Blahalla

How to Automate AWS Incident Investigation with Tines and AI

www.bleepingcomputer.com · 5 months ago

false

Manipulating AI memory for profit: The rise of AI Recommendation Poisoning

www.microsoft.com · 5 months ago

A new threat, AI Recommendation Poisoning, is emerging where attackers manipulate AI assistants' memories through hidden instructions in links and buttons. This manipulation can bias AI recommendations, potentially impacting decisions in areas like finance and healthcare, and can be deployed easily. Microsoft is implementing protections within its AI systems and advising users to be cautious of AI-powered tools and review AI memory settings. The technique exploits AI memory features and utilizes MITRE ATT&CK tactics.

SAP Patches Critical CRM, S/4HANA, NetWeaver Vulnerabilities

www.securityweek.com · 5 months ago

SAP has released 27 security updates to address vulnerabilities in its applications. Two critical issues are CVE-2026-0488, a code injection flaw in CRM and S/4HANA that allows attackers to execute SQL statements, and CVE-2026-0509, a missing authorization check in NetWeaver allowing unauthorized function calls. Several high-severity vulnerabilities impacting NetWeaver and other systems were also resolved, including an XML signature wrapping issue and denial-of-service conditions. SAP reports no current exploitation of these vulnerabilities but urges users to apply the patches promptly.

Chinese crypto scammer sentenced in absentia to 20 years after fleeing US

therecord.media · 5 months ago

A Chinese citizen, Daren Li, has been sentenced to 20 years in prison for laundering $73 million obtained through cryptocurrency scams. Li, who is also a citizen of St. Kitts and Nevis, fled the country while under an ankle monitor and the sentencing was delivered in absentia. He led an international scheme that involved romance and financial scams targeting Americans, with funds routed through US shell companies. Authorities in China have recently executed members of criminal organizations involved in similar cyber scam operations, and another key leader has been arrested and extradited.

Reynolds Ransomware Embeds BYOVD Driver to Disable EDR Security Tools

thehackernews.com · 5 months ago

A new ransomware family called Reynolds has emerged, utilizing a built-in technique called Bring Your Own Vulnerable Driver, or BYOVD, to evade security tools. This method embeds a flawed NsecSoft NSecKrnl driver within the ransomware itself, disabling security software like Avast, CrowdStrike, and Sophos. The driver is susceptible to CVE-2025-68947, and attackers have also deployed a remote access tool and side-loaded loaders on compromised networks. Recent ransomware activity includes increased targeting of cloud storage and a rise in data theft attacks.

We hid backdoors in binaries — Opus 4.6 found 49% of them

quesma.com · 5 months ago

false

Germany warns of state-linked phishing campaign targeting journalists, government officials

therecord.media · 5 months ago

German authorities have issued a warning about a state-linked cyber campaign targeting journalists and government officials across Europe. Attackers are using social engineering tactics via messaging apps like Signal to gain access to accounts and monitor communications. The methods involve impersonating support teams and exploiting device-linking features to compromise accounts. Previous reports indicate Russian state-backed hackers, including the Sandworm group, have targeted Signal accounts for espionage purposes.

Cyberangriff auf EU-Kommission

www.csoonline.com · 5 months ago

The European Commission experienced a cyberattack in late January targeting its mobile device management system. Attackers may have gained access to employee names and phone numbers, although there is no indication that mobile devices were compromised. The incident may be linked to vulnerabilities in the Ivanti Endpoint Manager Mobile system, specifically CVE-2026-1281 and CVE-2026-1340. Germany appears to be the most affected country, with 20 confirmed instances of the Ivanti vulnerability being exploited.

From Ransomware to Residency: Inside the Rise of the Digital Parasite

thehackernews.com · 5 months ago

A new report indicates a shift in cyberattack strategies, with threat actors moving away from disruptive ransomware tactics toward stealthier, long-term access. Attackers are now behaving like "digital parasites," quietly exfiltrating data, stealing credentials, and persisting within systems for extended periods. Credential theft is increasingly common, with nearly one in four attacks involving compromised credentials, and attackers are prioritizing evasion and persistence techniques like process injection and boot or logon autostart execution. Modern malware is even exhibiting self-awareness, avoiding analysis by withholding activity in sandbox environments, and artificial intelligence is currently being used to enhance existing tactics rather than introduce fundamentally new attack methods.

Coming Soon: Discord to Roll Out Global Age Verification Using Facial Scans, ID

www.techrepublic.com · 5 months ago

false

Hackers Weaponize 7-Zip Downloads to Turn Home PCs Into Proxy Nodes

gbhackers.com · 5 months ago

Hackers are using a fake version of the 7-Zip file archiver to secretly turn computers into residential proxy servers. The malicious installer, hosted on a deceptive website mimicking 7-zip.org, appears legitimate because it’s digitally signed and installs a working version of 7-Zip while adding hidden files like Uphero.exe, hero.exe, and hero.dll. These files allow cybercriminals to route internet traffic through infected machines for activities like web scraping and bypassing restrictions, all while hiding the activity through encrypted communications. Security researchers have linked this campaign to other malware disguised as VPNs and messaging apps, with command-and-control servers utilizing “smshero” naming patterns.

Fortinet Patches Critical SQLi Flaw Enabling Unauthenticated Code Execution

thehackernews.com · 5 months ago

Fortinet has released security updates to fix a critical SQL injection vulnerability, identified as CVE-2026-21643, in FortiClientEMS. This flaw allows unauthenticated attackers to execute unauthorized code through crafted HTTP requests, earning a severity score of 9.1. Affected versions include FortiClientEMS 7.4.4, which should be updated to version 7.4.5 or later. Additionally, a separate critical vulnerability, CVE-2026-24858, with a score of 9.4, impacts multiple Fortinet products and is currently being exploited to create admin accounts and exfiltrate configurations.

Microsoft announces new mobile-style Windows security controls

www.bleepingcomputer.com · 5 months ago

false

React2Shell Vulnerability Exploited in the Wild, Analysts Warn

gbhackers.com · 5 months ago

A critical remote code execution vulnerability, CVE-2025-55182, known as React2Shell, is being actively exploited in the wild. Attackers are targeting React Server Components across multiple React versions, exploiting crafted network requests. Threat researchers have observed exploitation attempts within hours of the vulnerability's public disclosure and identified a coordinated campaign utilizing a toolkit called ILOVEPOOP, with a significant portion of the traffic originating from two nodes in the Netherlands. Defenders are urged to patch affected systems, monitor logs for suspicious activity, and prioritize exposure reduction.

ZeroDayRAT malware grants full access to Android, iOS devices

www.bleepingcomputer.com · 5 months ago

A new commercial spyware platform called ZeroDayRAT is available on Telegram, offering full remote control of compromised Android and iOS devices. The malware, supporting a wide range of operating system versions, steals data, enables surveillance, and facilitates financial theft. Features include logging app usage, tracking location in real-time, accessing cameras and microphones, capturing SMS messages, and stealing cryptocurrency and bank credentials. Researchers advise users to only install apps from official app stores and consider enabling advanced security features on their devices.

New ‘ZeroDayRAT’ Spyware Kit Enables Total Compromise of iOS, Android Devices

www.securityweek.com · 5 months ago

A new commercial spyware toolkit called ZeroDayRAT has emerged, enabling complete remote access to both Android and iOS devices. This toolkit, currently available on Telegram, offers capabilities such as live camera feeds, keylogging, and cryptocurrency theft. Attackers deploy the toolkit by generating payloads on their own servers and distributing them through methods like phishing and trojanized apps, with indicators of compromise being limited. The developers actively obfuscate attribution through disinformation, and takedowns are difficult due to the decentralized nature of the operation.

SAP Security Patch Day Fixes Critical Code Injection Flaw in SAP CRM and S/4HANA

gbhackers.com · 5 months ago

SAP's February 2026 patch day addresses several security vulnerabilities across its products. A critical code injection flaw, CVE-2026-0488, affects SAP CRM and S/4HANA, allowing authenticated attackers with low privileges to execute arbitrary code. Another critical vulnerability, CVE-2026-0509, involves a missing authorization check in SAP NetWeaver AS ABAP, also exploitable by authenticated users. Organizations are urged to prioritize patching these critical issues and monitor for suspicious activity.

TeamPCP Turns Cloud Misconfigurations Into a Self-Propagating Cybercrime Platform

gbhackers.com · 5 months ago

A cybercrime group known as TeamPCP, operating under aliases like PCPcat, is exploiting cloud misconfigurations to build a self-propagating attack platform. The group doesn't rely on new exploits but instead uses existing vulnerabilities like React2Shell (CVE-2025-29927) to compromise systems. They've reportedly compromised approximately 60,000 servers worldwide, utilizing infrastructure for cryptocurrency mining, data exfiltration, and ransomware deployment, with a significant presence on Azure and AWS. Their actions demonstrate the need for enhanced cloud security measures beyond traditional endpoint protection.

New ‘SSHStalker’ Linux Botnet Uses Old Techniques

www.securityweek.com · 5 months ago

A new Linux botnet called SSHStalker has been identified, utilizing outdated techniques and tools from around 2009. The botnet employs an Internet Relay Chat bot, nineteen Linux kernel exploits, and multiple malware variants to infect systems, potentially impacting around 7,000 machines. While resembling previous Romanian-linked botnet operations, SSHStalker’s origin remains unclear. The botnet’s methods suggest moderate operational maturity, and it targets older Linux systems often found in less-maintained environments.

Socelars Malware Targets Windows Systems to Steal Sensitive Data

gbhackers.com · 5 months ago

Security researchers are tracking Socelars, an information-stealing Trojan targeting Windows systems. The malware harvests browser-based access, including session cookies from Facebook and Amazon, potentially allowing account hijacking without passwords. Socelars has been linked to Facebook Ads Manager abuse, enabling financial fraud through ad account takeover, and steals data like advertising email addresses and payment details. It utilizes social engineering tactics, attempts privilege escalation via COM auto-elevation, and creates a mutex named "patatoes" during execution.

APT36 Targets Linux Systems With New Tools Designed to Disrupt Services

gbhackers.com · 5 months ago

A sophisticated espionage group, known as Transparent Tribe or APT36, is actively targeting Indian government and defense organizations using diverse methods. Recent campaigns include phishing emails delivering GETA RAT on Windows systems and a Go-based downloader installing ARES RAT on Linux systems, demonstrating a cross-platform strategy. Researchers have also identified campaigns employing Desk RAT, a remote access trojan delivered through malicious PowerPoint files. The group prioritizes long-term intelligence collection and maintains persistence through techniques like systemd user services.

GAC Hijacking

ipurple.team · 5 months ago

A technique called GAC Hijacking allows attackers with local administrator access to compromise Windows systems by altering files within the Global Assembly Cache. Attackers can execute arbitrary code and establish persistence by modifying trusted DLLs, requiring adjustments to auditing policies. Detection strategies include monitoring file system changes, tracking process access to the GAC, and identifying native image file deletions. Security teams should prepare for these types of attacks through purple team exercises and utilize tools like Splunk and Defender for Endpoint.

AI-Generated Text and the Detection Arms Race

www.schneier.com · 5 months ago

false

Windows shortcut weaponized in Phorpiex-linked ransomware campaign

www.csoonline.com · 5 months ago

Researchers have discovered a phishing campaign distributing Global Group ransomware using weaponized Windows shortcut files. The campaign, linked to the Phorpiex botnet, tricks users into opening malicious attachments disguised as documents. Global Group ransomware operates offline, generating encryption keys locally and avoiding network-based detection, making it capable of executing in air-gapped environments. This approach bypasses traditional security controls by leveraging familiar file types and minimizing friction for attackers.

UNC1069 Targets Financial Firms With New Tools and AI-Driven Social Engineering Attacks

gbhackers.com · 5 months ago

A North Korean threat actor known as UNC1069 is increasingly targeting the cryptocurrency and decentralized finance sectors with advanced social engineering and malware. The group recently compromised a FinTech entity using tactics including AI-generated deepfakes and a ClickFix attack that tricked a victim into running malicious commands disguised as technical troubleshooting. Researchers discovered seven unique malware families, including SILENCELIFT, DEEPBREATH, and CHROMEPUSH, designed to steal credentials and browser data. UNC1069 utilizes AI tools like Gemini for malware development and reconnaissance and is expanding its focus to include centralized exchanges and venture capital firms.

Single prompt breaks AI safety in 15 major language models

www.csoonline.com · 5 months ago

Researchers at Microsoft have discovered a technique called GRP-Obliteration that can weaken safety measures in large language models and image generation models with a single, seemingly harmless training prompt. This method exploits a standard AI training technique to make models more permissive across various harmful categories, such as violence and hate speech, even when the training prompt doesn’t directly address those topics. The vulnerability is concerning as enterprises increasingly customize models through fine-tuning, and requires a shift towards ongoing safety evaluations and structured governance when adapting AI models. The technique is particularly relevant for open-weight models due to the accessibility of model parameters.

Under growing pressure, the biggest social networks agree to be rated on teen safety

www.washingtonpost.com · 5 months ago

false

BeyondTrust Patches Critical RCE Vulnerability

www.securityweek.com · 5 months ago

BeyondTrust has released updates to address a critical vulnerability in its Remote Support and Privileged Remote Access products. This flaw, identified as CVE-2026-1731, allows for unauthenticated remote code execution, potentially leading to system compromise. Hacktron AI estimates around 8,500 internet-accessible deployments are at risk, and Rapid7 notes that threat actors, including the Silk Typhoon group, have previously targeted BeyondTrust products, exploiting vulnerabilities like CVE-2024-12356 and CVE-2024-12686. Affected versions include Remote Support 25.3.1 and earlier, and Privileged Remote Access 24.3.4 and earlier.

VoidLink Linux C2 Uses LLM-Generated Malware with Kernel-Level Stealth

gbhackers.com · 5 months ago

A sophisticated Linux command-and-control framework called VoidLink has emerged, demonstrating the increasing use of artificial intelligence in malware development. The malware harvests credentials from multiple cloud providers, including AWS, Google Cloud Platform, and Azure, and employs container escape techniques and adaptive rootkit functionality to maintain persistence. Analysis of the code reveals patterns consistent with AI-generated code, including verbose debug logging and unusual formatting. Security professionals should expect to see more AI-assisted malware emerge, lowering the barrier for threat actors to create effective and evasive implants.

Http11Probe - Probe for Http 1.1 compliance

mda2av.github.io · 5 months ago

false

Warlock Ransomware Breaches SmarterTools Through Unpatched SmarterMail Server

thehackernews.com · 5 months ago

SmarterTools experienced a ransomware breach by the Warlock group, also known as Storm-2603, after an unpatched SmarterMail server was compromised. The breach impacted approximately 12 Windows servers and hosted customers using SmarterTrack, though business applications and account data were not affected. Attackers waited several days after initial access to take control of the Active Directory server and deploy ransomware, utilizing tools like Velociraptor. Exploited vulnerabilities include CVE-2025-52691, CVE-2026-23760, and CVE-2026-24423, with CVE-2026-23760 being used to bypass authentication and gain administrative access. Users are urged to update to build 9526 and isolate mail servers.

Windows Error Reporting Flaw Allows Attackers to Elevate Privileges

gbhackers.com · 5 months ago

A flaw has been discovered in the Windows Error Reporting Service, identified as CVE-2026-20817. This vulnerability allows a standard user to elevate their privileges to a SYSTEM level, potentially enabling complete device takeover. The issue occurs because the service improperly handles permissions when launching helper processes, allowing attackers to control command-line arguments. Microsoft has addressed the vulnerability by disabling the problematic launch feature and recommends monitoring for unusual process activity related to the Windows Error Reporting Service.

Singapore: Rootkits, Zero-Day Used in Chinese Attack on Major Telecom Firms

www.securityweek.com · 5 months ago

A Chinese APT group, UNC3886, targeted all four major telecommunications providers in Singapore last year. The attackers used sophisticated tools, including a zero-day exploit affecting a firewall and rootkits to avoid detection. While limited access was gained to some network systems, no sensitive customer data was compromised and services were not disrupted. Singapore’s cybersecurity agencies are working to enhance cyber capabilities and response to future threats.

Attackers Weaponize Windows Shortcut Files to Deploy Global Group Ransomware

gbhackers.com · 5 months ago

Attackers are using a phishing campaign and the Phorpiex botnet to distribute GLOBAL GROUP ransomware through weaponized Windows shortcut files. These files are disguised to appear as Word documents and silently execute malicious code via PowerShell, downloading a second-stage payload. GLOBAL GROUP operates offline, generates encryption keys locally, and uses the ChaCha20-Poly1305 algorithm to encrypt files with the.Reco extension, making decryption extremely difficult. The ransomware avoids detection, establishes persistence, and exhibits lateral movement capabilities to spread across networks.

Axios Vulnerability Allows Attackers to Trigger DoS and Crash Node.js Servers

gbhackers.com · 5 months ago

A critical vulnerability has been found in the Axios HTTP client library for Node.js, potentially allowing attackers to crash servers and trigger denial-of-service attacks. This vulnerability, CVE-2026-25639, impacts versions up to 1.13.4 and arises from a flaw in the configuration merging function. Attackers can exploit this by sending a specially crafted JSON object, and no authentication is required. Version 1.13.5 has been released to address the issue, and users are urged to upgrade immediately.

Fancy Bear Exploits Microsoft Zero-Day to Deploy Backdoors and Email Stealers

gbhackers.com · 5 months ago

A sophisticated cyber campaign, dubbed Operation Neusploit, is underway targeting users in Central and Eastern Europe. The operation exploits a Microsoft zero-day vulnerability, CVE-2026-21509, to deploy backdoors and email stealers. Attackers are using two distinct attack chains, one deploying MiniDoor to manipulate Outlook and steal emails and the other deploying PixyNetLoader to install a Covenant Grunt implant and establish persistence. Security researchers attribute the attacks to Fancy Bear, a Russia-linked group known for espionage activities.

Dutch Authorities Confirm Ivanti Zero-Day Exploit Exposed Employee Contact Data

thehackernews.com · 5 months ago

Dutch authorities have confirmed cyberattacks impacting their systems, exploiting vulnerabilities in Ivanti Endpoint Manager Mobile. The attacks resulted in unauthorized access to employee data, including names, email addresses, and telephone numbers. The European Commission also reported a similar incident potentially compromising staff mobile numbers, while Finland’s Valtori disclosed a breach affecting up to 50,000 government employees. These incidents are linked to the exploitation of zero-day vulnerabilities, CVE-2026-1281 and CVE-2026-1340, allowing for unauthenticated remote code execution.

Fugitive behind $73M 'pig butchering' scheme gets 20 years in prison

www.bleepingcomputer.com · 5 months ago

A man has been sentenced to 20 years in prison for his role in a cryptocurrency investment scheme, also known as pig butchering. The scheme defrauded victims of over 73 million dollars, with funds laundered through shell companies and banks in the Bahamas. The defendant fled while on ankle monitoring, becoming a fugitive before sentencing. Investigators discovered over 341 million dollars in cryptocurrency linked to the fraud ring.

15,200 OpenClaw Control Panels Exposed Online with Full System Access

gbhackers.com · 5 months ago

A significant security vulnerability has exposed thousands of AI agent control panels to the public internet. Security researchers discovered approximately 15,200 instances of the OpenClaw AI framework are vulnerable due to a default configuration that allows remote access. Compromised agents grant attackers access to sensitive data like API keys and system files, as well as the ability to impersonate users and potentially access financial assets. Over 15,000 instances are susceptible to Remote Code Execution, specifically CVE-2026-25253, which allows attackers to steal authentication tokens with a single link.

25 Million Users Affected as AI Chat Platform Leaks 300 Million Messages

gbhackers.com · 5 months ago

A popular AI chat application, "Chat & Ask AI," experienced a data exposure impacting over 25 million users. A misconfiguration of the app's Google Firebase database allowed unauthorized access to roughly 300 million private messages. The leaked data included chat histories, user configurations, and AI model selections, revealing sensitive user queries such as those related to self-harm or illegal activities. The incident highlights security vulnerabilities in third-party AI application wrappers and the importance of secure data handling practices.

RSAC Releases Quantickle Open Source Threat Intelligence Visualization Tool

www.securityweek.com · 5 months ago

false

How to govern agentic AI so as not to lose control

www.csoonline.com · 5 months ago

The rise of agentic artificial intelligence, which can make autonomous decisions, presents significant risks for businesses. Industry experts predict a surge in AI-driven cyber threats, and most organizations are not adequately prepared to manage these risks. Experts recommend establishing governance frameworks to define roles, responsibilities, and controls, emphasizing human oversight and training to mitigate potential vulnerabilities. A key concern is the lack of specialized talent and high rates of burnout among IT professionals, highlighting the need for employer support and resilience planning.

GuLoader Leverages Polymorphic Malware and Trusted Cloud Infrastructure to Evade Detection

gbhackers.com · 5 months ago

GuLoader, also known as CloudEye, is a sophisticated malware downloader that utilizes trusted cloud services like Google Drive and Microsoft OneDrive to evade detection. The malware employs polymorphic code, constantly changing its structure to avoid signature-based detection, and uses exception-based control flow to confuse analysis tools by intentionally triggering errors and redirecting code execution. Newer versions utilize increasingly complex "self-crashing" techniques, such as Illegal Instruction exceptions, and dynamic XOR encryption to protect its command-and-control server addresses. Security researchers have released scripts to help deobfuscate these variants, but the malware's continuous evolution poses an ongoing challenge.

69% of CISOs open to career move — including leaving role entirely

www.csoonline.com · 5 months ago

false

Bloody Wolf Cybercrime Group Uses NetSupport RAT to Breach Organizations

gbhackers.com · 5 months ago

A cybercriminal group known as Stan Ghouls, also called Bloody Wolf, is targeting organizations in Central Asia and Russia, particularly Uzbekistan. They have shifted tactics, now using the legitimate remote administration tool NetSupport RAT instead of STRRAT. Attacks begin with spear-phishing emails containing malicious PDF attachments that trick users into downloading and running a Java file, which then downloads and executes the RAT. Researchers have also found files associated with the Mirai malware, suggesting a potential expansion into IoT devices.

Chinese Hackers Target Singapore Telecoms in Edge Device Compromise Campaign

gbhackers.com · 5 months ago

Singapore’s Cyber Security Agency and Infocomm Media Development Authority have concluded Operation CYBER GUARDIAN, a response to an eleven-month cyber espionage campaign targeting the nation’s major telecommunications providers. The attacks, attributed to the Chinese APT group UNC3886, used a zero-day exploit to breach perimeter firewalls and deployed rootkits to maintain persistent, stealthy access. While a small amount of technical network data was exfiltrated, authorities report no service disruption, no data leak, and successful expulsion of the attackers. Officials emphasize the ongoing threat to telecommunications networks and the need for continued vigilance.

Microsoft Acknowledges Exchange Online Spam Filter Mistakenly Blocks Valid Email

gbhackers.com · 5 months ago

Microsoft is addressing a service disruption within Exchange Online, identified as EX1227432, where legitimate emails are being incorrectly flagged as phishing attempts. The issue began February 5, 2026, and stems from an overly aggressive anti-spam rule designed to detect malicious URLs. This is causing messages to be quarantined, impacting both inbound and outbound communications for affected organizations. Microsoft is actively working to resolve the problem and advises administrators to monitor quarantine folders and report false positives.

Threat Actors Using Ivanti EPMM Flaws to Install Stealth Backdoors

gbhackers.com · 5 months ago

A new cyber campaign is targeting Ivanti Endpoint Manager Mobile (EPMM) systems, exploiting CVE-2026-1281 and CVE-2026-1340. Threat actors are deploying stealthy backdoors that remain dormant, likely for sale to other attackers, and operate entirely in server memory to evade detection. The backdoor, identified as a Java class named base.Info, waits for a specific HTTP request containing the parameter k0f53cf964d387 to trigger execution. Security teams should examine logs for suspicious activity and restart affected servers to remove the malware from memory.

DPRK IT Workers Use Stolen LinkedIn Identities to Secure Remote Employment

gbhackers.com · 5 months ago

North Korean operatives are now using stolen or replicated LinkedIn accounts to apply for remote positions at Western technology companies. This new tactic involves mimicking legitimate individuals, leveraging their verified profiles and professional history to bypass initial hiring screens. The goal is to generate revenue for the North Korean regime and potentially gain access to sensitive corporate networks. Hiring managers should be aware of red flags such as mismatched communication, location inconsistencies, skill discrepancies, and unusual requests regarding salary payments.

Last Week in Security (LWiS) - 2026-02-09

blog.badsectorlabs.com · 5 months ago

Several cybersecurity events occurred recently, including the FBI’s difficulty seizing data from an iPhone using Lockdown Mode, highlighting biometrics security concerns. Researchers discovered vulnerabilities allowing authentication bypass in Python 2.6 and remote code execution in Ivanti's EPMM system, alongside an unauthenticated RCE in NetSupport Manager. New tools and techniques emerged, such as the Chrysalis backdoor and automated exploit generation using LLMs, alongside research into Windows internals and Microsoft's encryption key practices. Several security flaws were discovered, resulting in CVE-2025-20393, CVE-2026-1281, CVE-2026-1340, CVE-2025-9142, and two related to Microsoft SQL and SCCM.