goabout2

Security researcher of RedDrip Team（@RedDrip7）.

[goabout2 @goabout21]

Several interesting zero-day attack cases analyzed previously，The link to the English version of the article is in the reply.

[RedDrip Team @RedDrip7]

#APT
Since the disclosure of the #ZipperDown vulnerability in 2018, this is the first observed case of its in-the-wild exploitation by APT groups. Northeast Asian threat actors used it to target Android devices of individuals in North Korea and Northeast China.

[goabout2 @goabout21]

@mistymntncop 👍👍

[goabout2 @goabout21]

My analysis of Windows CLFS #EoP vuln (#CVE-2025-29824) in-the-wild exploitation sample and root cause,It should have been released earlier, but was delayed until now due to various reasons.

[RedDrip Team @RedDrip7]

Analysis of Windows CLFS #EoP vuln (#CVE-2025-29824) in-the-wild exploitation sample and root cause

Report: https://t.co/DTXak2WHqC

ITW sample: https://t.co/ORwLV6dkJW

[goabout2 @goabout21]

My brief Analysis of Chrome's 0day CVE-2025-6554 in the Wild,it's really insterating,thanks sharing of @DarkNavyOrg,@mistymntncop before.

[RedDrip Team @RedDrip7]

Brief analysis of Chrome vuln #CVE-2025-6554, which was exploited in the wild.

https://t.co/s0ru9dawua

[goabout2 @goabout21]

we find a 0day of foxmail used by APT-Q-12，now,everything is ok.

[RedDrip Team @RedDrip7]

#APT #APT-Q-12
APT-Q-12 has exploited a #0day existing in the Foxmail Windows client in recent campaign and we reported it to Tencent immediately. Now the vuln has been fixed and Windows users are suggested updating to latest version 7.2.25 (2025-03-28).

https://t.co/62NhGHAb3u

[goabout2 @goabout21]

@dnpushme it's cup？

[goabout2 @goabout21]

@ClearskySec The directory is set as the ActiveX cache folder file name through the guid in desktop.ini. Its attribute is a system hidden read-only directory. You can see this directory by unchecking the option to hide protected operating system files.

[goabout2 @goabout21]

New year, new research, a wild nday privilege escalation vulnerability reasearch I discovered some time ago, this time there is no ascii flow，Thanks to the intelligence from Clément Lecigne of Google Just now, the github project of this vul is as follows https://t.co/tlANSCOHPT

[RedDrip Team @RedDrip7]

Threats from ALPC -- Root cause research of an unknown Windows Nday #EoP vulnerability in the wild, which was fixed in August 2024.

Report: https://t.co/rcMKidXby6

ITW sample: https://t.co/tyfIz1z5BG

[goabout2 @goabout21]

@kevin_backhouse I also encountered this error

[goabout2 @goabout21]

@HaifeiLi for me，your flash research is my security analyze star，now thinking back, that was many years ago.

[goabout2 @goabout21]

@jq0904 yes，you are right，privilege limitations of the dwm process is the main reason，But it does cause some trouble for security software detection，I forgot to edit it, thanks for pointing this out，tks，bro！！

[goabout2 @goabout21]

my analyze about CVE-2024-30051,i realy like this ascii flow

[RedDrip Team @RedDrip7]

Analysis of Windows DWM #EoP vuln (#CVE-2024-30051) in-the-wild exploitation sample and root cause

https://t.co/xUMTGuhnQD

[goabout2 @goabout21]

@jq0904 @Mas0nShi cool，finally waited for this https://t.co/WTxQ8yRTkg🙃🙂🙃🙂

[goabout2 @goabout21]

amazeing！！

[Boris Larin @oct0xor]

We're revealing details of an obscure debugging feature in the Apple A12-A16 SoC’s that bypasses all of the hard-to-hack hardware-based memory protections on new iPhones. Its not used by the firmware and we don't know how the attackers found out about it. https://t.co/hsQo6JIPMJ

[goabout2 @goabout21]

@wdormann Besides, have you tested it in wrod? When I tested it in word, when redir_obj.htm called 1111.htm, it stopped loading the subsequent chm, but the same It is work under ie.

[goabout2 @goabout21]

@wdormann hello， Is **_file001.zip a directory or a compressed path when you test? In my test, if it is a compressed package, it seems that it cannot be executed.

[goabout2 @goabout21]

Writing reports is a pain and I have to spend more time doing them than debugging���

[RedDrip Team @RedDrip7]

Windows CLFS #EoP #CVE-2023-28252
Analysis of in-the-wild exp sample and vuln root cause

Check out the report for more details: https://t.co/cuFstpbizn

[goabout2 @goabout21]

@jq0904 i miss it,shit 🤣🤣🤣🤣

[goabout2 @goabout21]

I have to say the exploit technique of CVE-2021-31956 this attack is indeed very insterting

[RedDrip Team @RedDrip7]

#PuzzleMaker
We found a complete exploit chain which involves #Chrome #RCE vuln #CVE-2021-21224 and Windows EoP vuln #CVE-2021-31956 in the wild. This exploit chain allows attackers to escape Chrome sandbox and execute code with Windows system privileges.

https://t.co/W3sPCNtR2G

[RedDrip Team @RedDrip7]

#PuzzleMaker
We found a complete exploit chain which involves #Chrome #RCE vuln #CVE-2021-21224 and Windows EoP vuln #CVE-2021-31956 in the wild. This exploit chain allows attackers to escape Chrome sandbox and execute code with Windows system privileges.

https://t.co/W3sPCNtR2G