2026_06_x33fcon_Bring_Your_Own_Everything_-_The_Final_Approach.pdf

Malware - The Misunderstood Industry.pdf

This article said everything I had been telling my buddies

BSides Prishtina 2026 slides.

Full PoC code will be published in my blog soon. Enjoy!

#conference #hacking #malware #math #physics #programming #threatintel #cybersecurity #research

LACUNA Chain: Ghost Frames Defeat Every Layer of EDR Call-Stack Detection

Original text: “LACUNA Chain: Ghost Frames — defeats all EDR layers of call-stack-based detection” — Mohamed Alzhrani (@0xmaz), 0xmaz.me (Jun 20, 2026). Licensed CC BY 4.0. Tables, code listings, diagrams and figures below are reproduced verbatim with attribution captions.

Executive Summary

Modern endpoint detection has moved its trustworthiness anchor from userland hooks to kernel-mode telemetry:…

https://core-jmp.org/2026/06/lacuna-chain-ghost-frames-defeat-edr-call-stack-detection/

AMSI/ETW Evasion for PowerShell, without patching amsi.dll, by manipulating the CLR/JIT and using a Tail Jump patch for ETW 🔥

#etw #amsi

Do you even know what you're bypassing? Don't be that guy who throws direct syscalls at everything and calls it an AV bypass.
https://www.hackmosphere.fr/bypass-windows-defender-antivirus-2025-part-1/

Post-Build PE Obfuscation

Obfusk8 includes a post-build script to further harden the compiled binary by removing forensic artifacts.

* Script Location: `Obfusk8/Obfusk8/SCRIPTS/obfuscate_pe.ps1 at main · x86byte/Obfusk8`
* What it does:
1. Strips the Rich Header — removes the MSVC build-environment fingerprint that reveals compiler version and toolchain details.
2. Spoofs the TimeDateStamp — replaces the PE header timestamp with a fixed value to obscure build time.
3. Clears the Debug Directory — wipes debug directory entries that could leak PDB paths or build metadata.
* Usage:
Run as a post-build step after compiling:
powershell PowerShell -NoProfile -ExecutionPolicy Bypass -File Obfusk8/SCRIPTS/obfuscate_pe.ps1 -Path "path\to\Obfusk8.exe"

The script modifies the binary in-place. No backup is created.


@OrcaCyberWeapons

We’re building a small community around binary security research, focused on things like:

- Reverse Engineering
- Binary Obfuscation / Deobfuscation
- Exploit Development
- Compiler / interpreters...
- Malware Analysis
- Binary Hardening research

we also work on open source tools and experiments here:
GitHub → BinaryHardening GitHub
Discord → BinaryHardening Discord

If low level stuff and weird binaries are ur thing, come join us
Always happy to meet more RE people

Accelerating EDR Evasion with LLM-Driven Analysis

#EDR #LLM

New Stealit Campaign Abuses Node.js Single Executable Application

#SEA #Nodejs #malware

tl;dr
really effective malware multi-staged, multiple programming languages, use as many dependencies as possible. AI making this easier to do. AVs struggling

Historically, in regards to malware development, the end goal was minimalism. It was in your best interest to strip as many dependencies, shred the file size down, and make it position independent.

I think, as of ... now ... we need to take a different approach.

I think instead of stripping binaries, we (Red Team, Threat Emulation, malware developers) should intentionally introduce dependencies.

I have witnesses two unique things in the malware landscape since the AI boom.

1. Increase in malware slop. I continue to see stagers which contain notes in them. This is not intentional and this does not "trick" the analyst. This is a colossal mistake on the malware developers part. However, despite it being slop, AI has made malware more diverse. I am seeing more and more malware in Lua, Node JS (including SEA and nexe), Java, and Python. I am seeing more and more malware doing inter-process communication across multiple programming languages. Of course all of these have existed prior to AI, but I am seeing an explosion in these languages. This also has resulted in malware researchers creating new tools to combat this malware diversity.

2. Anti-malware services struggling. When I encounter a binary that is a Node JS SEA blob (Electron JS .exe, self-contained using SEA), which extracts a .JS payload, which uses obfuscated Java or heavily obfuscated Lua, all of these languages require a VM (PVM, LVM, JVM, whatever) for interpretation. Thus, with heavy obfuscation and multistaging, static analysis fails and the heavy abstraction makes it difficult for traditional hooking or minifilters to be effective, in essence there is too much noise. Many of these payloads with heavy dependencies easily avoid static analysis and even some emulation systems because they fail to account for the necessary dependencies which are required to emulate it correctly.

pic maybe related idk

The Defensive Stack is Exposed: LLMs, Reverse Engineering, and the End of Opaque Defense

#LLM #EDR

Persistence via Fake AMSI Provider | Playbook & Detection Strategies

#persistence #amsi