Kostas ✓

@Kostastsale · joined 20 Feb 2017

I like building things that solve real problems, working across cybersecurity, product, and research | 🇬🇷🇨🇦

20 504Followers

494Following

6 671Posts total

57.7KViews on collected posts

Latest posts

Kostas ✓@Kostastsale4 Sep

Been testing GPT-6 Astra against some recent malware we collected through IR engagements. I used the ChatGPT Chrome extension with Guacamole running a @ThruntingLabs FlareVM environment directly inside the browser. Samples included a recent SynkLoader, SystemBC and a few https 18.6K views · 288 likes · 49 reposts · 5 replies Open on X →

Kostas ✓@Kostastsale4 Sep

Perfect timing before the long weekend! https://t.co/JHi04LB3Rz 908 views · 6 likes · 0 reposts · 0 replies Open on X →

Kostas ✓@Kostastsale4 Sep

Yeah... I would not underestimate Iranian APTs. MuddyWater is mainly about espionage and long-term access. ➡️ hijacked accounts ➡️ targeted phishing ➡️ legit RMMs ➡️ custom backdoors and more... Also, Iranian-linked groups more broadly have used destructive wipers, fake 5.7K views · 48 likes · 4 reposts · 0 replies Open on X →

Kostas ✓@Kostastsale4 Sep

Yesterday, Vice President JD Vance said Iran’s ability to disrupt Americans through cyber activity is “quite limited.” We think that might be an understatement. Interested in seeing the kind of tradecraft Iranian APTs are actually using? Our next CTF puts you inside a full 6.7K views · 14 likes · 1 reposts · 0 replies Open on X →

Kostas ✓@Kostastsale4 Sep

Really good research from Elastic on Linux fileless execution. The telemetry is what drives the detections. Elastic keeps improving their Linux telemetry. The recent changes around `memfd_create` is a good example, so you can actually see and hunt this type of execution. We 6.1K views · 80 likes · 8 reposts · 0 replies Open on X →

Kostas ✓@Kostastsale3 Sep

While investigating an ongoing intrusion, we have come across a threat actor using what appears to be a custom RMM written in Python. The screenshot below shows the operator panel. Anyone recognize this RMM or come across something similar before? Please reach out and we will h 6.7K views · 54 likes · 13 reposts · 6 replies Open on X →

Kostas ✓@Kostastsale3 Sep

Fileless execution on Linux still leaves (a lot of) observable behavior. My latest research identifies five common patterns and maps each to the telemetry and detection rules that underlie them. Read it here ↓ https://t.co/D0YPRmpiP4 10.4K views · 94 likes · 27 reposts · 1 replies Open on X →

Kostas ✓@Kostastsale17 Jan

The Python Variant has a ton of similarities with NightshadeC2 like network traffic, UAC Bypasses and Prompt Bombing. Good article here by eSentire: https://t.co/V3wR9wvlEH @malwrhunterteam 841 views · 6 likes · 2 reposts · 0 replies Open on X →

Kostas ✓@Kostastsale17 Jan

@Kostastsale "this is a multi-stage, multi-language intrusion" If @444hex is correct (see: https://t.co/gqP9taKz9X), there is some WebAssembly in the chain too other than the ones you mentioned... 🤷‍♂️ 1.8K views · 12 likes · 2 reposts · 1 replies Open on X →

Against accounts of the same size

7 posts from the last 90 days, next to the 10K–100K follower range. shown widely, but few of those viewers react.

Median views6 697this account989median for 10K–100K

Reach, %32.66%this account3.56%median for 10K–100K

Engagement, %1.12%this account1.92%median for 10K–100K

Metric	This account	Median for 10K–100K	Ratio
Median views per post	6 697	989	6.77×
Reach (views ÷ followers)	32.66%	3.56%	9.17×
Engagement rate	1.12%	1.92%	0.58×

Others in this range → Compare with another account → How these benchmarks are built →

Growth & engagement

How the posts we collected actually performed: views and reaction rate post by post, what the audience did with them, and where the follower count goes.

Views per post

1.8K17 Jan

841

10.4K3 Sep

6.7K

6.1K4 Sep

6.7K

5.7K

908

18.6K

Last 9 collected posts, oldest on the left. The scale is logarithmic: one post can outrun the rest a hundred times over.

Engagement rate per post

0.83%17 Jan

0.95%

1.18%3 Sep

1.12%

1.45%4 Sep

0.25%

0.93%

0.66%

1.84%

Reactions — likes, reposts, replies and quotes — divided by views. Median for 10K–100K accounts is 1.92%.

What the audience does

Likes59.1%602 in total

Reposts10.4%106 in total

Replies1.3%13 in total

Quotes0.6%6 in total

Bookmarks28.6%291 in total

Share of every reaction we collected for this account. Replies mean argument, reposts mean endorsement, bookmarks mean the post was worth keeping.

The follower curve appears once this account has two daily snapshots — we take one a day, and this one is on its first.

Latest posts

Against accounts of the same size

Growth & engagement

Views per post

Engagement rate per post

What the audience does

Similar accounts