Behind the Binary by Google Cloud Security

In this episode, we get a unique look at the history of Windows through the eyes of one of its leading experts, Pavel Yosifovich. We delve into his fascinating origin story, including the "fluke" that led him to become the author of the legendary Windows Internals series, and why he describes himself as a developer who "hates security."

The conversation explores the most significant foundational changes in Windows kernel design, specifically the architectural shift toward Virtualization-Based Security (VBS) and the long-term strategy behind the "Secure Kernel." We discuss the ever-evolving landscape of EDRs, the reality of kernel-level threats, and the impact AI and memory-safe languages like Rust will have on future development. This episode offers valuable insights for reverse engineers and developers interested in the big-picture trends that have shaped—and will continue to shape—the world of operating system design.

Get the latest from FLARE's community efforts: Email [email protected] to join our mailing list for important announcements. Your information will not be shared and is used only for this purpose.

Join the Community

• Research Hub: Threat research, training events and news:
  https://cloud.google.com/security/flare
• The FLARE Insider: Get community updates and announcements. To subscribe, email [email protected]

FOLLOW THE SHOW:

• Subscribe: Apple Podcasts | Spotify | YouTube

In this episode, we’re joined by Nino Isakovic, a long-time low-level security expert, for a thought-provoking conversation that spans the foundational and the cutting-edge. Nino discusses the art of deconstructing problems—sharing insights on how to learn effectively, the building blocks of a robust RE toolkit, and the critical shift required in our analytical approach. We then transition into the front lines of threat intelligence, where Nino discusses the specific challenges of analyzing sophisticated adversary tools. This includes systems like ORB Networks and a detailed look at his discovery of the ScatterBrain obfuscating compiler. Tune in for a full-spectrum discussion on what it takes to thrive in reverse engineering.

ScatterBrain blog post: https://cloud.google.com/blog/topics/threat-intelligence/scatterbrain-unmasking-poisonplug-obfuscator?e=48754805

Get the latest from FLARE's community efforts: Email [email protected] to join our mailing list for important announcements. Your information will not be shared and is used only for this purpose.

Join the Community

• Research Hub: Threat research, training events and news:
  https://cloud.google.com/security/flare
• The FLARE Insider: Get community updates and announcements. To subscribe, email [email protected]

FOLLOW THE SHOW:

• Subscribe: Apple Podcasts | Spotify | YouTube

In this episode, we sit down with Nick Harbour, Blas Kojusner, Moritz Raabe, and Sam Kim — members of the FLARE Team and some of this year’s challenge authors — for a deep dive into the design and execution of FLARE-On 12. The team discusses the complexity and intent behind this year's challenges, including how Sam created his grueling final challenge, "10,000," which featured 10,000 individual DLLs to force competitors toward automation. Sam reveals that solving the final puzzle required deep knowledge of both reverse engineering and group theory concepts like topological sorting and modular exponentiation of a matrix. Blas Kojusner explains his approach to challenge design, detailing how he blended modern Web3 concepts into a classic reverse engineering scenario with his ransomware chat client challenge, while Moritz shares that his Challenge 7 used obfuscation based on an actual malware sample he analyzed earlier in the year.

The conversation then turns to the competition's impact and future. The authors confirm the community's primary feedback was a clear call for more malware-focused challenges. The strong participation and the constant flow of feedback directly influences the next iteration of the event, giving the team the motivation and data needed to improve. The FLARE Team confirms they are planning for FLARE-On 13 in 2026, driven by the community's enthusiasm to tackle new technical hurdles like Rust binaries. Tune in to hear the creators discuss the effort that goes into writing puzzles that truly test the world's best reverse engineers.

Get the latest from FLARE's community efforts. Email [email protected] to join our mailing list for important announcements. Your information will not be shared and is used only for this purpose.

Join the Community

• Research Hub: Threat research, training events and news:
  https://cloud.google.com/security/flare
• The FLARE Insider: Get community updates and announcements. To subscribe, email [email protected]

FOLLOW THE SHOW:

• Subscribe: Apple Podcasts | Spotify | YouTube

In this episode, we're asking the question: "What Lurks Beneath?" We're joined by Mark Overholser, a Technical Marketing Engineer at Corelight who's part of the team running the Black Hat Network Operations Center (NOC). We discuss the incident during Black Hat 2025 that introduced us and revealed the team's proactive approach to protecting every guest from the unseen threats hiding in the shadows. Mark gives us an insider’s look at the philosophy and challenges behind building a robust network for a security conference, which includes the complex infrastructure provided by partners like Arista, Cisco, Palo Alto Networks, and Lumen.

We then dive into memorable network incidents and how they apply to any modern organization. Mark shares key insights on how to balance a permissive network with robust security, how they identify legit traffic from the digital monsters in training labs, and the crucial role of network alerts (IDS/IPS) in stopping attacks before they become full-blown nightmares. He'll also share some scary stories, including an infected presenter, a leaked company org chart, and people accessing their NASes in the clear. Get ready for a frightfully insightful discussion on network security.

Join the Community

• Research Hub: Threat research, training events and news:
  https://cloud.google.com/security/flare
• The FLARE Insider: Get community updates and announcements. To subscribe, email [email protected]

FOLLOW THE SHOW:

• Subscribe: Apple Podcasts | Spotify | YouTube

In this episode of Behind the Binary, we're joined by renowned security researcher Hahna Kane Latonick for a deep dive into the powerful world where reverse engineering meets data science. Hahna shares her expertise on how techniques like supervised and unsupervised learning can be used to classify and predict security threats, and she explains how deep learning and neural networks are being applied to identifying code sharing and solving other classification problems. We also discuss how Generative AI is transforming reverse engineering, from augmenting and assisting workflows to driving fully automated analysis.

Resources mentioned during the episode:

https://dronewolf.darkwolf.io/

https://asrp.darkwolf.io/

https://ringzer0.training/countermeasure25-machine-learning-for-reverse-engineers/

Join the Community

• Research Hub: Threat research, training events and news:
  https://cloud.google.com/security/flare
• The FLARE Insider: Get community updates and announcements. To subscribe, email [email protected]

FOLLOW THE SHOW:

• Subscribe: Apple Podcasts | Spotify | YouTube

In this episode, we're "Getting Ready for FLARE-On 12" with an inside look at the world-renowned reverse engineering competition. We’re joined by long-time FLARE-On host and challenge author Nick Harbour and regular challenge author Blas Kojusner for an in-depth conversation.

We'll take a brief tour of FLARE-On history and discuss how it has grown into a must-do event for malware analysts and reverse engineers. We’ll also break down how the competition works, from the evolution of the unique flag format to the mechanics of getting to the next challenge.

Nick and Blas will then give us a sneak peek at FLARE-On 12, teasing details on the number of challenges, the technologies being covered, and what participants can expect from this year's installment. Plus, we'll share insights into the challenge's difficulty, from the blazing speed of the first finisher to the average completion time for a successful competitor.

Whether you're a seasoned veteran or a curious newcomer, getting ready for FLARE-On 12 starts here!

https://www.flare-on.com

Join the Community

• Research Hub: Threat research, training events and news:
  https://cloud.google.com/security/flare
• The FLARE Insider: Get community updates and announcements. To subscribe, email [email protected]

FOLLOW THE SHOW:

• Subscribe: Apple Podcasts | Spotify | YouTube

Web3 promised a new era of decentralized finance, but it has also created a new frontier for crime, with thefts and hacks far surpassing those in the traditional financial sector. In this episode, we sit down with experts Blas Kojusner, Robert Wallace, and Joseph Dobson to explore the Wild West of Web3 and decentralized finance (DeFi).

But what is Web3? Our episode begins by taking a look at Web3 technologies like DeFi, blockchain, and smart contracts and explain how their very design makes them vulnerable. Our panel will then reveal how threat actors exploit these weaknesses, from crypto wallet key theft and EthHiding to intricate smart contract exploits and web frontend attacks. We'll also highlight some of the major players in the Web3 crime scene, including organized state-sponsored groups.

We'll also discuss how organizations can fight back. Our guests will share critical defense strategies, offering actionable steps developers and users can take to protect themselves and their assets from this new breed of financial predator.

Read the blog referenced in this episode: https://cloud.google.com/blog/topics/threat-intelligence/examining-web3-heists

Join the Community

• Research Hub: Threat research, training events and news:
  https://cloud.google.com/security/flare
• The FLARE Insider: Get community updates and announcements. To subscribe, email [email protected]

FOLLOW THE SHOW:

• Subscribe: Apple Podcasts | Spotify | YouTube

In this episode of Behind the Binary, we sit down with Dr. Jared DeMott to pull back the curtain on the world of cybersecurity. Formerly with the Microsoft Security Response Center (MSRC), Jared shares invaluable wisdom on managing bug bounty programs at scale and what truly makes a good bug report. We then pivot to explore his fascinating career journey, from his start with the NSA to leading teams at Microsoft. If that wasn’t enough, we’ll also dive into the unique challenges of a cyber startup. Get a firsthand account of his entrepreneurial spirit as he discusses why he launched his own cybersecurity company, revealing both the surprising successes and the hurdles he had to overcome.

Join the Community

• Research Hub: Threat research, training events and news:
  https://cloud.google.com/security/flare
• The FLARE Insider: Get community updates and announcements. To subscribe, email [email protected]

FOLLOW THE SHOW:

• Subscribe: Apple Podcasts | Spotify | YouTube

Join us as we explore the world of reverse engineering with pioneer and CTO, Danny Quist. We'll examine the evolving landscape of binary analysis tools, the constant battle with malware obfuscation, and what it was like building one of the very first malware repositories for research. Plus, Danny shares unique insights on neuro-diversity and cognitive load – crucial topics that impact us all.

That's just a glimpse of what's ahead. Danny Quist isn't just a leading mind in reverse engineering; he offers a rare look into the evolution of our field and some deeply personal reflections that I think will resonate with many of you. Let's jump right into my chat with Danny.

Join the Community

• Research Hub: Threat research, training events and news:
  https://cloud.google.com/security/flare
• The FLARE Insider: Get community updates and announcements. To subscribe, email [email protected]

FOLLOW THE SHOW:

• Subscribe: Apple Podcasts | Spotify | YouTube

Ever wonder who names the world's most notorious APTs? In this episode, we sit down with Greg Sinclair, a reverse engineer from the FLARE team at Google. Greg not only hunts down sophisticated malware but also shares the behind the scenes story of how he discovered and named the North Korean APT, the Lazarus Group. He also discusses his innovative methods for identifying malware families through binary similarities. Get ready for an inside look at the challenges, triumphs, and the sheer passion that defines a cutting-edge reverse engineer.

Join the Community

• Research Hub: Threat research, training events and news:
  https://cloud.google.com/security/flare
• The FLARE Insider: Get community updates and announcements. To subscribe, email [email protected]

FOLLOW THE SHOW:

• Subscribe: Apple Podcasts | Spotify | YouTube