MrP

Dune

[Kurosh Dabbagh @_Kudaes_]

I've released Puzzle, a research project on deploying malware in monitored environments by abusing Windows minifilters functionality. It includes several utilities and PoCs to interact with minifilters and explore static and runtime analysis evasion 👐

https://t.co/8zWv1g8n79

[BlackArrow @BlackArrowSec]

Microsoft has addressed a one-click NTLM leak vulnerability affecting Windows Snipping Tool (CVE-2026-33829), discovered by our researcher Marcos Díaz (@Calvaruga).

➡️ Read the write-up: https://t.co/JvMGad5NuI
➡️ Microsoft bulletin: https://t.co/0IbpRxxUY7

[BlackArrow @BlackArrowSec]

Meetings You Didn’t Plan, But We Did

In this post, @ineesdv breaks down how calendar event processing in Outlook and Gmail can be abused to deliver spoofed meeting invites that are automatically added to a user's calendar without interaction

➡️Read more: https://t.co/7RApljHair

[BlackArrow @BlackArrowSec]

AvePoint has fixed a vulnerability in DocAve, Perimeter and Compliance Guardian discovered by our researchers @m1ntko and @Calvaruga.

This vulnerability can be used to achieve Remote Code Execution (RCE) in affected systems.

➡️ Advisory: https://t.co/bD9hLomlG1

[ATTL4S @DaniLJ94]

Hoy a las 20:00 (hora España) estaré hablando sobre Windows, suplantación de usuarios y movimientos laterales en el canal de @AlbertoJGarci11

YouTube: HablemosCyber

[ATTL4S @DaniLJ94]

@BHinfoSecurity My site https://t.co/1L9XIBDuiZ and my YouTube channel (ATTL4S). I have multiple presentations about Active Directory, Windows and C2 - among other topics. Thanks for this.

[Kurosh Dabbagh @_Kudaes_]

I've just released Eclipse, a PoC of what I call Activation Context Hijack. This technique redirects any application to load an arbitray DLL, allowing to inject code into any trusted process. More info available on Github. https://t.co/SgFHpaRJc1

[X-C3LL @TheXC3LL]

You can find my slides for "Offensive VBA" talk here https://t.co/QblUB0yhSS

[Kurosh Dabbagh @_Kudaes_]

Unwinder 0.1.2 now offers a different call stack spoofing mechanism besides SilentMoonWalk: stack replacement. It is fully functional and ready to use, but keep in mind that it is still under development and some bugs may appear.

[SpecterOps @SpecterOps]

LSA Whisperer focuses on interacting with Authentication Packages using their individual message protocols. Read @mcbroom_evan's NEW blog post detailing the journey developing the project to learn more. ⬇️ https://t.co/q93eSvPP0i

[Kurosh Dabbagh @_Kudaes_]

Although it's nothing new, @ineesdv and I are pleased to publish our own ROP-based implementation of the code fluctuation technique. We've tried to keep it simple and functional, avoiding to use common features like Timers, HWBP or APCs. https://t.co/sm2O310XNg

[BlackArrow @BlackArrowSec]

Our colleagues @_Kudaes_ & @ineesdv will be at #HackOn2024 presenting an alternative approach to ROP-based sleep obfuscation technique to evade memory scanners.

➡️ Read more: https://t.co/stknNHL5Zd

[BlackArrow @BlackArrowSec]

Our colleague @IagoAbad has weaponized the leaked token handles technique for MSSQL.

Now open token handles in MSSQL's process (sqlservr.exe) can be abused to change security context and escalate privileges both locally and in the domain.

https://t.co/JmXSDrLMfH

[Kurosh Dabbagh @_Kudaes_]

Call stack spoofing has reached Rust🙌. I have rewritten Unwinder and it is now a complete and stable weaponization of SilentMoonWalk technique. I have also added support for indirect syscalls and will be adding new features very soon. https://t.co/9gUEanO9p4

[BlackArrow @BlackArrowSec]

The @NavajaNegra_AB conference is just around the corner! @_Kudaes_ will be on-site to talk about malware development and EDR evasion.

➡️ Read more: https://t.co/zFZgCnNb1d

[ATTL4S @DaniLJ94]

First video of "Understanding a Payload's Life" uploaded. As soon as I have some spare time I'll be recording more. Enjoy!

https://t.co/AJsQvUgFws

[BlackArrow @BlackArrowSec]

Watchguard has fixed 4 vulnerabilities in Watchguard EPDR discovered by our researchers @antuache and @Calvaruga.

These vulnerabilities can be used to turn-off the defensive capabilities of the product and achieve privilege escalation.

➡️ Advisories: https://t.co/uJGhFsI5VR

[MDSec @MDSecLabs]

"A not so pleasant password manager" - a look at how we attacked Pleasant Password Server during a recent red team project by @au5_mate and @TheXC3LL https://t.co/GQTXeTigLe

[X-C3LL @TheXC3LL]

To difficult using reverse proxies for phishing (Muraena, Evilnginx, etc.) you can use JS + server side validation to modify flow and raise an alert. Although it's 5 years old, I believe still relevant the usage of anti-debugging tricks in JS for this https://t.co/gVpQoPlgXV