1/ Recently an unnamed source shared data exfiltrated from an internal North Korean payment server containing 390 accounts, chat logs, crypto transactions.
I spent long hours going through all of it, none of which has ever been publicly released.
It revealed an intricate ~$1M/month scheme of fraudulent identities, forged legal documents, and crypto-to-fiat conversion.
Enjoy the findings!
#ESETresearch discovered and analyzed a previously undocumented malicious tool for network devices that we have named #EdgeStepper, enabling China-aligned #PlushDaemon APT to perform adversary-in-the-middle to hijack updates to deliver malware. @0xfmz https://t.co/7ZaOFdA9ZB 1/5
Powerview 2025.1.5:
Added --obfuscate flag to obfuscate ldap filters and base DN. This is heavily inspired by https://t.co/pUjXHK01N5 obfuscation logic by @MacmodSec
Credits to the original research "MaLDAPtive" by @sabi_elezi and @danielhbohannon
1/ An unnamed source recently compromised a DPRK IT worker device which provided insights into how a small team of five ITWs operated 30+ fake identities with government IDs and purchased Upwork/LinkedIn accounts to obtain developer jobs at projects.
Speaking at @defcon was as fun as always! My new tool called RPC-Racer is now available. It masquerades as a legitimate RPC server to force a protected process to authenticate against an arbitrary server
https://t.co/TDO8H36ZEM
The 2025 @CrowdStrike Threat Hunting Report was released today. The OverWatch team did an incredible job stopping an unprecedented number of threats in the last year, Cloud intrusions are up 136% with China based cloud intrusions up 40%! Get the report:
https://t.co/13Y4RErAxi
Reverse engineering Microsoft’s SQLCMD.exe to implement Channel Binding support for MSSQL into Impacket’s https://t.co/w12YmS1m89. Storytime from Aurelien (@Defte_), including instructions for reproducing the test environment yourself.
(link below)
I have launched YSoNet (https://t.co/Imw4otKTq9) and added #SharePoint CVE-2025-49704 payload generator to it as the first thing.
Here is how this can work:
Running command:
```
ysonet.exe -p sharepoint --cve=CVE-2025-49704 -var 1 -c "calc"
```
Running C# code:
```
ysonet.exe -p sharepoint --cve=CVE-2025-49704 -var 2 -c "C:\\temp\\ExploitClass.cs;System.dll"
```
Payloads will be url-encoded already.
YSoNet is a fork and replacement of YSoSerial .Net (for me) and I will try to maintain my own version now to have full control over the settings. There are many things I have to change there but all changes will be gradual.
Of course you can still use the great YSoSerial .NET repo but I won't be the one maintaining it. Hopefully I can make @pwntester proud 😊
Introducing Stifle! A super simple .NET tool I spun up these past few days for abusing explicit strong certificate mappings leading to impersonation in Active Directory! Based off the research and powershell tools by @Jonas_B_K and @SpecterOps last year.
https://t.co/AT7DFgBYOU
The fact that @xiaohongshu's 小红书 (TikTok alternative)'s app literally contains the "backdoor" in several places in the app code is hilarious. Probably fallback protocols, but boy they didn't even try! 🤣
So you want to exploit ADCS ESC8 with only netexec and ntlmrelayx ? Fear not my friend, I will show you how to do it 👇
NetExec now supports "Pass-the-Cert" as an authentication method, thanks to @_dirkjan original work on PKINITtools ⛱️
🐧 It’s finally here! 🔍
The Linux EDR Telemetry Project results are live! After months of testing and collaboration, we’re excited to share how well EDR solutions handle Linux visibility.
Thank you to everyone who contributed, shared feedback, and supported the project! Your help made this possible. 🙌
Read the full blog here: 📝👇
https://t.co/S8c1luzZCO
🔗 Linux Results: https://t.co/L7Aq7Ko9NR
🔗 Scores: https://t.co/3WdJC7ASOr
If you want to support the project and help us keep it going, check out 👉 https://t.co/ZDPf7r6idK
Just finished redeveloping the Rubeus monitor plugin in C to avoid uploading a full Rubeus to exploit unconstrained delegation.
For now I have the :
- List/Inject/Dump tickets
- AskTGT/AskTGS
- TGTDeleg
All the exe file are less than 20KB which is really nice.
Telegram has launched a pretty intense campaign to malign Signal as insecure, with assistance from Elon Musk. The goal seems to be to get activists to switch away from encrypted Signal to mostly-unencrypted Telegram. I want to talk about this a bit. 1/