Alfred_M

Alfred_M

[📕「マルウエアの教科書」著者 | 吉川孝志 | 増補改訂版🌟発売中 @MalwareBibleJP]

Go言語で記述されたローダー「GoFlateLoader」が700〜950MBにまでPEファイルを人為的に肥大化させ、AV/EDRの最大スキャンサイズ制限やVirusTotalの650MBアップロード上限を回避する手法で配布されているとのこと。PEオーバーレイ領域にデータを付加するだけの単純なサイズ水増し手法で、アンチデバッグやアンチVM機能は確認されていない模様。メモリ上でのPEロードを行い、Lumma、Vidar、StealC、SvitStealerなど複数のインフォスティーラーを展開します。

【要点の整理】

・2026年4月以降に3万3000人以上のユニークユーザーが保護されたとされ、サイズ水増しによる超過がスキャンの盲点として実際に機能している状況がうかがえる

・PE実行にはGoのsyscall.Syscallを本来のOSシステムコール発行ではなく汎用的な呼び出しゲートとして悪用し、ハードコードされた引数1,2,3,4で呼び出す方式が使われている。Go言語の実行ファイルは静的リンクによりファイルサイズが大きくなりやすく、サイズ増加の違和感が軽減される側面がある

・配布経路は偽クラックソフトと、悪性TDS経由でパスワード付きアーカイブを配布する手法が確認されている

・ファイル肥大化自体は古い回避手法だが、多くのセキュリティ製品が処理効率のためにサイズ上限を設けている現状を突いた実用性がある。エンドポイント製品のスキャン上限設定の確認が推奨される

詳細は以下を参照：

https://t.co/6i16N2AN2I

[Mr. OS @ksg93rd]

https://t.co/ONjQXBncj9

DCOMIllusionist

Windows fileless latteral movement technique.

#github #tools

[MagicSword @magicswordio]

CISA, NSA, and FBI published joint guidance on Living Off the Land attacks. LOLDrivers and LOLRMM, built by our founders, are cited in it. MagicSword turns that intelligence into preventative controls.

👉 https://t.co/QoV09bo2VX

#CISA #LivingOffTheLand #LOLDrivers #LOLRMM #ApplicationControl #CyberSecurity #PreventionEngineering

[Vincent Yiu @vysecurity]

Turns out the Russian guy was using https://t.co/KU1ukP7Esx to run the FortiBleed...

[Clandestine @akaclandestine]

FortiBleed — Fortinet Firewall & VPN Exposure Lookup | Zenox https://t.co/UEkIxLI2HB

[7h3h4ckv157 @7h3h4ckv157]

How I Use Every Claude Code Feature as a Security Engineer - Part 1

Author: Muh. Fani "Rama" Akbar
Read: https://t.co/qogHXeDacc

[Panos Gkatziroulis 🦄 @ipurple]

🚨 Since @TwoSevenOneT dropped the EDRChoker article, I’ve noticed some inaccurate detection guidance around the registry key monitoring.
🧠 Specifically, when a QoS policy is created in ActiveStore, nothing is written to the registry. More details ⤵️
🖊️ https://t.co/eE844iirbX

[Nicolas Krassas @Dinosn]

Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file data straight from disk. https://t.co/HBmGQZRNfz

[0xor0ne @0xor0ne]

Building autonomous vulnerability hunting lab with Claude Code + MCP

https://t.co/MT4LbPOVGU

#infosec #llm

[7h3h4ckv157 @7h3h4ckv157]

PhantomCtx: A New Approach to Activation Context Hijacking for EDR Evasion

Credit: rexmax[.]dev
Link: https://t.co/APzJuBTB0u

[7h3h4ckv157 @7h3h4ckv157]

CloudFox 📍

It’s an open source command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure.

Source: https://t.co/8RTsqYR2V0

[Nightmare Eclipse @ChaoticEclipse0]

Funny how Microsoft attempts to fix Defender resulted in a bug that causes Defender to be unable to delete any malware with NTFS ADS file name, something like C:\test:mlwr.exe will never be deleted by Defender, will be detected but always fails to delete.

[Dark Web Informer @DarkWebInformer]

💥 Telegram OSINT: Terminal-based Telegram OSINT toolkit - profile users, analyse channels, enumerate members, and search chats, with JSON/CSV/Markdown export.

GitHub: https://t.co/KS21Ysns5C

[BRute Logic @BRuteLogic]

The Crypto Layer Bug Bounty Misses

Every bug bounty hunter tests for SQLi, XSS, IDOR, auth bypass.

Almost nobody tests the crypto layer.

Not because it's hard. Because nobody showed them where to look.

The server doesn't hand you the key. It leaks math through its behavior.

A timing delta. A Content-Length difference of three bytes. A distinct HTTP status code on bad padding.

That's the oracle. The oracle exists before you exploit it.

CVE-2025-22150 undici, the HTTP client behind Node.js fetch, insufficient randomness in session token generation. Every modern Node.js app is a candidate. One curl captures the token. UUIDv1 structure exposes MAC address and timestamp. The Iterate step enumerates a ±1 second window, 10 million 100ns ticks. The Take step hijacks the session.

BREACH turns HTTP compression into a CSRF token extractor. The oracle isn't in the app: it's in Nginx, running silently at the proxy layer. Most hunters check "does the app use compression" and move on. The oracle is already there.

Padding oracle: one malformed ciphertext, one status code difference. Byte by byte, the plaintext surrenders. Then you forge the admin token and fire it.
That's LIT. Leak. Iterate. Take.

This work covers 4 attack families. 21 CVEs. 5 chapters. Padding oracles. Compression oracles. PRNG seed recovery. Hash length extension.

Every technique has a LIT-labeled PoC. Every command tested on Ubuntu 24. No theory without payload. No placeholder code.

Three original detection primitives named here first: Oracle Classifier, Compression Oracle Probe, Signature Surface Probe. No existing scanner packages these as standalone pre-flight checks.

Most hunters walk past this every day.

Full breakdown in the replies.

[Hacking Articles @hackinarticles]

Network Pivoting: Ligolo-MP Complete Guide

🔥 Telegram: https://t.co/upuP8k8ckB
✴ Twitter: https://t.co/Za7rYILz6E

Network pivoting allows attackers to move deeper into internal networks using a compromised machine as a bridge to access hidden systems and services.

⚡ Key Highlights
🔗 Pivot into internal networks
🌐 Access hidden subnets & services
🔄 Route traffic through compromised host
🚀 Perform lateral movement & internal recon

⚡ Ligolo-MP Advantages
🧠 VPN-like tunneling (TUN interface)
🔐 Encrypted communication (mTLS)
⚡ Multiple concurrent tunnels
🧑‍🤝‍🧑 Multiplayer pivoting support
📡 No need for SOCKS/port forwarding

💡 Ligolo-MP creates a tunnel that makes your attacker machine behave as if it is inside the target network, enabling tools like Nmap to scan internal systems directly.

📖 Article: https://t.co/93XiDgOyux

#CyberSecurity #EthicalHacking #RedTeam #Pentesting #Pivoting #Networking #Ligolo #InfoSec

[Panos Gkatziroulis 🦄 @ipurple]

Security content lifecycle management for Microsoft Sentinel and Microsoft Defender XDR https://t.co/qvrOT0IRTl

[Clandestine @akaclandestine]

scp.exe -S "cmd /c c:\windows\system32\calc.exe" . localhost:.

[Vivek | Cybersecurity @VivekIntel]

🛡️ CrowdSec: Open-Source Crowd-Powered Threat Detection & Protection

CrowdSec is a modern open-source security platform that combines IDS, IPS, WAF capabilities, and community-driven threat intelligence.

Key Features:

🔹 Real-Time Threat Detection
🔹 Community-Powered Malicious IP Blocklist
🔹 Log Analysis & Behavioral Detection
🔹 Automated Remediation
🔹 Web Attack, Brute Force & Port Scan Detection
🔹 Docker, Kubernetes, Linux, Windows & OpnSense Support

The more organizations contribute, the stronger the collective defense becomes.

🔗 https://t.co/QBJj09lEVF

#CrowdSec #ThreatIntelligence #BlueTeam #CyberSecurity #SOC #DFIR #NetworkSecurity

[BRute Logic @BRuteLogic]

Wayback URL Recon - One Liner

curl -s 'https://web .archive.org/cdx/search/cdx?url=testphp.vulnweb.com/*&output=text&fl=original&collapse=urlkey&filter=statuscode:200' | grep -viP '\.(png|jpg|jpeg|gif|svg|ico|pdf|css|mp4|woff2?|ttf|eot)(\?|$)' | sed 's/:80\//\//' | sort -u

[Panos Gkatziroulis 🦄 @ipurple]

Hopefully, more techniques will be added, but this project is very interesting for Purple Teamers and Defenders https://t.co/J20Aq4r3Og