Areenzor

🖥️ Where innovation strategy meets cybersecurity

[Areenzor @Areenzor]

🦋@Areenzor is now on BlueSky! Follow us: https://t.co/15GphzAYZG

#CyberSecurity #infosec #OT #IT #IoT #Malware

[Areenzor @Areenzor]

We will be in hiatus to reform the overall strategy.

[Areenzor @Areenzor]

Want to master Windows internals for offensive security?!

Read ...

'Windows Internals, Part 1 & 2'

by Solomon & Ionescu.

It discusses processes, memory management & kernel mechanisms.

Essential for red teamers.

#RedTeam #Malware #cyberseurity #Infosec #windows

[Areenzor @Areenzor]

Abusing DbgPrint for stealthy data exfiltration?

Kernel-mode logging APIs let malware smuggle data via debug output, bypassing traditional network monitoring.

Works well in driver-based implants.

#Malware #RedTeam #Data #Network #Kernel #API #infosec #CyberSecurity

[Areenzor @Areenzor]

On Code Trick:

Need stealthy C2 communication?

Use ICMP echo requests to encode commands & TTL values to exfiltrate data.

Many firewalls ignore ICMP, making it a covert channel.

#RedTeam #C2Evasion #ICMP #infosec #CyberSecurity #TTL

[Areenzor @Areenzor]

Abusing Windows Error Reporting (WER) for stealthy execution?

Drop payloads in

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\,

then trigger 'WerFault.exe' to load them.

Low detection, high persistence.

#RedTeam #EDR #infosec #CyberSecurity #WER #Payload

[Areenzor @Areenzor]

The 2014 Heartbleed bug exposed a brutal reality:

even widely trusted cryptographic libraries (OpenSSL) can harbor catastrophic flaws.

The lesson?

Continuous auditing > blind trust.

#CyberSecurity #History #SSL #Cryptography #Bug #Infosec

[Areenzor @Areenzor]

Abusing Windows COM objects for stealthy execution?

Use 'MMC20.Application' to execute commands outside direct process lineage tracking.

Works well against naive EDR correlation.

#RedTeam #DefenseEvasion #infosec #Cybersecurity #EDR

[Areenzor @Areenzor]

🔄 End of an era: Microsoft is officially pulling the plug on Skype.

Once the king of VoIP, now a relic in the age of Teams & Zoom.

💡A reminder .. in tech, innovation outruns nostalgia

adapt or fade away.

Topic: https://t.co/DWm30fFsgb

#Tech #Microsoft #Goodbye #Skype #VoIP

[Areenzor @Areenzor]

QwQ-32B proves that smart scaling & RL refinements ... It can let a 32B model punch well above its weight, challenging giants with pure reasoning power!

[Qwen @Alibaba_Qwen]

Today, we release QwQ-32B, our new reasoning model with only 32 billion parameters that rivals cutting-edge reasoning model, e.g., DeepSeek-R1.

Blog: https://t.co/jpNEx0Ck8p
HF: https://t.co/h91przQmoP
ModelScope: https://t.co/p0ztmZpWIZ
Demo: https://t.co/sxVVRFwunC
Qwen Chat: https://t.co/bg4tAU1p74

This time, we investigate recipes for scaling RL and have achieved some impressive results based on our Qwen2.5-32B. We find that RL training con continuously improve the performance especially in math and coding, and we observe that the continous scaling of RL can help a medium-size model achieve competitieve performance against gigantic MoE model. Feel free to chat with our new models and provide us feedback!

[Oleg @Cyber_0leg]

🚨 How was Black Basta structured? What were its members’ roles? How did its infrastructure operate?

Leaked chats reveal a highly organized ransomware group with defined leadership, internal teams, and external affiliates.

More in my article ⬇️

https://t.co/YJHXxf5H4n

[CERT Orange Cyberdefense @CERTCyberdef]

🆕New version of our #ransomware mapping is out on our GitHub!
➡️https://t.co/M9vmt1UZzj
V28 (!) includes latest newcomers and recent ecosystem evolutions.🔍
As always, feedback is welcome!
#cti #threatintel #blackbasta #ransomhub #lockbit

[Areenzor @Areenzor]

🚨 #VMware Zero-Days Alert:

Three critical vulnerabilities
CVE-2025-22224,
CVE-2025-22225,
CVE-2025-22226
are under active exploitation, allowing VM escape & hypervisor compromis.

#ZeroDay #CyberSecurity #infosec #CVE #Bugbounty #Malware

Details: https://t.co/wzVRg5vwVo

[Areenzor @Areenzor]

90s viruses were chaotic, flashy & kinda fun.

Today’s malware? Silent, sophisticated, and terrifying. 🦠💻

Dive into the evolution of digital threats—from prank pop-ups to billion-dollar cybercrime:

🔗 https://t.co/4nrq0qGM5m

#CyberSecurity #Malware #Hacking #Infosec

[Areenzor @Areenzor]

For low-level malware analysis, 'Practical Malware Analysis' by Sikorski & Honig is essential.

But if you want to go deeper, complement it with 'The Art of Memory Forensics' for in-depth DFIR insights.

#MalwareAnalysis #DFIR #infosec #DigitalForensics #cybersecurity

[Areenzor @Areenzor]

Want to execute shellcode without API calls?

Abuse indirect syscalls via HAL dispatch tables.

Hook NtAllocateVirtualMemory and redirect execution stealthily. EDR visibility?

Nearly zero.

#MalDev #RedTeam #Infosec #cybersecurity #powershell

[Ahmed @Mawg0ud]

➾ ShellMorph-Pro:

An Open-source cutting-edge tool for transforming Portable Executables (PE) into shellcode.

It offers:
a. Advanced Injection Techniques
b. Modular Architecture
c. Modern Platforms.

Ready to shape your ideas!

#Infosec #OpenSource

🔗 https://t.co/cXjTYjaE2t

[Areenzor @Areenzor]

Public Wi-Fi isn’t your friend. 🛑

Even with HTTPS, evil twin APs, SSL stripping & MITM attacks are still a thing.

Use a trusted VPN, or better yet .. just don’t connect.

Your data isn’t worth the risk.

#CyberSecurity #Privacy #SSL #MITM #VPN #Wifi #HTTPs

[Areenzor @Areenzor]

2017:
WannaCry spreads like wildfire, exploiting SMBv1 with EternalBlue.

Lesson?

Patching isn't optional.

If your infra still has unpatched, exposed SMB services in 2025, you’re just waiting for the next worm.

#CyberSecurity #Infosec #WannaCry #SMB #Patch

[Areenzor @Areenzor]

When we go back to 2010, Stuxnet attack redefined cyber-physical warfare.

It proved that targeting PLCs can cripple infrastructure without a single bullet fired.

ICS/SCADA security is still playing catch-up.

#CyberSecurity #History #Stuxnet #PLC #SCADA #ICS #warfare

[Areenzor @Areenzor]

Kerberos ticket delegation attacks are still underutilized.

Combine constrained delegation with 'S4U2Proxy' to impersonate high-privilege accounts without dumping creds.

Abuse the trust chain.

#RedTeam #ActiveDirectory #Kerberos #Proxy #Infosec #DFIR