Three Buddy Problem

The greatest APT hunter of all time, Apple's exploit kit problem, Microsoft FedRAMP mess

4 snips

Mar 20, 2026

They reminisce about Sergey Mineev and his anomaly-hunting mastery. They unpack a new in-the-wild iOS exploit kit and why older Apple devices remain at risk. They tackle Interlock ransomware exploiting a Cisco zero-day and the Amazon discovery. They react to ProPublica’s findings on Microsoft and FedRAMP and note a major AI chip smuggling indictment.

Ask episode

AI Snips

Chapters

Transcript

Episode notes

ANECDOTE

Sergey Mineev's Needle In The Haystack Hunting

Sergey Mineev built bespoke SQL-driven anomaly hunters that found rare malware by clustering clean and malicious strings.
Costin recalled Mineev manually processing hundreds of failed hits daily to surface a few high-value samples like Equation Group drivers.

INSIGHT

Yara From Clean Strings Catches Hidden Malware

Mineev generated Yara rules from unique combinations of otherwise clean strings to catch malicious samples missed by conventional rules.
He kept massive MS SQL tables of clean and malicious strings and automated rule creation to pivot from one rare hit to broader clusters.

INSIGHT

DarkSword Uses Pure JavaScript To Bypass Native Implants

DarkSword is a JavaScript-heavy iOS exploit kit targeting iOS 18.4–18.7 that avoids native implants by doing exploitation and exfiltration in JS.
Costin noted multiple actors reused the kit and linked Parse Defense as a possible commercial supplier.

Get the Snipd Podcast app to discover more snips from this episode