@_zero_q profile picture
Jan @_zero_q

- Security Researcher - Incident Responder - Lethal Forensicator - Reverse Engineering Enthusiast [Tweets are my own and not the views of my employer]

Joined June 2017
  • Tweets 594
  • Following 273
  • Followers 144
27 Photos and videos
Jan@_zero_q
Jun 11
Linking indicators from samples to campaigns and actors. #MalwareAnalysis #CTI
24
Jan@_zero_q
Jun 9
I am including some malware config extraction too: #MalwareAnalysis #CTI
37
Jan@_zero_q
Jun 8
Moving forward with my static analysis platform: #MalwareAnalysis #CTI
1
45
Jan retweeted
Antonio 's4tan' Parata@s4tan
Jun 6
new blog post: shrun, apiwatcher, and argus: three malware analysis tools built with Claude antonioparata.blogspot.com/2… #MalwareAnalysis #ReverseEngineering
6
14
706
Jan retweeted
Cyber_OSINT@Cyber_O51NT
Jun 6
Foresiet identified and analyzed Lucid Stealer, a Node.js SEA wrapper delivering a credential stealer and remote-access Trojan with persistence, wallet theft, keylogging, HVNC, and DDoS capabilities. foresiet.com/blog/lucid-stea…

lucid-stealer-malware-analysis-report

Foresiet Threat Intel analyzes the Lucid Stealer: a commercial Node.js info-stealer and RAT. Learn the infection chain, IOCs, and how to detect this threat.

foresiet.com
1
4
13
1,757
Jan retweeted
Laurent Cheylus@lcheylus
May 27
Benchmarking LLMs for Malware Triage and static Unpacking with Malcat (binary analysis software) #Infosec #Malware #LLM malcat.fr/blog/benchmarking-…

Benchmarking LLMs for malware triage and static unpacking with Malcat

Ever wondered which LLM model is the best to analyse malware? Well, we did, and put them to the test. By strapping 9 state-of-the-art large language models to Malcat's powerful MCP server, we made...

malcat.fr
1
2
2
146
Jan retweeted
Alex Matrosov
@matrosov
May 27
Follow every Mythos discovery through our coordinated vulnerability disclosure dashboard. red.anthropic.com/2026/cvd/
10
140
643
60,909
Jan@_zero_q
May 19
hmm what to do when machine thinks it knows better than me:
36
Jan@_zero_q
May 14
Just waiting for AI to include hidden advertisement in their responses, e.g. when asking for summary of incident response actions depending on LLM it will point out that it is best to use tool or service of a certain company 🤣
1
34
Jan@_zero_q
May 12
Fortinet warns of critical RCE flaws in FortiSandbox and FortiAuthenticator bleepingcomputer.com/news/se…

Fortinet warns of critical RCE flaws in FortiSandbox and FortiAuthenticator

Fortinet has released security patches for two critical vulnerabilities in FortiSandbox and FortiAuthenticator that could enable attackers to run commands or arbitrary code.

bleepingcomputer.com
1
1
37
Jan@_zero_q
May 12
Can someone run Mythos against Forti and Ivanti, so that we get that chapter closed once and for all
1
32
Jan@_zero_q
May 1
Running @opencode together with Selenium and Safari remote control to have the AI fix my JavaScript errors, so I can enjoy the sun 🤣
2
50
Jan@_zero_q
Apr 14
AI does not mean attackers generate better exploits. It means they generate better reasons to panic. Speed of patching replaces verification as the dominant safety signal.
1
41
Jan@_zero_q
Apr 6
I just wanted to update one library ... now I am running OCLP on my late 2013 mac with a clean install of Sonoma 🤣
1
96
Jan@_zero_q
Apr 3
Added capability overview based on imported API function:
1
53
Jan@_zero_q
Mar 31
Slowly getting to where I want it to be. If you have labelled samples for me to play with, let me know.
53
Jan retweeted
Mehmet Ergene
@Cyb3rMonk
Mar 28
github.com/Vigil-SOC/vigil

GitHub - Vigil-SOC/vigil: Vigil - an ever improving 100% OpenSource AI system for security

Vigil - an ever improving 100% OpenSource AI system for security - Vigil-SOC/vigil

github.com
13
92
6,951
Jan@_zero_q
Mar 21
Continued to play further with malware similarity: --- Top 1 Family Ranking for 1b357f661479 --- RANK 1: [ACCEPTED] Zeus | Weight: 144.5 REJECTED (Low Weight): PlugX | Weight: 19.7 REJECTED (Low Weight): PoisonIvy | Weight: 1.41 not perfect yet but we are getting there.
1
1
2
284
Jan@_zero_q
Mar 25
Btw. If you happen to have some labelled sample sets your willing to share please reach out.
21
Jan retweeted
Censys
@censysio
22 Dec 2025
🚨 A critical RCE vulnerability in certain versions of n8n allows an authenticated attacker to execute arbitrary code with the privileges of the n8n process. Exploitation could lead to full compromise of the affected instance. 🔴 CVSS 9.9 🛠️ Patch available — upgrade immediately. 👉 See full advisory for more details: hubs.ly/Q03YVn9L0 #cve202568613
4
58
208
22,046
Load more