Taha Karim is a reverse engineer and threat researcher specializing in multi-stage implants, mobile exploit chains, and AI-assisted analysis of advanced intrusion sets.
01 / RESEARCH & EXPERIENCE
A career in advanced
security research.
He graduated from EPITA in Paris (École Pour l’Informatique et les Techniques Avancées) with a concentration in cybersecurity, then joined Symantec as a malware reverse engineer. There he placed first in the Symantec CyberWar Challenge among roughly 1,000 company-wide participants.
At FireEye he moved from financially motivated botnets and carding operations into senior malware research. He co-authored the first public teardown of LATENTBOT, a modular multi-stage bot dating to at least 2013: ConfuserEx-obfuscated .NET loaders, process hollowing into RegAsm.exe/CvTres.exe, ephemeral runtime decryption, custom crypto across components and C2, hidden-desktop/HVNC, Pony-based stealing, desktop lock, and optional MBR wipe. Most artifacts existed only briefly in memory or the registry, which kept AV coverage generic while campaigns hit financial and insurance targets internationally.
As Head of Malware Research Labs at DarkMatter, he led APT research on x86 and ARM and work on real-time hunting. His analysis of WindShift (MITRE G0112) described a sparse Middle East espionage actor that favored phishing and SMS reconnaissance, then abused custom URL schemes to launch signed macOS app bundles and drop WindTail and WindTape for document theft and screenshots. The work was presented at HITB GSEC and later cited in WindTail/WindTape analyses and ATT&CK (S0466).
As a security researcher on Exodus Intelligence’s 0-day team, he built and maintained Android baseband exploit chains—modem firmware, radio-interface surfaces, and privilege escalation from the baseband into higher-privilege Android contexts. At Google he reversed malicious APKs for Play Store defense: unpacking, persistence and escalation mapping, and converting implant behavior into pre-distribution detection.
He now leads work on TikTok/ByteDance’s global threat intelligence team, building AI workflows that scale analysis of advanced attacks across red- and blue-team problems.
He has trained at Black Hat and presented at Black Hat, HITB, and SANS.
02 / BUILDING ADVERSERIAL AI
Deep security research.
Specialized intelligence.
Today, Taha is the founder of Adverserial AI and the creator of CyberKimi, a specialized AI system designed for professional cybersecurity work. CyberKimi represents the convergence of his two primary fields: deep cybersecurity research and advanced artificial intelligence.
Rather than adapting a general-purpose assistant with a small layer of security knowledge, Taha’s vision is to build AI systems around the real workflows of security professionals including vulnerability research, reverse engineering, exploit analysis, secure-code review and threat investigation. His work focuses on creating specialized models, private cybersecurity datasets, agentic research systems and rigorous benchmarks capable of measuring genuine technical performance.
Under the identity @lordx64, Taha actively shares his research, experiments and perspectives on the evolving relationship between artificial intelligence and offensive and defensive security. His work explores how AI can move beyond answering security questions to becoming a practical research partner capable of reasoning through complex systems, analyzing unfamiliar code and accelerating authorized vulnerability discovery.
03 / THE MISSION
Intelligence built
for the realities of security.
Through Adverserial AI, his mission is to build a new generation of highly capable, security-native AI systems that help trusted professionals identify vulnerabilities faster, understand sophisticated threats and protect critical digital infrastructure.
