K Followers 14K Following There are 10 types of people in the world. Those who understand binary, and those who don't. All opinions and views are my own. #BsidesDub organizer
Bruce Dang @brucedang
5K Followers 1K Following Sweeping the floor at https://t.co/CM8ErzxC5z (we are hiring). Previously at Microsoft/Veramine/Apple. author of Practical Reverse Engineering.
🤷♂️ @floesen_
2K Followers 99 Following
Brent Murphy @brent_murphy
831 Followers 682 Following detection engineering @sentinelone | former @todylsecurity @elastic @endgameinc | oscp | cissp | news @blueteamsec1
Satoshi Tanda @standa_t
8K Followers 396 Following Software security engineer and trainer https://t.co/tenaquooTc
Worawit Wang @sleepya_
2K Followers 39 Following
Michele Campa @s1ckb017
1K Followers 461 Following VR at @XI_Research - my opinions are my own and do not represent the views of my employer
Security BSides Pragu... @bsidesprg
607 Followers 226 Following Annual community-driven information security conference
Boris Larin @oct0xor
19K Followers 729 Following Former console hacker (PS3/PS4). Hunting in the wild 0-days at Kaspersky GReAT. All tweets are my own.
Cedric Van Bockhaven @c3c
1K Followers 363 Following
Alon Leviev @alon_leviev
2K Followers 202 Following Senior Vulnerability Researcher at @Microsoft | Brazilian Jiu Jitsu athlete turned cyber security researcher
Tim McGuffin @NotMedic
6K Followers 2K Following Back to Red Teaming. Risk Hunter. DEFCON Staff & CFP Board. MS in DF. Fmr Fire/EMS. Red and Blue. Builder. Morally Flexible. https://t.co/zakkIXf6x2 @ bluesky
System Informer @SystemInformer
725 Followers 1 Following A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions
Vulnlab @vulnlab_eu
6K Followers 1K Following Labs & Training by @xct_de | You are welcome to join the community @ https://t.co/p5R9zGJYHw Vulnlab is now part of Hack The Box.
Jared Atkinson @jaredcatkinson
10K Followers 2K Following | CTO @specterops | Host @dcpthepodcast | Ex PowerShell MVP | USAF Vet | FC Bayern Supporter | Language Learner 🇳🇴 🇮🇹 🇧🇷 |
Geiseric @Geiseric4
922 Followers 170 Following AD/Azure Enthusiast | eCPPTv2 | CRTP | CRTO | CRTE | CRTM | CARTP | CARTE https://t.co/yYy84cNFPwYou might like
