Patrick Fussell (@capt_red_beardz) header
Patrick Fussell (@capt_red_beardz) profile picture

Head of Adversary Simulation at IBM X-Force. (https://xitter.gq/t.co/sWYyRku71U). Opinions are my own.

Roanoke, VA
Joined March 2009
Photo by Patrick Fussell (@capt_red_beardz)Photo by Patrick Fussell (@capt_red_beardz)Photo by Patrick Fussell (@capt_red_beardz)Photo by Patrick Fussell (@capt_red_beardz)Photo by Patrick Fussell (@capt_red_beardz)Photo by Patrick Fussell (@capt_red_beardz)Photo by Patrick Fussell (@capt_red_beardz)Photo by Patrick Fussell (@capt_red_beardz)Photo by Patrick Fussell (@capt_red_beardz)Photo by Patrick Fussell (@capt_red_beardz)
Patrick Fussell retweeted
The only way to stop hackers from hacking you is to hire hackers to hack you before the hackers you didn’t hire hack you
52
155
16
911
46,329
Patrick Fussell retweeted
I’ve been grinding hard on AI for the better part of the last 8+ months - learning, building, adapting, and pulling late nights just like so many others right now. Cutting through the FUD and hype, there is real potential here. Industry-breaking potential. The era we’ve been waiting for - to finally supercharge and develop the tools and platforms we’ve wanted to build for years - is here, and agent assistance is accelerating everything. With coding agents, I’ve built solid tools and had research breakthroughs that would have taken weeks or months before. These should feel like real wins worth celebrating. But honestly? I don’t feel victorious. In many ways, it just feels necessary to keep pace. As Dave said: adapt or be left behind - and for good reason. I’m not ready to be left behind. But damn, I’m tired. I’m tired of constantly reinventing myself. Tired of constantly re-tooling. Tired of the endless cycle of keeping up, the late nights, and the personal sacrifices that come with it. I’ve even lost the desire to share knowledge and research with the community the way I used to. From the conversations I’ve had, I’m far from alone - many others in this space feel the same but don’t necessarily vocalize it outside of smaller circles. Is it because I see AI purely as a threat? Not really. The offensive side of our industry has been heading this way for a while, and I’ve been moving with it. The truth is, the excitement Dave describes is real - but for me right now, it’s mixed with exhaustion. I’m grateful for the breakthroughs, yet I catch myself wondering how long I can sustain this level of constant reinvention without something giving. The early-2000s energy is back, sure… but so is the burnout that often came with it. Being a bit older now, with young kids at home, the pace hits differently. I don’t have the same endless energy I once did, and the late nights and constant context-switching carry a heavier weight. Finding balance is tough, but it feels more important than ever. Hopefully we can all figure out how to ride this wave more sustainably - without burning out in the process.
What I see in cybersecurity: AI has re-invigorated an industry that was largely stale for the past ten years. Complete new green field. Changes everything. New innovation happening everyday. Need to adapt or be left behind. This reminds me of the early 2000s, it’s exciting, addicting, and it’s going to be fun as hell.
23
54
6
375
47,920
Patrick Fussell retweeted
Watch XOR’s talk CUDA de Grâce: Owning AI Cloud Infrastructure with GPU exploits Kernel + driver bugs aren’t just a LPE problem, they’re a cloud problem. With the explosion of AI in the cloud, NVIDIA’s GPU drivers have become a valuable attack surface youtu.be/Lvz2_ZHj3lo
5
72
3
295
53,055
Looking for an experienced red teamer. Hit me up if you have any questions.
If you're into serious red teaming with a crazy skilled team we've got a US based opening! ibmglobal.avature.net/en_US/…
1
2
8
1,819
Just noticed this is listed as hybrid but is totally remote
1
101
Any Canadian friends with strong red team backgrounds looking for an AdvSim spot? ibmglobal.avature.net/en_US/…
1
12
1
41
19,171
Patrick Fussell retweeted
Ever been on an SCCM site server and *this* close to a DA pw that you couldn't decrypt for some reason? Check out my new blog looking at encryption in use within SCCM sites configured for High Availability and accompanying tooling to recover passwords: ibm.com/think/x-force/decryp…
3
57
1
137
14,987
Offensive AI Con time!
1
1
34
2,587
Patrick Fussell retweeted
Redtreat was a blast this year, I lost count of the amount of 0days dropped. Massive respect to all the speakers
2
32
2,874
Patrick Fussell retweeted
Azure Arc is Microsoft's solution for managing on-premises systems in hybrid environments. My new blog covers how it can it be identified in an enterprise and misconfigurations that could allow it to be used for out-of-band execution and persistence. ibm.com/think/x-force/identi…
7
83
1
185
24,374
Patrick Fussell retweeted
New research just dropped I'll be presenting at @WEareTROOPERS next week - Attacking ML Training Infrastructure 💥 Model poisoning for code execution ⚠️ Abusing ML workflows ⚙️ MLOKit updates and new threat hunting rules ibm.com/think/x-force/becomi…
2
34
1
91
22,089
Worked on a simple POC last night for connecting Mythic up to LiteLLM (pointing to Claude) for riding shotgun on a C2 session. Only using shell cmd, but provides oversight and hints to potential paths to explore. Quite happy for a weekend project :D youtu.be/C9J5okm6cA4
6
33
3
175
36,382
Patrick Fussell retweeted
Me and the homies are dropping browser exploits on the red team engagement 😎. Find out how to bypass WDAC + execute native shellcode using this one weird trick -- exploiting the V8 engine of a vulnerable trusted application. ibm.com/think/x-force/operat…
23
234
6
787
137,159
Patrick Fussell retweeted
New blog from me on using CLR customizations to improve the OPSEC of your .NET execution harness. This includes a novel AMSI bypass that I identified in 2023. By taking control of CLR assembly loads, we can load assemblies from memory with no AMSI scan. securityintelligence.com/x-f…
13
146
5
419
55,492
Patrick Fussell retweeted
I am hiring for several Offensive AI Researchers, focused on offensive use of AI. careers.ibm.com/job/20939619… Come join an amazing team and help us supercharge our extensive capabilities with AI and automation! Requirements: - Experience with iterative multi-stage offensive tasking and targeting workflows leveraging DAG or similar - Demonstrated experience using and creating offensive agents which support shifting towards a Human-on-the-Loop approach for offensive tasks that are good candidates for automation - Experience evaluating AI models and creating test harnesses for offensive use - Experience with training, testing, and optimizing machine learning models using frameworks such as Optuna or otherwise - Experience with Model Evasion, Extraction, Inversion, Poisoning attacks as well as LLM Prompt Injection - Experience with enterprise data lakes, relational/vector databases, complex data structures and data analysis tools, offensive data schema development and format conversations - 5+ years of adversary tradecraft industry experience
6
46
6
130
65,140
We are so stoked to have you!
Last week, I joined the IBM @XForce Adversary Simulation team. I am excited and grateful to work with such an incredibly talented group. Cheers to new adventures!
1
5
982
Patrick Fussell retweeted
I’m excited to share that I’ve joined IBM’s @XForce Adversary Simulation team. Eager to dive into new challenges and collaborate with some of the industry’s brightest minds. Looking forward to the new adventure!
26
20
1
209
21,925
If you don’t have this in your toolkit you are missing out. Great read @h4wkst3r !!!
Today I am releasing a whitepaper and new tool (ADOKit) as part of my @XForce research I will be presenting at @BlackHatEvents #BHEU on Wednesday. Links are below 🔗 Whitepaper: ibm.com/downloads/cas/5JKAPV… Tool: github.com/xforcered/ADOKit
1
6
1,022
Patrick Fussell retweeted
Like the opsec of NightHawk but missing Aggressor-like scripting functionality? Check out DayBird, an extension I built for NightHawk to allow for automation of operator workflows and initial check-in actions via C# plugins. b:securityintelligence.com/x-f… gh:github.com/xforcered/DayBird
8
54
4
140
42,665