MΞTΛΞXPL0ЯΞ

Security Researcher,Reverse Engineer and Programmer - Tweets are my own

[TrendAI™ Research @trendai_RSRCH]

TrendAI™ Research has uncovered "Quasar Linux" (QLNX), a sophisticated Linux RAT that evades detection with rootkit and PAM backdoor techniques. QLNX targets developer credentials used to publish code and access cloud infrastructure. Full research: https://t.co/L6Od5GAPoy

[Aliakbar Zahravi @AliakbarZahravi]

🚨 New research out: 

👾 Meet GhostPenguin: A multi-threaded Linux backdoor RC5-encrypted UDP channels for C2 communication . Read the full technical breakdown of this new threat here: https://t.co/g48jD8bA3V

#Malware #GhostPenguin #InfoSec #Linux #backdoor #ThreatHunting

[Aliakbar Zahravi @AliakbarZahravi]

🚨 New research out:  Critical Langflow #Vulnerability (#CVE-2025-3248 - CVSS 9.8) Actively Exploited to Deliver #Flodrix #Botnet.

https://t.co/4tLldBtTWr

#CVE20253248 #Malware #InfoSec #Cybersecurity #CyberAttack #exploit

[Aliakbar Zahravi @AliakbarZahravi]

🚨 Inside the Water Gamayun Arsenal: We’ve just released a comprehensive analysis of the tools and #backdoors used by #WaterGamayun (aka #Encrypthub).

🔍 Dive into the full report:
https://t.co/BXi4UolP53
#CVE-2025-26633 #ThreatResearch #APT #malware

[TrendAI™ Research @trendai_RSRCH]

Trend Research uncovers Water Gamayun’s arsenal and infrastructure. This suspected Russian threat actor exploits the CVE-2025-26633 #zeroday #vulnerability to execute malicious code and exfiltrate data from compromised systems.

Read more: ⬇️https://t.co/25Srz2IHDN

[TrendAI™ Research @trendai_RSRCH]

1/6 Water Gamayun, a suspected Russian threat actor, is exploiting the CVE-2025-26633 vulnerability to execute malicious code and steal data. This #zeroday #vulnerability poses significant risks to businesses.

Here's what you need to know: https://t.co/Dmyt56AOM6

[Aliakbar Zahravi @AliakbarZahravi]

🚨🕵️ 1/3 We've released our research on #CVE-2025-26633 — detailing how Water Gamayun (aka. #EncryptHub) weaponizes MUIPath via the MSC #EvilTwin technique.
This bug in Microsoft Management Console (mmc.exe) is abused to proxy execute #malicious code on an infected system.👇🧵

[Aliakbar Zahravi @AliakbarZahravi]

We have uncovered a Windows .lnk shortcut bug (#ZDI-CAN-25373) being exploited by #APT groups and cybercriminals worldwide. This bug in Windows  .lnk files allows attackers to execute hidden malicious commands that aren't visible when viewing shortcut properties. More details 🧵

[7h3h4ckv157 @7h3h4ckv157]

Windows Persistence Map v0.1

Credit & Source: https://t.co/UpyQEQOOTg

[TrendAI™ Research @trendai_RSRCH]

Red team tools offer many benefits, but their dual-use nature also poses substantial risks, underscoring the need for strong ethical guidelines and effective detection capabilities.

Here’s what you need to know: ⬇️ https://t.co/ctOJypYBHP

[MΞTΛΞXPL0ЯΞ @Meta_Explore]

New research on the use of open-source #redteaming tools in #malware development and #cyberattacks. Learn how AI can detect trending repositories and generate analysis reports. 🛡️ #CyberSecurity #AI #RedTeaming #ThreatHunting

🔗 Read more:

https://t.co/37LhheSeQI

[MΞTΛΞXPL0ЯΞ @Meta_Explore]

Void Banshee #exploit #CVE-2024-38112 to infect victim machines with the #Atlantida info-#stealer
https://t.co/7t4nMO53Dr

#zeroday #malware #infosec #exploit

[MΞTΛΞXPL0ЯΞ @Meta_Explore]

Void Arachne campaign and in-depth analysis of Winos 4.0 C&C framework.

https://t.co/fMCNokDYLq

#infosec #cybersecurity #backdoor #cyberthreats #malwareanalysis #AI #CyberAttack #Deepfake #malware #RAT

[jro @junr0n]

Finally found some time this weekend to work on an IDA plugin I've always wanted

[Pedram Amini @pedramamini]

The https://t.co/DSo6yZBM6J decompiler has gone open source:

https://t.co/SXQPlyaiKL

https://t.co/IeGBPsDmWl

[Peter Girnus 🦅 @gothburz]

🚨 🔎 In January, the @thezdi reported CVE-2024-21412 (ZDI-CAN-23100) to @MsftSecIntel . In the course of our investigation, we discovered that the Water Hydra group was exploiting a Windows Defender SmartScreen Security bypass, as well as the operators of DarkGate malware, who were exploiting both CVE-2024-21412 (as a zero-day) and CVE-2023-36025 (as an n-day). This incident highlights how distinct threat actor groups may independently exploit zero-day vulnerabilities before the vendors become aware of any security vulnerabilities in their products.

🤝 Fantastic analysis and collaboration with my colleague Aliakbar Zahravi (@AliakbarZahravi), who is always a pleasure to work with.

See you all at Pwn2Own and CanSecWest 2024 in Vancouver! 🍻

https://t.co/AlJZBbVCjZ

[Aliakbar Zahravi @AliakbarZahravi]

🚨🚨We have discovered a 0-day #exploitation (#CVE-2024-21412) carried out by Water Hydra (#DarkCasino), deploying the #DarkMe #RAT against financial traders. For detailed insights:
https://t.co/0S7OdfHDJb
#malware #patchtuesday #ThreatIntelligence

[Pavel Yosifovich @zodiacon]

Simple x86/x64 assembler and emulator:
https://t.co/3hmuRittkK

[TrendAI™ Research @trendai_RSRCH]

.@TrendMicro has found a malicious Chrome extension targeting Latin America that we’ve named “ParaSiteSnatcher." It allows threat actors to monitor, manipulate, and exfiltrate highly sensitive information from multiple sources.

Read: ⬇️ https://t.co/13XYnoHAgT

[Meeting C++ @meetingcpp]

A free Modern C++ programming course on Github
https://t.co/UgTlKXXRkz
#cpp
#cplusplus