Natway

#ITstudent

[0x12 Dark Development @Salsa12__]

VM Detection via MAC Address Prefix Matching

New Medium post! In this one, we will explore a simple yet effective virtual machine detection technique based on MAC address prefix matching

https://t.co/8ixPzd6wHY

[Smukx.E @5mukx]

Windows UEFI Bootkit in Rust by MemN0ps.

TLDR:- Bootkit that executes before ntoskrnl.exe and bypasses DSE using a simple .data pointer hook, sets up kernelmode manual mapper (redlotus.sys), controlled post-boot via a Rust-based use mode client.

https://t.co/YKY5KN6DAK

[IT Guy @T3chFalcon]

A 19-year-old hacker used VPNs, tunneling tools, and rotated IPs across 3 countries. The FBI still caught him. Here's the Windows feature that made it possible and why it should concern everyone.

Peter Stokes, an alleged member of Scattered Spider (the group behind $100M+ in ransomware extortion), was arrested at Helsinki Airport this April. Court documents revealed a key piece of evidence: Microsoft's GDID.

What is a GDID?
GDID = Global Device Identifier. It's a unique code baked into every Windows installation. Microsoft uses it for telemetry, crash reports, feature usage, and license verification (it's why swapping your CPU can break your Windows activation).

What Microsoft gave the FBI:
→ Web activity with timestamps
→ Gaming history
→ IP addresses used over time
→ Tool usage (including Ngrok, a tunneling app)
→ Azure account activity

All tied to one persistent device fingerprint. Even though the VPN masked his IP, it didn't affect the GDID.

How they connected the dots:
Every time Stokes logged in to Snapchat, Apple, or Facebook from a new IP address, the GDID was there too. Investigators matched timestamps across platforms and countries: Tallinn, New York, Thailand, Germany. Different IPs. Same machine. Same person.

Microsoft had already identified him in October 2024 and filed a criminal referral. He was still 17. So they waited till He turned 18. Then they moved.

Yes, Stokes is accused of serious crimes. But the GDID data exists on every Windows machine, including yours. The infrastructure that handed his entire digital life to the FBI is the same infrastructure running on your laptop right now.

The unanswered questions:
- There's no public policy on when Microsoft shares GDID data

- No known opt-out mechanism

- No transparency report specifically covering GDID disclosures

- What other criminal referrals has Microsoft quietly filed?

[cr3ghost @cr3ghost]

FuzzySecurity covers usermode exploitation, kernel exploitation, privilege escalation, persistence, credential theft, lateral movement, UAC bypass, heap internals, ROP chains, shellcoding, RFID hacking, and malware analysis. All free.

One of the few resources that takes you from basic buffer overflows all the way to kernel pool overflow and GDI bitmap abuse in a single series.

https://t.co/sBuYFKewBc

Author: @FuzzySec

#ExploitDevelopment #ReverseEngineering #InfoSec

[YungBinary @YungBinary]

New blog post covering what's changed in Amatera Stealer 4.0.2 Beta! Plus a bug I found that can be used as a vaccine.

- XTEA-encrypted strings
- C2 protocol changes (AES -> ECDH P256 + ChaCha20-Poly1305) making decryption more difficult
- SysCall SSN encoding, decoded just before WoW64Transition

https://t.co/EksdoSDQno

[🅰🅳🅼 @securityfreax]

Modern C2 implants use sleep masking & metamorphic code to stay hidden. We’re revealing how to unmask them using low-level runtime telemetry (ETW & CPU profiling) live in production including a POC with a lightweight sensor.

My team will be presenting our research at x33fcon:

https://t.co/qhtckSyxx5

[Rapid7 @rapid7]

New research from Rapid7 Labs has led to the discovery of 7 new BPFDoor variants, through which stateless C2 routing and ICMP relay work to bypass multi-million dollar security stacks & establish persistence in global telecoms.

More in a brand new blog: https://t.co/nzum0nnZvN

[Moritz @m_r_tz]

The FLARE team now freely distributes its quality reverse engineering and malware analysis educational content at https://t.co/bGCIjBfD3C. Launched with:
- Malware Analysis Crash Course
- Go Reversing Reference
- Intro to TTD

[Kyle Cucci @d4rksystem]

I uploaded all the malware samples used in my book #EvasiveMalware to my Github:

https://t.co/qaxENwi2Ge

I received some questions about the lab samples, so just posting it for everyone here 🤓

[blackorbird @blackorbird]

Python toolkit for reverse-engineering Berkeley Packet Filter (BPF) bytecode.
https://t.co/hJf9lQyKvN

[R136a1 @TheEnergyStory]

TeamPCP msbuild.exe Malware Analysis

Here is a breakdown of the execution chain, featuring EDR bypasses and steganography.

🛡️ 1. Evasion
• Dynamic SSN Resolution: The malware resolves native API functions (e.g., ZwAllocateVirtualMemory, NtProtectVirtualMemory) by matching their DJB2 hashes to dynamically extract their Syscall Service Numbers (SSNs).
• Trampoline Syscalls: To bypass EDR user-land hooks, it then searches the ntdll.dll .text section for the first occurrence of a clean syscall; ret gadget (0x0f05C3), typically finding it inside NtAccessCheck.
• Custom Syscall Stubs: Finally, it uses the extracted SSNs with custom syscall stubs. These stubs load the appropriate registers and jump to the located ntdll.dll gadget, cleanly executing indirect syscalls from a legitimate memory region.
• ETW Blinding: Neutralizes telemetry by patching the first instruction of EtwEventWrite with 0xC3 (ret).

🖼️ 2. Steganography
• Spawns a suspended dllhost.exe child process.
• Extracts the Adaptix C2 payload (shellcode loader + payload) embedded into the Red, Green, and Blue color channels of the image, while locking the Alpha (transparency) channel to fully opaque (FF).
• Writes the payload directly into an allocated buffer in dllhost.exe.

💉 3. Injection
• Instead of relying on one method, it sequentially tries multiple techniques to execute the payload in dllhost.exe:
1️⃣ APC Injection: NtQueueApcThread, NtResumeThread
2️⃣ Thread Execution Hijacking: ZwGetContextThread, ZwSetContextThread, NtResumeThread
3️⃣ Remote Thread Injection: NtCreateThreadEx, NtResumeThread
(Note: APIs for process hollowing and doppelgänging are also present but remain unused).

📡 4. Adaptix C2 Payload
• C2 URL: checkmarx[.]zone/telemetry/checkmarx.json (Defanged)
• Exfiltration: HTTP POST requests using the X-Content-ID header for encoded/encrypted data.
• User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0

🔬 5. IOCs
• Analyzed Sample: https://t.co/Xq8Jh5ngJq
• Related Sample: https://t.co/W65u77Abec

Overall, a nice mix of methods, but nothing novel.

[Tom Dörr @tom_doerr]

Patch iOS apps without jailbreak

https://t.co/IWpVDg1X2m

[DFIR Radar @DFIR_Radar]

Chinese 🇨🇳 threat actor's VoidLink rootkit exposed through leaked source code. Hybrid LKM-eBPF design evolved through 4 generations, showing sophisticated AI-assisted development that hides processes, network connections, and files across CentOS 7 to Ubuntu 22.04.

Technical details:
• LKM component uses ftrace hooks on __x64_sys_getdents64, vfs_read for process/file hiding; masquerades as "amd_mem_encrypt" AMD driver
• eBPF companion exploits bpf_probe_write_user() to manipulate Netlink buffers, hiding connections from ss utility by "swallowing" SOCK_DIAG_BY_FAMILY messages
• ICMP C2 channel uses magic value 0xC0DE, XOR key 0x42, supports 10 commands including privilege escalation (GIVE_ROOT) and self-destruct
• Advanced evasion: 3-second delayed hook installation, anti-debugging timer scanning for strace/gdb/bpftool, kill protection for designated PIDs

Infrastructure artifacts link to Alibaba Cloud 🇨🇳 IPs 8.149.128[.]10 and 116.62.172[.]147. Source code annotations in Simplified Chinese show phase-numbered development matching LLM conversation patterns.

Hunt for unsigned modules with AMD descriptions on non-AMD systems, ftrace hooks on syscall functions, and eBPF programs using bpf_probe_write_user helper.

#DFIR_Radar

[0xor0ne @0xor0ne]

Collection of papers on LLM for vulnerability detection

https://t.co/c0F7TkOvHp

#llm #infosec

[Christiaan Beek @ChristiaanBeek]

Our latest research we worked on for a long time and still goes on: https://t.co/J2D7wIKFr0 #APT #BPFdoor

[Tom Dörr @tom_doerr]

iOS SSL pinning bypass without jailbreak

https://t.co/1Q58begJvJ

[SpiderLabs @SpiderLabs]

We observed a VBS-based loader that led to a broader attacker ecosystem leveraging open directories for payload staging and delivery.
The campaign incorporated Unicode obfuscation, PNG-based payload delivery, and fileless execution to distribute malware families such as RemcosRAT and Xworm.

The infrastructure supports multiple infection chains, demonstrating a scalable and reusable threat framework.

The team dives deeper into the campaign and IOCs here: https://t.co/W800SDjy1Q

And is hosting a webinar research recap on April 2:
https://t.co/MPCdzi6KZr

[Bill Marczak @billmarczak]

Very interesting! One of the kernel exploits part of the Coruna (L3Harris/Trenchant) chain was identical (source-code-wise) to one of the exploits used by Operation Triangulation (except, the Coruna version was updated). https://t.co/GUWdW40Df2

[reverseame @reverseame]

Hunting hidden gems in libraries https://t.co/D8N1jm27Md

[blackorbird @blackorbird]

Illuminating VoidLink: Technical analysis of the VoidLink rootkit framework
Analysis of the leaked rootkit source code complements those findings by providing a deep technical look at the kernel-level subsystem that underpins VoidLink's concealment capabilities.
https://t.co/abxh2K0qV9