K2▊
An exploit developer who wrote the first public polymorphic shellcode engine — ADMmutate, the tool that taught intrusion-detection systems to fear a payload that never looks the same twice — and who the antisecurity bloc then branded the enemy. In the summer of 2002 an anonymous zine crew declared that "ADM sponsored the antisecurity movement, and K2 is a member of ADM," accused him of turning informant, and demanded an apology. He never gave one. The receipts are real; the "enemy" label was assigned by people who signed their case-file with a threat of torture.
Classic code from 1999+ — I am fairly sure this is the first public polymorphic shellcode ever.
K2, describing ADMmutate in his own words on the tool's public code archive
- WHO
- "K2" (also "ktwo") — exploit developer and security researcher; real legal name not publicly confirmed, kept as the handle here FACT
- SCENE
- Author of ADMmutate, the polymorphic shellcode engine; associated with the ADM exploit-dev group and w00w00; CanSecWest speaker (see the Antisecurity Movement)
- THE DRAMA
- Named "the enemy" by the Phrack High Council / ~el8 antisec bloc in July 2002; accused of informing on the zine's circle; the feud ran on published statements, not in any court
- RECORD
- ADMmutate (c. 1999–2001) is documented in the academic IDS-evasion literature as an early, influential polymorphic engine. No charge, no conviction, no court finding is associated with the antisec accusations against him FACT
- STATUS
- ACTIVE — a working security professional; the technical body of work stands on its own
This file is tight on purpose. K2's public record has two clean halves that barely touch: a documented run of exploit-development work — above all ADMmutate — and a single, loud feud in which an anonymous zine crew cast him as the villain of "antisecurity." The archive keeps both, and keeps them separate. The technical contributions are stated as fact. The "enemy" framing is stated as what it was: the accusation of a movement that published under handles, offered no court and no proof, and closed its own statement with a threat.
the drama timeline
ACT I — THE ENGINE (c. 1999–2001)
Before the feud, the work: a shellcode mutation engine that made a payload look different every time it fired.
-
c. 1999–2001
ADMmutate
K2 writes ADMmutate, a polymorphic shellcode engine that auto-generates a decoder and re-encodes a payload to defeat signature-based intrusion detection. It is widely cited in the academic literature as one of the first public polymorphic shellcode tools, and it forces a generation of IDS vendors to move past static signatures. The work is presented at CanSecWest. This is the substance the drama never touches.
-
c. 2000–01
The disclosure debate
K2 posts to the anti.security.is message board, the forum around the early antisecurity idea, and takes part in the full-disclosure-versus-nondisclosure argument that defines the era — at one point weighing, in his own words, "kiddy damage vs. nondisclosure damage." A researcher who both ships exploits and questions reflexive disclosure is exactly the figure the coming feud will call a hypocrite.
ACT II — THE ENEMY (JULY 2002)
The Phrack High Council, the anonymous crew behind the ~el8 zine, names K2 the enemy of antisecurity — and puts its accusation in writing.
-
JUL 15, 2002
"K2 is a member of ADM"
In a public statement, a member of the Phrack High Council (PHC) writes that he was "slandered by K2, who is a member of numerous underground organizations including ADM and w00w00, and who is an employee of a large international security company called CORE-ST (formerly known as CORE-SDI)." The same statement declares: "ADM sponsored the antisecurity movement, and K2 is a member of ADM." The framing is complete: the man who wrote antisec's own tools has, in their telling, betrayed them.
-
JUL 15, 2002
The "narc" accusation
PHC accuses K2 of circulating a mass email that named people the crew associated with ~el8 — including, they charge, the contact details of a minor — and of trying to "create legal problems" for those he believed had compromised and humiliated him. K2's side, plainly stated: by the crew's own account his machines had been broken into, and what they call "narcing" is a targeted party naming those he believed responsible. troll.fan reproduces none of that email and no personal data from it.
-
JUL 2002
The threat
A second PHC statement drops the pretense of a debate. Demanding a public apology, its anonymous author warns that if none comes, "K2 will be found by my people and by tortures or another method" he will be made to comply. Whatever the disclosure argument had been, the crew branding K2 the enemy had just signed its case-file with a threat of violence. That is the document, and it points one direction.
ACT III — THE WORK OUTLASTS THE FEUD (2002–)
The zine war ended where zine wars end — nowhere in particular. The code did not.
-
2002–
No court, no charge
The feud produced statements, not a case. No charge, conviction, or court finding attaches to PHC's accusations against K2. He kept working; the "enemy of antisecurity" label stayed exactly where it was born — in an anonymous zine.
-
present
ADMmutate, archived
K2 later republished ADMmutate to a public code archive, still describing it as "fairly sure… the first public polymorphic shellcode ever." Two decades on, the tool is a fixture of the IDS-evasion canon and the reason his name survives — not the feud that tried to redefine it.
both sides, on the record
The movement's case: PHC held that ADM had sponsored the antisecurity idea and that K2, as an ADM member, was therefore antisec's own — and had betrayed it. In their telling he demanded advisories for trivial bugs, argued both sides of disclosure, and, once his machines were breached and he was mocked, "narced" by circulating identities to security professionals and threatening legal action [1].
Their charge of hypocrisy: the man who questioned reckless full disclosure was, they said, happy to expose a teenager's contact details when it served him — disclosure for me, nondisclosure for thee [1].
The work is real and clean: ADMmutate is a documented, influential piece of exploit research, studied in the peer-reviewed IDS-evasion literature and published under his own name. Nothing in the feud touches or diminishes it [2].
The accusations are an anonymous zine's, not a court's: PHC published under handles, offered no evidence beyond its own assertion, and produced no charge or finding. By the crew's own account, K2's machines had been broken into first — what they call informing was a man under attack naming those he believed responsible [1].
The escalation was theirs: the same crew that called K2 the enemy closed its demand with a written threat to "find" him and extract an apology "by tortures." That is the strongest single fact in the file, and it is not on his side of the ledger [3].
YOU DECIDE
Two records, barely touching. One is a body of exploit-development work — ADMmutate above all — that stands on its own merits and its own citations. The other is a single feud in which an anonymous crew declared a builder to be a traitor, accused him without a court, and then threatened him with violence. Strip the "antisecurity enemy" branding away and you are left with a researcher who shipped a landmark tool and a group that signed its grievance with a threat. Decide which of those is the story.
The archive does not adjudicate the feud. It keeps the code, and it keeps the sentence with the word "tortures" in it.
evidence locker
PRIMARY / REFERENCE
PHC / ~el8 statement (local mirror) ATTRIBUTED — the Phrack High Council statement naming K2 "a member of… ADM and w00w00" and "an employee of… CORE-ST (formerly… CORE-SDI)," and asserting "ADM sponsored the antisecurity movement, and K2 is a member of ADM." The "narc" accusation and demand for apology. These are PHC's allegations, presented as theirs.
research/zines/antisec/phc/old/statement1.txt
GitHub — K2/ADMMutate FACT — K2's own public archive of ADMmutate, with his description of it as "the first public polymorphic shellcode ever." Verifiable technical contribution.
github.com/K2/ADMMutate PHC follow-up statement (local mirror) ATTRIBUTED — the second statement demanding an apology and threatening that K2 "will be found by my people and by tortures." PHC characterizing its own intent; quoted as theirs.
research/zines/antisec/phc/old/statement2.txt
CONTEXT & CROSS-LINKS
Wikipedia — Core Security Technologies REFERENCE — the company PHC named (CORE-SDI, later Core Security), confirming it as a real security firm; K2's employment there is PHC's claim, not established here.
en.wikipedia.org/wiki/Core_Security_Technologies
The standard. K2 is a living professional, so the load-bearing facts here are the documented, first-party ones: he authored ADMmutate, a real and influential piece of exploit research, and that is stated at full strength. Everything the antisecurity bloc alleged — ADM/w00w00 membership, CORE employment, "sponsoring antisec," "narcing" — is presented as the Phrack High Council's own attributed accusation, quoted from the period statements and never adopted as troll.fan's finding. No court, charge, or conviction attaches to any of it. No private data from the crew's "mass mail" is reproduced. His real legal name is not publicly confirmed, so this file guesses none and keeps the handle. If a line here couldn't survive scrutiny, it wouldn't be on the page.