ZEROTRACE LAB

Offensive security R&D Firm turning original research into real world offensive capabilities.

[ZEROTRACE LAB @zerotracelab]

The QTFY Hunt: How Chinese Hackers Were Tracked and How the Internet Became the Sensor

In a new analysis, our researcher @theclu5ter examines how QTFY’s infrastructure was uncovered, how legitimate commercial proxy networks were used to conceal operations, and why visibility across the internet can reveal what conventional security tools miss.

Read the full analysis: https://t.co/8UqBsW5Y4X

[Smukx.E @5mukx]

for the past months, I've been focused on building a custom compiler for my vanguard engine . I wanted something simple and flexible. rewriting an entire compiler makes zero sense. so i took clang/LLVM, customized it heavily, and pushed until achieving my goal.

It got smaller, a much smaller.

same source, same features. the production vanguard beacon went from 141,245 bytes (with full features) down to 112,130. That's minus 20.62%. when you compile with selective features. it becomes even less smaller <00kb

you will ask what is the point building all of this ?

less shellcode means less memory to allocate, protect, and encrypt during every sleep cycle. no wasted padding, no unnecessary identifying strings, and less entropy and signature to pick up on. the main goal of my vanguard project is to give operators: flexibility and evasion capabilities during their engagements.

when i am developing the engine, i really loved digging into the underlying compiler internals concepts and found a few more interesting things for pic that i will be blogging about in our lab: @zerotracelab

Also i want to show some thing i worked on yesterday:- [2nd pic is a modified version of foliage apc with 112 bytes with full compilation features] ...

[ZEROTRACE LAB @zerotracelab]

In our latest research, @5mukx researched about the Windows Global Device Identifier (GDID) to understand how it works and whether it is possible to modify or patch another device's GDID.

Read the full research here: https://t.co/8Fd0RzYfg5

[ZEROTRACE LAB @zerotracelab]

Can Chrome Remote Desktop lead to red team operations? Can it be used for monitoring and spying purposes?

@5mukx dives into its internals, explores its architecture, reverse engineers its components, and finds a way to make it possible.

https://t.co/Z2eZw4s3Vc