Johan

Mostly RT interesting stuff.

RT != Endorsement and all that jazz.

[_SiCk @encrypted_past]

MOM HE'S LARPING AGAIN!!!!

Windows updates don't matter when you can BYOVD.

[vx-underground @vxunderground]

Microsoft introduces Microsoft Scout, also known as Autopilot.

Scout is always on and has file system and application access "based on your corporate policy".

Best news for Threat Actors in a long time

https://t.co/M3pyfcbTBm

[vx-underground @vxunderground]

As someone who enjoys malware and malware accessories, I for one believe this to be incredible news and I applaud Satya Nadella for this

As someone who deals with malware defensively, I for one believe this is terrible news and I hate Satya Nadella so much right now it's unreal

[JFrog Security @JFrogSecurity]

The software supply chain has a new predator. 🐛

Meet Iron Worm, the "rustier cousin" of the infamous Shai-Hulud worm. Just like its predecessor, it burrows into dev environments, steals credentials, and self-propagates through trusted GitHub and npm workflows.
Except this one is built in heavy, async Rust, hides behind an eBPF kernel rootkit, and talks over Tor.

Full teardown of the beast:
https://t.co/9Tn4G8tluW

[Moshe Siman Tov Bustan @MosheTov]

I really need to get some sleep - but seeing a malware embedding it's own ebpf script inside it's packed code in order to dump and deploy it on the machine -> is some next lvl stuff...

Great work from JFrog for finding this

[Andrew @4ndr3w6S]

Round two!

Yesterday was one report, here’s another: an unpatched NTLM coercion via the Windows Search (search-ms://) URI handler.

Same questions about how it got handled. It’s all in the writeup, timeline included.

https://t.co/eMbyEGbx8b

[Fady Moheb @N1NJ10_]

Bypassing AMSI is useless if you get caught by Script Block Logging (4104) 5 seconds later.

I compiled a complete reference guide for PowerShell Defense Evasion covering the full chain: AMSI, AppLocker, CLM escapes, and blinding the logs.

Read the full breakdown below

https://t.co/VTCTVGq6Zp

[Askar @askardyuss]

Spotted a new signed malware sample (MD5 E75C6D87CC5DC04B2F28DF3E6C6FB908) by APT-Q-27 (aka DragonBreath / Golden Eye Dog).

The obfuscated .NET executable was signed at 28.03.2026 and belongs to Taiyuan Yuansu E-commerce Co., Ltd (s/n 32a51e44b13f18e80c4c3d5f by @globalsign @GlobalSignAPAC). Payloads are stored at https[:]//storage.googleapis[.]com/uuupdat/us.txt, but this bucket is already taken down.

#ThreatIntel #MalwareAnalysis #APT

[Brian in Pittsburgh @arekfurt]

Auth policy silos in AD are so, so massively underutilized. Especially when it comes to securing privileged accounts by requiring them to be used only from certain groups of hardened devices.

[Abdul Mhanni @abdo_mhanni]

Did an engagement sometime back where Certipy and Certify both failed to discover the ESC8 vuln due to the web enrollment endpoint being configured on a standalone/separate Web server.

I wrote about this edge case on my blog here: https://t.co/3RjopWLA18

[Fady Moheb @N1NJ10_]

Stop burning RDP persistence with 4732 alerts. Bypass the "Remote Desktop Users" group entirely.
GUI access only requires:

- SeRemoteInteractiveLogonRight (Inject SID via secedit)
- RDP-Tcp listener permissions (Modify CIM class)

OPSEC: Trades 4732 for 4704. Most SOCs don't tune 4704 with the same aggression.

h/t @Cptjesus for the concept.

[Askar @askardyuss]

Same technique (VHDX + RLO + DLL sideloading) was used to execute the variant of malicious DLL (MD5 68088E5032370006560FF1035B3F2E72).

[Ridgeline Cyber @RidgelineCyber]

Your XDR monitors vssadmin.exe and ntdsutil.exe. If an attacker runs those binaries on a DC, a high-severity alert is triggered.

So how do real-world threat actors still walk away with ntds.dit?

They don't use the standard Windows utilities. They use native API calls or alternative administrative mechanisms to interact with the Volume Shadow Copy (VSS) service directly—masking the extraction as routine backup operations.

Instead of spawning loud processes, sophisticated actors manipulate VSS via:

Direct COM/API interaction: Compiling custom binaries that call the VSS API directly, bypassing process-name logging entirely.

NTDSDumpEx or native Esentutl: Leveraging esentutl.exe (a native Windows database utility) to copy locked database files via alternative volume paths.

PowerShell WMI/CIM objects: Invoking the Win32_ShadowCopy class directly to create snapshots without ever touching vssadmin.

If you are only waiting for an EDR signature on "ntdsutil," you are missing the broader footprint of snapshot manipulation.

To build resilient detection strategies, look for the underlying side effects: untrusted non-system processes mounting global root paths or atypical processes reading directly from a volume snapshot folder.

You don't need complex queries to detect these activities. Drop the below into your MDE or Sentinel to identify anomalous processes interacting with shadow copy volumes:

[Zion Leonahenahe Basque @mahal0z]

For years, Rust binaries made reversing a nightmare. Modern decompilers only support C, lacking meaningful types, constructs, and language-specific functions. Led by @34r7hm4n, we're releasing our S&P work Oxidizer, the first deep Rust decompiler, built on angr!

Interested? 🧵👇

[Johan @Syndikalist]

@vxunderground Happy belated birthday to your website!

I just saw this video and thought of you, Smelly:
https://t.co/9FyNjWMzH8

[王依依棺材馅儿 @ec12edfae2cb221]

不升级 -> 0day.
升级 -> 供应链攻击.

[Justin Elze @HackingLZ]

👀 https://t.co/qh5IpGgJGx

[Ayush Anand @Securityinbits]

https://t.co/qBnJ7YpxsA

[Steven Lim @0x534c]

🧙‍♂️Kongtukes Unmasked — DefenderXDR detection of evolved Modelorat🐀

https://t.co/Xkjri3CnSL

Threat actors never stop iterating. Kongtukes has evolved its help desk lure playbook into the Modelorat campaign — a reminder that social engineering remains one of the most effective initial access tactics.

To stay ahead, I built a KQL threat detection that flags suspicious helpdesk style Teams impersonation attempt and traces the pivot into RAT activity. This detection logic ensures SecOps teams don’t miss the earliest signals of compromise.

https://t.co/PvuBemDakV

#ThreatHunting #DefenderXDR #Kongtukes #DetectionEngineering

[L0Psec @L0Psec]

Another cool share by @malwrhunterteam: 5d67f810bea19b9c3489e0981559af4340be39f188460938c7b11fea854ed06e. Currently has 7 VT hits, potentially DPRK? (based on detections) Most interesting thing is that it is signed: Alex Lopez (VLV25ZF66P)