Ransomware syndicates are increasingly adopting the clandestine practice of concealing their malicious artifacts not merely adjacent to the operating system, but directly within its architectural framework. The operators of Payouts King have inaugurated the...
BOF RunPE is a Beacon Object File for Cobalt Strike that executes PE files entirely in-memory within the beacon process. Unlike traditional fork&run, no child process is spawned, no console is created, and no pipe...
LazyDLLSideload A Rust-based tool for generating DLL proxy/sideload projects for red team engagements. Automatically parses PE export tables and generates ready-to-compile Rust projects with your payload embedded. LazyDLLSideload automates the process of creating DLL...
DbgNexum is a Proof-of-Concept for injecting shellcode using the Windows Debugging API and Shared Memory (File Mapping). It avoids writing and reading remote memory directly, instead using context manipulation to force the target process to...
KittyLoader is a highly evasive loader written in C / Assembly. Features Hijacks early execution by replacing the C runtime entrypoint (__scrt_common_main_seh) with custom assembly. Hides all modules by walking PEB->Ldr lists and unlinking...
Blocking EDRs traffic Two tools written in C that block network traffic for blacklisted EDR processes, using either Windows Defender Firewall (WDF) or Windows Filtering Platform (WFP). Overview WindowsDefenderFirewall.exe Creates inbound and outbound block rules in Windows Defender Firewall for...
A newly released open-source project has drawn the attention of the technical community for its attempt to circumvent modern workstation protection mechanisms. A developer using the alias hwbp has published a framework called LazyHook...
Logan Goins, a researcher at SpecterOps, has unveiled a novel technique for exploiting NTLM authentication that enables adversaries to bypass low-level access restrictions in corporate networks and offload tool execution from an infected workstation....
ArmouryLoader has once again captured the attention of cybersecurity experts, emerging as one of the most technically sophisticated malware loaders in recent memory. Its architecture reflects a mature approach to evading defenses, employing stealthy...
