Recorded and edited by the UMBC IEEE Branch.
Website: https://www.umbc.edu/ieee/
Email: ieee-student-org@umbc.edu

TrickBot's stealthy BazarBackdoor malware has been rewritten in the Nim programming language, likely to evade detection by security software.

Guess what might not be running in safe mode? An AV/EDR. Also, attackers do NOT need to be physically in front of the machine to run in…

Evasion, Credential Dumping

SharpRelay is based on the WinDivert driver. WinDivert is a kernel driver that allows for user-mode packet interception and modification

C2/post-exploitation framework. Contribute to loseys/BlackMamba development by creating an account on GitHub.

This release comes with a whole heap of bugfixes.
Big thanks to everyone who submitted PRs and fixes (@cnotin @jtothef @nheineger @Scoubi)

C2/post-exploitation framework. Contribute to loseys/BlackMamba development by creating an account on GitHub.

fw extraction to rce

Digital Forensics and Threat Hunting for Artifacts In Obscure Windows Event Logs

Alternative ways to copy your shellcode to memory in your VBA macros

About The Project Continuing from the last blog post that discussed malicious Linux Cryptocurrency miners, I have discovered new activity that blends two of my previous Cryptocurrency mining malware (aka Cryptojacking) blog posts.
By taking a deeper look…

A few days ago, I released Perfusion, an exploit tool for the RpcEptMapper registry key vulnerability that I discussed in my previous post. Here, I want to discuss the strategy I opted for when I developed the exploit. Although it is not as technical as a…