![cr3ghost's tweet photo. Call stack spoofing started in the game hacking community on UnknownCheats in 2018. A single JMP [RBX] gadget to spoof a return address.
Eight years later it defeats every layer of EDR call-stack-based detection and is CET shadow stack compatible.
The evolution:
@namazso (2018) – original x64 return address spoofing from the game hacking scene. The foundation everything else built on.
@waldoirc YouMayPasser (2022) – first major extension of namazso’s work, bypassing PE-sieve and Moneta using Gargoyle-style ROP with sleep encryption.
@KlezVirus SilentMoonwalk (2022) – desynchronized stack unwinding using real .pdata RUNTIME_FUNCTION entries to construct synthetic frames. Moonwalk++ (2025) combined stack spoofing with memory self-encryption.
@0xmaz LACUNA Chain (2026) – Ghost Frames defeating userland hooks, kernel callbacks, and ETW-Ti stack collection simultaneously. Zero .pdata modification.
BingusLdr (2026) – CET compatible stack spoofing. The shadow stack problem every previous technique ignored, solved.
Commercial C2 frameworks like Havoc Pro from @infinitycurve have already started integrating CET compatible stack spoofing to bypass top tier EDRs. But vendors like @elasticseclabs are catching on, publishing research on detecting shadow stack mismatches and synthetic frame anomalies.
The arms race continues. From game cheats to defeating enterprise EDRs. The tradecraft is the same. The targets changed.
If you build detections for call stack anomalies, this is the history you need to understand.
https://t.co/cm1WtxP4s5
https://t.co/C4fnpcFbGZ
https://t.co/ljyOoz6Yyd
https://t.co/XCPB26sIGw
https://t.co/JmeuCVEQju
https://t.co/ftmycu3ffh
https://t.co/dBRnz8MBJb
https://t.co/vPUlNACBSW
https://t.co/q6nJLjM1kU
@namazso @waldoirc @KlezVirus @0xmaz
#DetectionEngineering #WindowsInternals #InfoSec](https://pbs.twimg.com/media/HNwGFV2aAAERmlt.png)
![cr3ghost's tweet photo. Call stack spoofing started in the game hacking community on UnknownCheats in 2018. A single JMP [RBX] gadget to spoof a return address.
Eight years later it defeats every layer of EDR call-stack-based detection and is CET shadow stack compatible.
The evolution:
@namazso (2018) – original x64 return address spoofing from the game hacking scene. The foundation everything else built on.
@waldoirc YouMayPasser (2022) – first major extension of namazso’s work, bypassing PE-sieve and Moneta using Gargoyle-style ROP with sleep encryption.
@KlezVirus SilentMoonwalk (2022) – desynchronized stack unwinding using real .pdata RUNTIME_FUNCTION entries to construct synthetic frames. Moonwalk++ (2025) combined stack spoofing with memory self-encryption.
@0xmaz LACUNA Chain (2026) – Ghost Frames defeating userland hooks, kernel callbacks, and ETW-Ti stack collection simultaneously. Zero .pdata modification.
BingusLdr (2026) – CET compatible stack spoofing. The shadow stack problem every previous technique ignored, solved.
Commercial C2 frameworks like Havoc Pro from @infinitycurve have already started integrating CET compatible stack spoofing to bypass top tier EDRs. But vendors like @elasticseclabs are catching on, publishing research on detecting shadow stack mismatches and synthetic frame anomalies.
The arms race continues. From game cheats to defeating enterprise EDRs. The tradecraft is the same. The targets changed.
If you build detections for call stack anomalies, this is the history you need to understand.
https://t.co/cm1WtxP4s5
https://t.co/C4fnpcFbGZ
https://t.co/ljyOoz6Yyd
https://t.co/XCPB26sIGw
https://t.co/JmeuCVEQju
https://t.co/ftmycu3ffh
https://t.co/dBRnz8MBJb
https://t.co/vPUlNACBSW
https://t.co/q6nJLjM1kU
@namazso @waldoirc @KlezVirus @0xmaz
#DetectionEngineering #WindowsInternals #InfoSec](https://pbs.twimg.com/media/HNwGFV1aAAAAKnw.jpg)
Olivia
Online
1u0m
@0x3175306d
Hiking Mountaineering stocks coder
Joined January 2012
267 Following
140 Followers
223 Posts
Blog by: cognisys group labs.
Call stack spoofing started in the game hacking community on UnknownCheats in 2018. A single JMP [RBX] gadget to spoof a return address.
Eight years later it defeats every layer of EDR call-stack-based detection and is CET shadow stack compatible.
The evolution:
@namazso (2018) – original x64 return address spoofing from the game hacking scene. The foundation everything else built on.
@waldoirc YouMayPasser (2022) – first major extension of namazso’s work, bypassing PE-sieve and Moneta using Gargoyle-style ROP with sleep encryption.
@KlezVirus SilentMoonwalk (2022) – desynchronized stack unwinding using real .pdata RUNTIME_FUNCTION entries to construct synthetic frames. Moonwalk++ (2025) combined stack spoofing with memory self-encryption.
@0xmaz LACUNA Chain (2026) – Ghost Frames defeating userland hooks, kernel callbacks, and ETW-Ti stack collection simultaneously. Zero .pdata modification.
BingusLdr (2026) – CET compatible stack spoofing. The shadow stack problem every previous technique ignored, solved.
Commercial C2 frameworks like Havoc Pro from @infinitycurve have already started integrating CET compatible stack spoofing to bypass top tier EDRs. But vendors like @elasticseclabs are catching on, publishing research on detecting shadow stack mismatches and synthetic frame anomalies.
The arms race continues. From game cheats to defeating enterprise EDRs. The tradecraft is the same. The targets changed.
If you build detections for call stack anomalies, this is the history you need to understand.
https://t.co/cm1WtxP4s5
https://t.co/C4fnpcFbGZ
https://t.co/ljyOoz6Yyd
https://t.co/XCPB26sIGw
https://t.co/JmeuCVEQju
https://t.co/ftmycu3ffh
https://t.co/dBRnz8MBJb
https://t.co/vPUlNACBSW
https://t.co/q6nJLjM1kU
@namazso @waldoirc @KlezVirus @0xmaz
#DetectionEngineering #WindowsInternals #InfoSec
![cr3ghost's tweet photo. Call stack spoofing started in the game hacking community on UnknownCheats in 2018. A single JMP [RBX] gadget to spoof a return address.
Eight years later it defeats every layer of EDR call-stack-based detection and is CET shadow stack compatible.
The evolution:
@namazso (2018) – original x64 return address spoofing from the game hacking scene. The foundation everything else built on.
@waldoirc YouMayPasser (2022) – first major extension of namazso’s work, bypassing PE-sieve and Moneta using Gargoyle-style ROP with sleep encryption.
@KlezVirus SilentMoonwalk (2022) – desynchronized stack unwinding using real .pdata RUNTIME_FUNCTION entries to construct synthetic frames. Moonwalk++ (2025) combined stack spoofing with memory self-encryption.
@0xmaz LACUNA Chain (2026) – Ghost Frames defeating userland hooks, kernel callbacks, and ETW-Ti stack collection simultaneously. Zero .pdata modification.
BingusLdr (2026) – CET compatible stack spoofing. The shadow stack problem every previous technique ignored, solved.
Commercial C2 frameworks like Havoc Pro from @infinitycurve have already started integrating CET compatible stack spoofing to bypass top tier EDRs. But vendors like @elasticseclabs are catching on, publishing research on detecting shadow stack mismatches and synthetic frame anomalies.
The arms race continues. From game cheats to defeating enterprise EDRs. The tradecraft is the same. The targets changed.
If you build detections for call stack anomalies, this is the history you need to understand.
https://t.co/cm1WtxP4s5
https://t.co/C4fnpcFbGZ
https://t.co/ljyOoz6Yyd
https://t.co/XCPB26sIGw
https://t.co/JmeuCVEQju
https://t.co/ftmycu3ffh
https://t.co/dBRnz8MBJb
https://t.co/vPUlNACBSW
https://t.co/q6nJLjM1kU
@namazso @waldoirc @KlezVirus @0xmaz
#DetectionEngineering #WindowsInternals #InfoSec](https://pbs.twimg.com/media/HNwGFV4awAA1r4t.jpg)
https://t.co/RuGnhwcTiZ
@mythhack 0 0！ 我现在也是快要被优化的人了
@pcobidco 排队参与一个 16265481
@ZhanweiC 16265481
meet VMkatz, https://t.co/eza4AXRuFT
New post on the MDSec blog and another Windows EoP....
RIP RegPwn - https://t.co/o9PjCQAvx5
Saying goodbye to a much loved EoP, by @filip_dragovic
SysWhispers4 just dropped !!!
https://t.co/dCGboy3rwQ
New blog & exploit about CVE-2025-29969 - RCE by Yarin Aharoni @safebreach Labs.
Findings allow:
----
* Checking arbitrary paths existence (unfixed!).
* Writing files remotely (RCE).
----
On ALL Windows & Windows Server computers in the domain!
Repo - https://t.co/Ygs0t775RT
New fav persistence method which works on Win11 25H2: Set the default key's value of HKCU\Software\Classes\CLSID\{18907f3b-9afb-4f87-b764-f9a4e16a21b8}\InprocServer32 to point to a malicious DLL and get shells from multiple programs even before a user logs in.
The flaw allows attackers to gain SYSTEM privileges on Windows Server 2025 via a new NTLM relay attack that bypasses LDAP Channel Binding. PoC available!
#WindowsServer #InfoSec #CVE #NTLM #CyberSecurity
https://t.co/CI4qfGyHrP
Telecom Networks digital #forensics process.
A wide range of custom tools/malware designed for telecom environments.
AuthDoor/ChronosRAT/NoDepDNS
https://t.co/1HjE2TTjNx
SGSN Emulator
https://t.co/3nRqELhKHb
GTPDoor
https://t.co/Ejt55pHzCD
Cordscan
https://t.co/kNiwg7VmZJ
Zimbra10_SQL_Injection/WRITE_UP.md at main · yelang123/Zimbra10_SQL_Injection · GitHub - https://t.co/4JBIqNf1ml
Last Seen Users on Sotwe
budak_sinek
Seen from United States
beatriz jiang
Seen from Indonesia
Mê cặc
Seen from Vietnam
Mila Miette ♡ 
Seen from United States
Ayesha khan
Seen from Netherlands
crotin semua merek jilbab
Seen from Indonesia
Eğlen Dostum
Seen from Turkey
Umut Tekin
Seen from Indonesia
mymo
Seen from Egypt
Greek Romeo
Most Popular Users
Elon Musk
@elonmusk
241.1M followers
Barack Obama
@barackobama
119.1M followers
Cristiano Ronaldo
@cristiano
112.6M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.1M followers
Rihanna
@rihanna
98.2M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.4M followers
KATY PERRY
@katyperry
88.8M followers
Taylor Swift
@taylorswift13
82.7M followers
Lady Gaga
@ladygaga
74.2M followers
Virat Kohli
@imvkohli
71.7M followers
Kim Kardashian
@kimkardashian
70.3M followers
YouTube
@youtube
68.7M followers
Neymar Jr
@neymarjr
64.6M followers
Bill Gates
@billgates
64.5M followers
The Ellen Show
@theellenshow
62.4M followers
Selena Gomez
@selenagomez
61.9M followers
CNN
@cnn
61.8M followers
X
@x
60.8M followers