MITRE has unveiled ATT&CK v19, a monumental evolution of the framework utilized by security cohorts to delineate adversary tactics and techniques. This iteration fundamentally recalibrates the established architecture: developers have bifurcated the overly broad...
The Chinese cyber-espionage collective Dragon Breath, also recognized by the designation APT-Q-27, has purportedly acquired a formidable new instrument for infiltrating corporate infrastructures. According to a report by Ransom-ISAC, investigators identified a vulnerable driver,...
Since the twilight of 2025, Cisco Talos has been vigilantly tracking a malicious campaign directed against educational and healthcare institutions within the United States. Researchers attribute this coordinated activity to the threat actor UAT-10027...
The LockBit collective, which many had prematurely consigned to oblivion following a series of ignominious setbacks and data exposures, has staged an unexpected resurgence. In the autumn of 2025, the group re-emerged with LockBit...
SilentButDeadly is a network communication blocker specifically designed to neutralize EDR/AV software by preventing their cloud connectivity using Windows Filtering Platform (WFP). This version focuses solely on network isolation without process termination. Key Technical...
Occasionally, circumventing Windows‘ security apparatus does not necessitate a direct assault on the antivirus software itself; rather, it is sufficient to orchestrate a scenario in which the software fails to initialize correctly. A security...
A new commodity has surfaced on underground forums for those seeking to operate more quietly—and for longer. An actor using the alias AlphaGhoul has begun promoting a utility called NtKiller, which, according to its...
TrapFlagForSyscalling: Bypass user-land hooks by syscall tampering via the Trap Flag The Trap Flag (TF) is a special bit in the CPU’s EFLAGS register that forces the processor to generate a single-step exception after every instruction. This behavior...
Singularity is a powerful Linux Kernel Module (LKM) rootkit designed for modern 6.x kernels. It provides comprehensive stealth capabilities through advanced system call hooking via ftrace infrastructure. What is Singularity? Singularity is a sophisticated rootkit...
ChromeAlone is a browser implant that can be used in place of conventional implants like Cobalt Strike or Meterpreter. This repo provides a simple build process that will generate a management console, deploy infrastructure,...
RingReaper is a simple post-exploitation agent for Linux designed for those who need to operate stealthily, minimizing the chances of being detected by EDR solutions. The idea behind this project was to leverage io_uring, the new...
The emergence of a new tool known as RingReaper has sparked concern among cybersecurity experts and penetration testing teams alike. This program leverages a legitimate yet highly potent Linux kernel feature called io_uring to...
