Pinned Tweet
How the NSA (Equation Group) allegedly hacked into China's Polytechnical University 👀
I analysed intelligence reports from Chinese cyber firms (360, Pangu, CVERC) to aggregate TTPs attributed to Equation Group.
🔗inversecos.com/2025/02/an-ins…
I analysed intelligence reports from Chinese cyber firms (360, Pangu, CVERC) to aggregate TTPs attributed to Equation Group.
🔗inversecos.com/2025/02/an-ins…
43
410
1,910
429,861
NEW XINTRA COURSE!!!🥳
Windows Kernel: Offensive, Defensive & Reverse Engineering by @Idov31
xintra.org/courses/11-win…
Build an EDR and rootkits from scratch while mastering the Windows kernel.
Over 70 videos and labs covering:
> Build your own EDR (detection + prevention)
> Rootkits &> Reversing Windows kernel & drivers
> Kernel callbacks, ETW, minifilter and more
There are preview videos too if you wanna see some snippets of the course content ;)
This course is instructed by Ido Veltzman (@Idov31), a senior security researcher specializing in reverse engineering, operating system internals, vulnerability research, and exploit development.
His work spans UEFI, hypervisors, kernel, and user mode, where he has developed advanced evasion, persistence, and injection techniques.
@XintraOrg
Windows Kernel: Offensive, Defensive & Reverse Engineering by @Idov31
xintra.org/courses/11-win…
Build an EDR and rootkits from scratch while mastering the Windows kernel.
Over 70 videos and labs covering:
> Build your own EDR (detection + prevention)
> Rootkits &> Reversing Windows kernel & drivers
> Kernel callbacks, ETW, minifilter and more
There are preview videos too if you wanna see some snippets of the course content ;)
This course is instructed by Ido Veltzman (@Idov31), a senior security researcher specializing in reverse engineering, operating system internals, vulnerability research, and exploit development.
His work spans UEFI, hypervisors, kernel, and user mode, where he has developed advanced evasion, persistence, and injection techniques.
@XintraOrg
6
68
390
48,661
Chinese spies have infiltrated Stanford University
> spies use fake Stanford pics on social media
> target students studying military ops / AI
> build trust and pressure them to move onto Wechat
> pressures students to "fly to China"
> suspected phone compromise ...
details of them knowing thk screenshots and pressuring them to delete it
Stanford has received $64 million in anonymous Chinese funding since 2010
srcs
nypost.com/2026/03/26/us-…
Stanford Review
stanfordreview.org/investigation-…
Stanford Funding
stanfordreview.org/stanford-chine…
> spies use fake Stanford pics on social media
> target students studying military ops / AI
> build trust and pressure them to move onto Wechat
> pressures students to "fly to China"
> suspected phone compromise ...
details of them knowing thk screenshots and pressuring them to delete it
Stanford has received $64 million in anonymous Chinese funding since 2010
srcs
nypost.com/2026/03/26/us-…
Stanford Review
stanfordreview.org/investigation-…
Stanford Funding
stanfordreview.org/stanford-chine…
36
141
423
43,846
NEW LAB: NavalTech Defense Contractor ⚓
We emulated a North Korean (DPRK) cyber espionage campaign targeting a submarine contractor’s vessel-tracking systems.
Based on CISA’s reporting on DPRK operations to advance military and nuclear programs.
Contributors
@django88_
Solve it here 👇
xintra.org
We emulated a North Korean (DPRK) cyber espionage campaign targeting a submarine contractor’s vessel-tracking systems.
Based on CISA’s reporting on DPRK operations to advance military and nuclear programs.
Contributors
@django88_
Solve it here 👇
xintra.org
5
31
176
19,158
Modeled on adversary tactics attributed to the Democratic People’s Republic of Korea (DPRK) based on the following CISA report <3
cisa.gov/sites/default/…
cisa.gov/sites/default/…
1
3
41
8,490
What separates Chinese cyber ops from Five Eyes?
Three things that shifted my thinking about this topic:
1. Early cyber training (90s-2000s) happened on live targets.
Not sandboxes, not simulations...actual foreign infrastructure. The "practice" was the operation. Operational errors caught during IR back then weren't failures of tradecraft... they were the cost of learning on production.
2. The private sector operates as APT infrastructure.
Cybersecurity companies founded by former 2000s hackers (Topsec, i-SOON, Integrity Tech) were later publicly linked to state-directed operations. The line between "legitimate vendor" and "APT contractor" is deliberately blurred (by design).
3. Operators don't stay siloed in their APT group.
They rotate across teams for decades, carrying often the exact same tools, tactics with them. What we label as "different APT groups" is often the same people with different hats.
This makes attribution way messier than the tidy narrative we see in threat reports.
Worth reading this epic report published by the Zurich Centre for Security Studies if this stuff keeps you up at night:
ethz.ch/content/dam/et…
Three things that shifted my thinking about this topic:
1. Early cyber training (90s-2000s) happened on live targets.
Not sandboxes, not simulations...actual foreign infrastructure. The "practice" was the operation. Operational errors caught during IR back then weren't failures of tradecraft... they were the cost of learning on production.
2. The private sector operates as APT infrastructure.
Cybersecurity companies founded by former 2000s hackers (Topsec, i-SOON, Integrity Tech) were later publicly linked to state-directed operations. The line between "legitimate vendor" and "APT contractor" is deliberately blurred (by design).
3. Operators don't stay siloed in their APT group.
They rotate across teams for decades, carrying often the exact same tools, tactics with them. What we label as "different APT groups" is often the same people with different hats.
This makes attribution way messier than the tidy narrative we see in threat reports.
Worth reading this epic report published by the Zurich Centre for Security Studies if this stuff keeps you up at night:
ethz.ch/content/dam/et…
17
151
801
113,770
NEW LAB: APT40 Ivanti Exploitation
APT40 (Chinese Hainan State Security Department) targets the Department of Trade and Finance of Meow Islands by exploiting a vulnerable Ivanti appliance.
The investigation involves:
🔸Ivanti Connect Secure exploitation
🔸Appliance filesystem to internal pivoting
🔸Sideloading through trusted antivirus binaries
Enterprise "LIVE" customers receive full RDP access to all appliances and devices involved in the investigation.
Contributors
Adversarial Emulation @ZephrFish
Incident Response @svch0st
Solve it here xintra.org
APT40 (Chinese Hainan State Security Department) targets the Department of Trade and Finance of Meow Islands by exploiting a vulnerable Ivanti appliance.
The investigation involves:
🔸Ivanti Connect Secure exploitation
🔸Appliance filesystem to internal pivoting
🔸Sideloading through trusted antivirus binaries
Enterprise "LIVE" customers receive full RDP access to all appliances and devices involved in the investigation.
Contributors
Adversarial Emulation @ZephrFish
Incident Response @svch0st
Solve it here xintra.org
9
41
194
32,291
This simulation is a targeted cyber intrusion against the Department of Trade and Finance (DoTF) of the Southeast Asian nation, Meow Islands.
Modelled on known tactics of APT40, the scenario begins with the exploitation of a vulnerable Ivanti Connect Secure appliance, leading mpromise of government infrastructure.
Modelled on known tactics of APT40, the scenario begins with the exploitation of a vulnerable Ivanti Connect Secure appliance, leading mpromise of government infrastructure.
3
3
28
7,253
The first AI driven APT espionage campaign has just happened. 🤯
This Anthropic report is a huge turning point for our industry. It’s the first publicly known AI led espionage campaign by an APT group.
They ran intrusion chains at machine speed and breaching around 30 lly. Around 80 to 90 percent of the operation was handled autonomously, with humans only stepping in for the final pieces.
There were limits though. The AI made mistakes, occasionally hallucinated credentials, and needed human steering for about 10 to 20 percent of the work. But the ceiling is rising fast.
This happened in September 2025. It will keep happening. The next era of cyber will be humans defending against machines.
Manual detection and manual threat hunting will fall behind. We need AI supported defence and safe environments to understand and train against machine speed threats.
Unfortunately for whatever reasons Anthropic did not release any TTPs or any IOCs for us. 💀 so I’m off here just imagining what the intrusions could’ve been like …
assets.anthropic.com/m/ec212e6566a0…
This Anthropic report is a huge turning point for our industry. It’s the first publicly known AI led espionage campaign by an APT group.
They ran intrusion chains at machine speed and breaching around 30 lly. Around 80 to 90 percent of the operation was handled autonomously, with humans only stepping in for the final pieces.
There were limits though. The AI made mistakes, occasionally hallucinated credentials, and needed human steering for about 10 to 20 percent of the work. But the ceiling is rising fast.
This happened in September 2025. It will keep happening. The next era of cyber will be humans defending against machines.
Manual detection and manual threat hunting will fall behind. We need AI supported defence and safe environments to understand and train against machine speed threats.
Unfortunately for whatever reasons Anthropic did not release any TTPs or any IOCs for us. 💀 so I’m off here just imagining what the intrusions could’ve been like …
assets.anthropic.com/m/ec212e6566a0…
15
53
260
31,089
The next decade of cyber conflict will decide how the world operates.
If you want to work on technology that defines the future and makes real impact, come build it with us @XintraOrg
xintra.org/jobs
If you want to work on technology that defines the future and makes real impact, come build it with us @XintraOrg
xintra.org/jobs
8
18
138
20,884
New XINTRA course‼️
Advanced IIS Post Exploitation, Detection & Evasion
Modern APT groups are actively weaponizing ToolShell and fileless IIS tradecraft to compromise Exchange, SharePoint, ASP workloads.
If your detection and response capabilities lag exposure, this course bridmory dump analysis (Windbg)
- Deserialisation exploits & detections
- ViewState attacks
- .NET Reflection
- Deobfuscation techniques
Syllabus and preview videos here👇
xintra.org/courses/9-adva…
@XintraOrg
Advanced IIS Post Exploitation, Detection & Evasion
Modern APT groups are actively weaponizing ToolShell and fileless IIS tradecraft to compromise Exchange, SharePoint, ASP workloads.
If your detection and response capabilities lag exposure, this course bridmory dump analysis (Windbg)
- Deserialisation exploits & detections
- ViewState attacks
- .NET Reflection
- Deobfuscation techniques
Syllabus and preview videos here👇
xintra.org/courses/9-adva…
@XintraOrg
2
33
253
31,420
This course is instructed by Adrian Justice @Zeroedtech, who has performed IR at Crowdstrike and at the Australian Cyber Security Centre (ACSC) for the government.
He has extensive experience responding to APT compromises of government departments and critical infrastructure related compromises.
One piece of notable work in his career was his work in the infamous Copy-Paste compromises conducted by alleged Chinese APT groups
cyber.gov.au/sites/default/…
He has extensive experience responding to APT compromises of government departments and critical infrastructure related compromises.
One piece of notable work in his career was his work in the infamous Copy-Paste compromises conducted by alleged Chinese APT groups
cyber.gov.au/sites/default/…
0
1
21
7,568
cover letters are basically corporate fan fiction
tf you supposed to write 😩
“Nothing excites me more than logging into Entra ID…”
tf you supposed to write 😩
“Nothing excites me more than logging into Entra ID…”
48
33
723
40,558
NEW LAB: Scattered Spider (UNC3944) 🕷️🕸️
Scattered Spider hits indie studio AB Projekt Blue, deploying ransomware and stealing unreleased game code.
Test your skills on:
👀 Social Engineering & MFA Fatigue
👀 Credential Theft via OST Files
👀 Bring Your Own Vulnerable Driver (BYO👀 Custom Ransomware Binary
👀 RMM Exploitation
Lab Contributors
Adversarial Emulation @q8fawazo
Incident Response @r3nzsec
Threat Intelligence @CuratedIntel
Solve it here 👉 xintra.org
@XintraOrg
Scattered Spider hits indie studio AB Projekt Blue, deploying ransomware and stealing unreleased game code.
Test your skills on:
👀 Social Engineering & MFA Fatigue
👀 Credential Theft via OST Files
👀 Bring Your Own Vulnerable Driver (BYO👀 Custom Ransomware Binary
👀 RMM Exploitation
Lab Contributors
Adversarial Emulation @q8fawazo
Incident Response @r3nzsec
Threat Intelligence @CuratedIntel
Solve it here 👉 xintra.org
@XintraOrg
13
84
509
72,475
We based the entire story of the lab on CD Projekt Red compromise but updated ALL of the TTPs to use the latest techniques Scattered Spider uses 😉 this lab took a few iterations to get perfect. We hope you enjoy it <3
Here's the infected network you're investigating.
cyble.com/blog/cd-projek…
Here's the infected network you're investigating.
cyble.com/blog/cd-projek…
0
3
39
7,759
inversecos retweeted
✅ initial access achieved
disk 11: @inversecos
we psyop’d the one and only @inversecos! such a beautiful mammal inside and out; infectiously happy and joyful, i’m genuinely so glad i got to meet you not once but twice! 🖤🖤🖤
disk 11: @inversecos
we psyop’d the one and only @inversecos! such a beautiful mammal inside and out; infectiously happy and joyful, i’m genuinely so glad i got to meet you not once but twice! 🖤🖤🖤
4
7
151
15,094
ur girls at defcon so if u want @XintraOrg waifu & egirl stickers just come thru 🫶🏼
13
8
252
24,192
