Computer security and writing. But mostly I tweet about my kids.
El Cerrito, CA, USA
Joined July 2008
- Tweets40.7K
- Following2.8K
- Followers3.4K
- Likes32.3K
Me: blowing the interview by trying to not condescendingly clarify if the question is as dumb as I think, and doing it really condescendingly.
This quoted post is unavailable.
3
1,177
East-coast folks (Tysons, VA), Crogl, Inc. is putting on a super-affordable 1-day con.
5 hours+ hackathon - you’ll get the tools and the tokens. Strategies for automating your SOC. The future of the human-AI partnership in security.
Register here:
aisocsummit.com/
2
128
Whomever did the artwork for the Stranger Things series closer end credits did a fantastic job.
1
192
Ordered a couple. But just a reminder: If you make me fill out all my shipping and billing info manually before I can get to billing, but then let me check out with PayPal (which will give you all that), then I hate you.
Don't let holiday hackers feast on your accounts this season! 🦃 Thankfully, there's YubiKey. Protect your digital life (and your loved ones!) with the ultimate security upgrade.
💰 30% off YubiKey 5 NFC and 5C NFC
🛒 Shop the deal: yubico.com/us/store/2025/bla…
220
ryanlrussell retweeted
Even with patches provided with bug reports, AI makes too much human work in prioritizing & testing. Commercial closed source faces similar bottlenecks & diminishing security returns. Vuln handling can’t keep up even if using AI validation. Security is being DoSed by AI right now
Youngest son is prepping to move out post-marriage last week. He had asked for book recs at one point, and now wants to take them to read still. Grabbing a pic so I know which ones went out the door.
3
85
ryanlrussell retweeted
Hi @Steam why do you allow threat actors to utilise Steam account names to host C2 for their information stealers?
Some of these are here a while. Also, the C2 gets changed out every so often for a new one.
CC: @malwrhunterteam
Check out my latest article: How about we try some hunting? botw-ryanlrussell-19 linkedin.com/pulse/how-we-tr… via Wherein I've got a long list of malware-associated Steam accounts. s/o @Steam
Check out my latest article: Are you tired of .bat, .lnk, and .py files yet? botw-ryanlrussell-18 linkedin.com/pulse/you-tired… Wherein I think I've seen this threat actor before. s/o @ShanHolo
Check out my latest article: Shall I finally reveal the malicious Python payload? botw-ryanlrussell-17-part3 linkedin.com/pulse/shall-i-f… Ok, NOW I'm showing the deobfuscated inner Python code for the infostealer.
127
What do people do for hosting malware analysis work product, such as a deobfuscated sample? I DO see some on GitHub, but that seems like a bad long-term solution? Are the sample hosting sites cool with me posting a bundle of analysis work? @vxunderground @abuse_ch ?
3
2
2,206
And I'm pretty sure I don't want to just slap the whole sample in the middle of my LinkedIn article.
1
136
Well, to answer my own question, I guess I'm gonna try github: docs.github.com/en/site-poli… It's explicitly allowed to my surprise, and seems reasonable. They will take down/restrict if it's basically being used for active distribution.
92
Check out my latest article: Can I defeat the Python obfuscation? botw-ryanlrussell-17-part2 linkedin.com/pulse/can-i-def… Wherein I learn weird portions of Python. Payload reveal in next part, which should be up before too long.
80