Curt Wilson, human

Exploring systems security since 1985. Malware+{cybercrime/espionage} analysis, threat intelligence + full-spectrum tech security research. Personal account.

[𝕡𝕨𝕟𝕚𝕖 @0day_ninja]

https://t.co/Z6lNM4ssoh

[Nextron Research ⚡️ @nextronresearch]

After Microsoft fixed BlueHammer, another Windows Defender privesc showed up: RedSun.

What makes this one interesting is that it’s not a classic memory corruption or logic bug. It looks more like Defender doing something… unexpected.

When Defender flags a file as malicious and it has a cloud verdict attached, it can end up writing that file back to its original location instead of removing it. If you can control that file and trigger the right behavior, you basically get Defender to write data for you with its elevated privileges.

The RedSun PoC shows that this can be abused to overwrite system files and escalate privileges to SYSTEM.

We took a closer look at the exploit and built detections. We’re publishing:
- Sigma rules covering different stages of the chain
- a YARA rule for the PoC

All rules are free on GitHub and also included in the free THOR Lite and THOR Lite Cloud scanner.

Sigma rules: https://t.co/w2jtiDzW4f
by @swachchhanda

YARA rule: https://t.co/vBNQkZhele
by @cod3nym

[Steven Lim @0x534c]

Hunting RedSun 🌞

Inspired by the Nightmare‑Eclipse RedSun PoC, I’ve expanded my BlueHammer KQL detection to uncover Defender’s behavioral blind spots.

Sharing my DefenderXDR hunting logic with the community — evolving the path from BlueHammer to RedSun.🎯

KQL Code: https://t.co/YK5EimNR2a

#CyberSecurity #RedSun #DetectionEngineering #DefenderXDR

[Curt Wilson, human @curtw]

@banthisguy9349 @UK_Daniel_Card Use JA4+ when it makes sense to do so. Check for reuse of custom favico files from actor infra. Not secret by any means but have borne fruit at times

[Huntress @HuntressLabs]

A single hypervisor breach can put hundreds of virtual machines at risk.

We’ve seen Akira and others shift to ESXi/Hyper-V for mass impact.
✅ They use legit tools (like openssl)
✅ Bypass EDR
✅ Encrypt VMDKs directly

📃 @RussianPanda9xx @Purp1eW0lf
https://t.co/nWxBC2Tb65

[Matthew Green @matthew_d_green]

Six years ago I wondered how we would enable scanning of end-to-end encrypted messages without destroying security and introducing trusted parties everywhere. Now in 2025, I realize the answer is: we’re going to introduce trusted parties everywhere.

[Curt Wilson, human @curtw]

Good find

[Squiblydoo @SquiblydooBlog]

This appears to be a key compromise.

Lydsec creates Keypasco, a MFA handling solution for enterprise and mobile.
The stolen key (not EV, no hardware token) was used to sign CobaltStrike.

Its not known how or who acquired the key, or what other damage was done.

[Wirebrowser @wirebrowser]

New in Wirebrowser: Breakpoint-Driven Heap Search (BDHS) — step-out debugging + temporal heap snapshots to identify the user-land function where a JavaScript value is created, even across async boundaries.

Writeup: https://t.co/1pQAUX5zlj

[Virus Bulletin @virusbtn]

LAC's Cyber Emergency Center describes a PlugX campaign by a China-based attack group targeting Japanese transport firms & their subsidiaries. The report analyses new PlugX variants MetaRAT and Talisman PlugX, and expands on findings first shared at VB2025 https://t.co/n5ZxOArZem

[Curt Wilson, human @curtw]

@tech_maddy @cyb3rops How practical is this approach though? You’d have to be making process dumps all the time. How does that scale?

[Alex Matrosov @matrosov]

https://t.co/pkcJdpmubl

[Nasreddine Bencherchali @nas_bench]

I have spent some time this past day to investigate NodeJS source code and how a typical process tree from a react/next.js app will look like.

If you are building detections for React2Shell give this a read. as it'll help you identify the right strings to use to filter down FPs and what anomalous look might like.

https://t.co/pSSYRFir6O

[International Cyber Digest @IntCyberDigest]

Read the full Amnesty report: https://t.co/B6KYMZTsR4

[Curt Wilson, human @curtw]

@whoamix302 @RussianPanda9xx Thanks for that

[Curt Wilson, human @curtw]

@APTease IMO, Matt Walsh is a hateful person who resorted to trickery to film “what is a woman”, used to increase oppression on the trans community. Seeing his work get quoted is troubling. I’m thankful for the great yara work that Florian does but can live without this type of comment.

[Curt Wilson, human @curtw]

@hackerfantastic Now that’s going to be filled with some serious heavy metal(s) 🤘🏼

[Curt Wilson, human @curtw]

No code, but looks very interesting.

[Curt Wilson, human @curtw]

@AndreGironda Who would have guessed it would be misused! 😂

[Curt Wilson, human @curtw]

@silascutler So where’s the leet stego shellcode therein? Is it XOR’ed 99e99 times to do bad things? 😂

[dreadnode @dreadnode]

"Offense and defense aren't peers. Defense is offense's child." - @JohnLaTwC

We built an LLM-powered AMSI provider and paired it against a red team agent. Then, @0xdab0 wrote a blog about it: https://t.co/TTehwMdofs

A few observations from the experiment:

>>> To advance, we must generate unique, ground-truth datasets.

>>> Defenses will need to live at the edge.

>>> The real potential lies in the interaction between red and blue.

>>> This is a blueprint for generative adversarial reinforcement learning.