Greg Lesnewich

Can someone smarter than me tell me if the cyber strategy for america from the regime means anything for me personally?

nearly sued the previous owners of our last residence over this exact thing

Christopher Kempczinski bit into that burger like it was the first time he'd every tasted a McDonalds burger

AND...

This is actually a case study on how American companies no longer promote within

Niplodram Fame GIF ALT: Niplodram Fame GIF

They don't see grandpa, until they look over at the crowd of kids getting their NASCAR gear signed by “Big Al”

kids didn’t know the old dude in the fishing hat WASN’T a team owner, so grandpa took his chance to be hilarious and sign like 6 autographs as Big Al, and BS’d about how the race went

Fast forward to them deciding to leave

Story goes that my uncle lost track of grandpa towards the gated exit to the parking lots

They wander to the exit where a bunch of kids are waiting on the other side of the fence hawking autographs …

a race car with the number 20 on the front ALT: a race car with the number 20 on the front

So one race he brings along my grandpa and my old man. Happenstance, one of the cars they sponsored, Tony Stewart, wins!

So the three of them, having no business being there, end up in the winners circle

There’s a ton of people there - they get a free beer but don’t meet anyone fr

a race car is driving down a track with spike written on the bottom of the screen ALT: a race car is driving down a track with spike written on the bottom of the screen

Since things are #rough out here right now, I figured I’d share a fun story

Back in the early 00’s, my uncle worked at some manufacturer that sponsored a bunch of NASCAR cars and would regularly get tickets to the events

Anthropic just got a life time subscriber based off this one screen wow

i personally loved the one where he subtweeted Anthropic and said they were committing treason

Staying off socials to keep my mentals in order but had to come in here to say that I’m certain Bad Bunny had more yards from scrimmage than the Pats in that first half

#BREAKING #ESETresearch identified the wiper #DynoWiper used in an attempted disruptive cyberattack against the Polish energy sector on Dec 29, 2025. At this point, no successful disruption is known, but the malware’s design clearly indicates destructive intent. 1/5

You fear innovation

We Are Witnessing the Self-Immolation of a Superpower With Donald Trump’s actions in Greenland, Minneapolis, and Venezuela, a foreign enemy could not invent a better chain of events to wreck the standing of the United States.

"A superpower is choosing to self-immolate and torch its remaining global trust and friendships, including and especially NATO...at the precise moment when it had been reinvigorated and renewed...in the wake of Russia’s large-scale invasion of Ukraine in 2022" - by @vermontgmg.bsky.social

Minneapolis church has delivered more than 12,000 boxes of groceries to families in hiding DHH church has hundreds of volunteers packing and delivering groceries to families who have been too scared to leave their homes during the immigration operation.

They have quite an operation going.
www.mprnews.org/episode/2026...

Appreciate the tip! Will see if it takes down the champ!

We have not! Worth giving a go?

I don’t think we’ve collectively paid enough attention to the fact that Annie’s is now the regent of boxed Mac and cheese

Kraft got their chain snatched and now it just tastes like dog water compared to Annie’s

I for one am excited for the Hoth Takes episode on this one to help me digest this news

#100daysofYARA - day 12
VirusTotal uses CAPE sandbox to identify many malware families and determine if they can extract the malware's configuration. Since they use CAPE, we can often see their logic. Today, we'll suggest edits to a rule for AgentTesla.

Rule at end.
1/10

words don't mean anything anymore

Imagine publishing a blog on "Lazarus" in the year of our lord 2026

#100DaysofYARA - Day 11
In looking at automatic YARA generation, yarGen-Go is a must. Just released by @cyb3rops, it is a rewrite and advancement from the original yarGen.

We'll look at the same malware from day 10; a targeted HavocC2 loader with decoy.

rule at bottom
1/5

100DaysofYARA/Squiblydoo/Day9.yara at main · Squiblydoo/100DaysofYARA Rules shared by the community from 100 Days of YARA 2026 - Squiblydoo/100DaysofYARA

This scripts are deceptive as they contain 10,000 empty lines. BTW #malcat loads scripts like these better than most text editors.

If I get the chance, I may revise it to see how to find ones without the matching text or if you have ideas, hmu.

github.com/Squiblydo...
3/3

Inside the BlueNoroff Web3 macOS Intrusion Analysis | Huntress Learn how DPRK's BlueNoroff group executed a Web3 macOS intrusion. Explore the attack chain, malware, and techniques in our detailed technical report.

The rule is fairly simple but it seems that at least one DPRK team is using the same consistent message in the header. I validated this using ReversingLab's YARA scanning.

A slightly different header is seen in Huntress' analysis: www.huntress.com/blo...
2/3

#100DaysofYARA - Day 9
YARA looks for the header used in a .SCPT file used by BlueNoroff (DPRK) to target MacOS systems.

Script is delivered to victims disguised as a Zoom meeting launcher.
e.g. a7c7d75c33aa809c231f1b22521ae680248986c980b45aa0881e19c19b7b1892

Rule at end
1/3

#100DaysofYARA - Day 8
For many years, many attackers tried to keep their binaries small. However, the others found the opposite works too: extremely large binaries can cause problems with analysis.

What can be done about these large executables?

Rule at end
1/6

The same people spent the last decade justifying Black folks being choked to death on camera… they’ve been practicing

congress should behave like a co equal branch

impeachment
defunding
filing suits
subpoenas
writing laws
hearings, hearings, hearings

what else?

GRU-Linked BlueDelta Evolves Credential Harvesting Insikt Group reveals how GRU-linked BlueDelta evolved credential-harvesting campaigns targeting government, energy, and research organizations across Europe and Eurasia.

Today, we released new @RecordedFuture research detailing BlueDelta’s expanded credential-harvesting activity observed between February and September 2025. #BlueDelta #APT28 #FANCYBEAR #ForestBlizzard #FROZENLAKE #ITG05 #PawnStorm #Sednit #Sofacy #TA422 (1/5) www.recordedfuture.com/research/gru...

#100DaysofYARA - Day 7
@malwrhunterteam identified a suspicious file signed by "Xiamen Jialan Guang Information Technology Service Co., Ltd."

While we have a pretty good idea it'll be abused, it hasn't been yet.
So, lets watch for it to be abused.

Rule at end
1/5