Can we still have fun at CTFs? These last two months, I played 2 CTFs, and I did not have fun 😢 Year Impact for CTFs 2023 First challenge at Ph0wn involving a LLM. LLMs are far better than chat bots, but they are far from being able to solve CTF challenges. 2024 Several AI bypassing challenges at N0PS CTF. LLMs have improved, but there is still no MCP (end of 2024), and few agents 2025 All CTF players have open browser tabs with their favorite model (e.

GoGra Linux Dropper analysis GoGra is an backdoor family which emerged in 2024, mostly targeting India and Afghanistan. In April 2026, its developers released a Linux variant, which was analyzed here. In this blog post, we’ll go over a few interesting functionalities which were not detailed in that prior analysis. IOC: 9c23c65a8a392a3fd885496a5ff2004252f1ad4388814b20e5459695280b0b82 Background info GoGra was first seen in November 2023. It is written in Go and abuses the Microsoft Graph API.

GoGra Linux Payload analysis This blog post continues our analysis of GoGra Linux variant. In a first part, we analyzed the Dropper and found out it was displaying a decoy PDF and executing another binary. In this second part, we analyze the other binary, also called payload or implant. Pclntab The implant is stripped, so at first, Ghidra sees no function names, filenames etc. Note that, at first, our LLM did not know at all how to deal with Go binaries.

THCon 2026 Badge The badge at THCon 2026 was created by DVID. It actually had 2 firmware: Shipped on the badges for the conference, and reversed by Virtualabs. Interesting blog post, read it! This firmware has the badges communicate with a master using BLE. A specific firmware for a challenge. Getting the XRefs in Ghidra I had dumped the firmware and retrieved the applicative part see Virtualab’s post, but I was annoyed not to have any xref in Ghidra.

CTE v2 (2026) - Le Vault This challenge begins with some OSINT where we need to find a program protected by password. This program is used by Melanie’s friend, Samir Taleb. NB. These are fake identities used all along “Capture The Evidence” v2. Then, we’ll need to provide the author’s name of this challenge as flag. The tags of the challenge suggest there’s a part with OSINT (first part) and a part with Reverse (second part).

CTE v2 (2026) - Toujours en Vente This is a reverse engineering challenge created by Miaou for Capture The Evidence (CTE) in June 2026. We are given a binary broker_tool, and we need to find a URL to flag, e.g https://u.rl/path. Reconnaissance The binary is an ELF x86-64, not stripped. We run it: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 =================================== B U S I N E S S P O R T A L =================================== Welcome, valued partner.