Costin Raiu
@craiu
Followers
39K
Following
16K
Media
589
Statuses
10K
Cybersecurity researcher focused on threat intel & APTs. Breaking down attacks, hunting threats, and crafting YARA rules. 🛡️💻 #ThreatIntel #CTI #Crypto #YARA
Bucharest
Joined October 2007
The malicious JS deployed by Lazarus in the ByBit hack, 0/61 on VT.
Sample is now on VT! 🚩Hash: fbd5e3eb17ef62f2ecf7890108a3af9bcc229aaa51820a6e5ec08a56864d864d 🎯Actor name: Lazarus 🔹Comment: The Safe{Wallet} JavaScript used by Lazarus in the ByBit hack that was deployed Feb 19, 2025 17:29:05 and replaced with the original clean version
15
101
401
I’ve clustered these CharmingKitten BTC addresses into @arkham and identified some TXs with KYC exchanges like Binance, Coinbase, and Kraken. Some good leads for investigators here: https://t.co/bGEK1Dazvs
1
5
22
KittenBusters Episode 4 just dropped with some interesting credentials and IOCs ->
So… based on the episode 4 of the kittens leaks, are we now assuming Chaeming Kittens & Moses-staff are actually parts of the same group? Needs extra verification though, so don’t just blindly assume based on the leak. But if confirmed, this is an important piece of the leak and
0
0
20
#ChatControl is OFF the table for now. 💪 But the Danish Minister of Justice and chief architect of the current Chat Control proposal, Peter Hummelgaard, wants to bring it back in December. 😡 He now even claims your activism was paid for by Big Tech! 😡 Remember, this is the
36
237
897
Found ELF_PLEAD / SSHTD (aarch64) samples uploaded to VirusTotal in June 2025. Might be used for campaign in 2024. #BlackTech #APT #malware #iocs a653ae9e9906c0e5a5b5ba6330e10c9bb6b42e71abd6e80198eaa1386ea03cfb - Campaign Code: x240129-1 - C2: csp.fortinetline[.]com:443 (1/2)
1
12
60
The HackingTeam is back! New name, new malware, new exploits
securelist.com
Kaspersky researchers discovered previously unidentified commercial Dante spyware developed by Memento Labs (formerly Hacking Team) and linked it to the ForumTroll APT attacks.
5
105
333
Wow, so recording of my talk "Silent Killers: Unmasking a Large-Scale Legacy Driver Exploitation Campaign", presenting our @_CPResearch_ ( https://t.co/utX1IzrFZS) at #HackLu 2025 was already published 🤗: https://t.co/OCebCtt9kJ I'd like to thank @hack_lu organizers for one of
1
39
133
I’m presenting something interesting at @TheSAScon tomorrow! Large-scale malware database + code similarity = magic ✨
3
12
85
China releases 'UBIOS' standard to replace UEFI — Huawei-backed BIOS firmware replacement charges China's domestic computing goals
tomshardware.com
Support for chiplets, heterogeneous computing, and a step away from U.S.-based standards are key features of China's BIOS replacement.
30
144
564
New drop from the Three Buddy Problem: Apple’s iOS forensics freeze, WhatsApp zero-click, China outs NSA https://t.co/jhEOTQNcaO
2
26
131
The show is available on all platforms
pod.link
Listen to Three Buddy Problem wherever you get your podcasts!
New episode ALERT! @craiu @juanandres_gs We dig into news that Apple's iOS 26 has quietly killed the shutdown.log forensic artifact used to spot signs of infections and what it means for threat hunters. Plus, whispers of a million-dollar WhatsApp zero-click exploit that never
0
2
4
New episode ALERT! @craiu @juanandres_gs We dig into news that Apple's iOS 26 has quietly killed the shutdown.log forensic artifact used to spot signs of infections and what it means for threat hunters. Plus, whispers of a million-dollar WhatsApp zero-click exploit that never
securityconversations.com
Three Buddy Problem – Episode 69: We dig into news that Apple's iOS 26 has quietly killed the shutdown.log forensic artifact used to spot signs […]
1
7
17
Probably one of the biggest losses of US cyberweapons in years. 👇 All from private companies... ❓How were stolen capabilities used? ❓Were NSA etc ops burned? ❓Were they turned against Americans? Raises alarming questions about for-profit offensive sector's reliability.
NEW: The U.S. govt accused Peter Williams, ex general manager of hacking tool maker L3Harris Trenchant, of stealing trade secrets and selling them to buyer in Russia. Earlier this year Trenchant investigated a leak of internal tools. It's unclear if the investigation is related.
6
80
240
This significantly changes the context of the “iOS Vuln dev hacked!” story. It is a clear national security issue, with exploits sold to the U.S. being resold to Russia. Both Russia and the U.S. (e.g. FBI) would have legitimate reasons to investigate the suspected leaker.
7
34
141
It’s been a pleasure working side by side with @julien_c and the @huggingface team to make this happen... and this is just the beginning. Thanks for the great collaboration! https://t.co/XaNIBLuIy4
4
16
76
Just why?
Not OK in my book. iOS 26 wipes shutdown.log, one of the most useful forensic traces in identifying malicious activity on your iPhone -
2
5
36
@radian is this intentional behavior?
Not OK in my book. iOS 26 wipes shutdown.log, one of the most useful forensic traces in identifying malicious activity on your iPhone -
0
2
3
@craiu Costin, you are looking at this the wrong way. It’s a brave decision right? No indication of bad if indicators can’t be found right?
1
2
14