Forwarded from club1337
The EU just sanctioned the operators behind Lumma Stealer.
“Daugn0” and “Lummaseller” have been officially designated for their roles in developing, distributing, and selling the LummaC2 infostealer.
Also added:
• BPH MediaLand LLC and its owner
• Two members of Cyber Army of Russia Reborn
• Bentley/Stern (CONTI ransomware)
• Two members of GRU Unit 29155
The inclusion of the Lumma operators is particularly notable. Looks like the “lummakrysy” drama wasn’t entirely off the mark after all.
cc g0njxa, Gi7w0rm
https://eur-lex.europa.eu/eli/reg_impl/2026/1714/oj/eng
Telegram✉️ @club1337
X (Twitter)🕊 @club31337
“Daugn0” and “Lummaseller” have been officially designated for their roles in developing, distributing, and selling the LummaC2 infostealer.
Also added:
• BPH MediaLand LLC and its owner
• Two members of Cyber Army of Russia Reborn
• Bentley/Stern (CONTI ransomware)
• Two members of GRU Unit 29155
The inclusion of the Lumma operators is particularly notable. Looks like the “lummakrysy” drama wasn’t entirely off the mark after all.
cc g0njxa, Gi7w0rm
https://eur-lex.europa.eu/eli/reg_impl/2026/1714/oj/eng
Telegram
X (Twitter)
Please open Telegram to view this post
VIEW IN TELEGRAM
Please open Telegram to view this post
VIEW IN TELEGRAM
👍2🔥2👎1
گروهی تخصصی برای متخصصین آفنسیو و ردتیم با زبان فارسی
https://t.me/+drFBtbbrVDo5NjA0
اینجا قراره ریپورتهایی که منتشر میشه رو بررسی کنیم، تکنیکهای جدید رو استخراج کنیم و دربارهی مشکلات فنی و چالشهایی که سر راه اجراست بحث کنیم.
https://t.me/+drFBtbbrVDo5NjA0
👍9👎8👾3
🔓 Dumping NTLM Hashes from Windows Memory via forensics tools
What can an attacker recover from a Windows memory image after gaining access to an endpoint?
#RedTeam #OffensiveSecurity
What can an attacker recover from a Windows memory image after gaining access to an endpoint?
In my new blog, I explored:
WinPmem → Volatility 3 → SYSTEM/SAM → NTLM
#RedTeam #OffensiveSecurity
👍5🔥2👾2
Forwarded from club1337
Devman-ArticleXakep.txt
17.9 KB
Вымогатель-болтун. Как Devman прошел путь от новичка до преступника в розыске Интерпола
👑 Статья для подписчиков
31 июля 2025 года Джон Ди Маджо открыл сообщение в зашифрованном мессенджере. Преступники обычно не любят, когда их деятельность расследуют, но этот написал сам. К сообщению была приложена фотография: дорогие часы, спортивные автомобили. Отправителя Ди Маджо знал.
https://xakep.ru/2026/08/13/devman/
Telegram✉️ @club1337
X (Twitter)🕊 @club31337
👑 Статья для подписчиков
31 июля 2025 года Джон Ди Маджо открыл сообщение в зашифрованном мессенджере. Преступники обычно не любят, когда их деятельность расследуют, но этот написал сам. К сообщению была приложена фотография: дорогие часы, спортивные автомобили. Отправителя Ди Маджо знал.
https://xakep.ru/2026/08/13/devman/
Telegram
X (Twitter)
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥3👾2
This media is not supported in your browser
VIEW IN TELEGRAM
You don’t always need to go for the hardest approach. Sometimes, you just need to understand what you actually need and choose the right path.
As you know, LSASS is heavily monitored and protected nowadays, so getting a dump from it isn’t as straightforward as it used to be.
So instead of getting stuck on LSASS and trying to bypass every protection around it, why not look at other options?
If the goal is to obtain local account credential material, SAM might be enough for what we need.
The point is simple: choose the technique based on the objective, not based on how complicated it is.
#EDR #SentinelOne
As you know, LSASS is heavily monitored and protected nowadays, so getting a dump from it isn’t as straightforward as it used to be.
So instead of getting stuck on LSASS and trying to bypass every protection around it, why not look at other options?
If the goal is to obtain local account credential material, SAM might be enough for what we need.
The point is simple: choose the technique based on the objective, not based on how complicated it is.
#EDR #SentinelOne
3🔥12👍4🕊2👾2
Workshop materials for “Step-by-Step Malware Development: Evading EDR from Loaders to the Kernel”, presented at DEF CON 34 and BSidesLV 2026.
#EDR #maldev #defcon
#EDR #maldev #defcon
👍6👾2
Woooowwwww
You must Read this
https://mrtiz.github.io/cet-callstack-spoofing-thread-pool-trampoline
#callstack #bypass
You must Read this
https://mrtiz.github.io/cet-callstack-spoofing-thread-pool-trampoline
#callstack #bypass
👾11🔥1
Forwarded from RedTeam brazzers (Миша)
Всем привет! Мой коллега Вячеслав Цепенников выступал на OFFZONE с докладом «Living off the Browser». Он наресерчил крутой функционал Direct Sockets внутри Chrome, который позволяет через Isolated Web Apps отправлять полноценные сетевые TCP/UDP-запросы. Путем нескольких бессонных ночей получилось внутрь Isolated Web App портировать большинство самых популярных тулз для пентеста! Теперь вы можете буквально ломать через браузер : )
Демо:
https://iwa-tools.pkilla.pw/
Сорцы:
https://github.com/CICADA8-Research/iwa-tools
Демо:
https://iwa-tools.pkilla.pw/
Сорцы:
https://github.com/CICADA8-Research/iwa-tools
👍3🔥3
🔥 HTB PingPong — Insane | Pwned
Started from the assumed-breach credentials.
Attack Chain:
ESC13 provided the initial WinRM foothold. A Hyper-V pivot exposed the second forest and enabled cross-realm Kerberos.
Abusing gMSA Managers and Foreign SID Injection allowed access to the "Pong_gMSA$" password, leading to JEA abuse and an XXE file read.
From there, RBCD against MSSQL → GodPotato resulted in local admin on DC2. DCSync then compromised "R.Martinelli", providing access to CA Managers.
Finally, ESC4 → ESC1 → PKINIT yielded an Administrator certificate and Domain Admin.
One hell of an AD chain. 🏴☠️
#AD #HTB
Started from the assumed-breach credentials.
Attack Chain:
→ "ESC13"
→ "WinRM Foothold on DC1"
→ "Hyper-V Pivot"
→ "Cross-Forest / Cross-Realm Kerberos"
→ "RID Enumeration"
→ "gMSA Managers Ownership"
→ "Foreign SID Injection"
→ "Read Pong_gMSA$ Password"
→ "JEA → XXE File Read"
→ "RBCD → MSSQL"
→ "GodPotato"
→ "Local Admin on DC2"
→ "DCSync → R.Martinelli"
→ "CA Managers"
→ "ESC4 → ESC1"
→ "PKINIT as Administrator"
→ Domain Admin
ESC13 provided the initial WinRM foothold. A Hyper-V pivot exposed the second forest and enabled cross-realm Kerberos.
Abusing gMSA Managers and Foreign SID Injection allowed access to the "Pong_gMSA$" password, leading to JEA abuse and an XXE file read.
From there, RBCD against MSSQL → GodPotato resulted in local admin on DC2. DCSync then compromised "R.Martinelli", providing access to CA Managers.
Finally, ESC4 → ESC1 → PKINIT yielded an Administrator certificate and Domain Admin.
One hell of an AD chain. 🏴☠️
#AD #HTB
🔥12👾3👍2