aelassas/servy: Professional-Grade Windows Service Wrapper with Real-Time Monitoring
https://github.com/aelassas/servy
🎖@malwr
https://github.com/aelassas/servy
Servy lets you run any app as a native Windows service with full control over the working directory, startup type, process priority, CPU affinity, logging, health checks, environment variables, dependencies, pre-launch and post-launch hooks, pre-stop and post-stop hooks, and parameters.
🎖@malwr
GitHub
GitHub - aelassas/servy: Enterprise-Grade Windows Service Wrapper with Real-Time Monitoring
Enterprise-Grade Windows Service Wrapper with Real-Time Monitoring - aelassas/servy
winterknife/PLATINUMPICK: Windows Kernel-Mode Shellcode Development Framework (WKMSDF)
https://github.com/winterknife/PLATINUMPICK
🎖@malwr
https://github.com/winterknife/PLATINUMPICK
🎖@malwr
GitHub
GitHub - winterknife/PLATINUMPICK: Windows Kernel-Mode Shellcode Development Framework (WKMSDF)
Windows Kernel-Mode Shellcode Development Framework (WKMSDF) - winterknife/PLATINUMPICK
ioallocate/Ira: Ira - Interactive Reverser Analyzation is a POC of detecting Software Debuggers trough Machine Learning.
https://github.com/ioallocate/Ira
🎖@malwr
https://github.com/ioallocate/Ira
🎖@malwr
GitHub
GitHub - ioallocate/Cinnamon: Cinnamon is a POC of detecting Software Debuggers trough Machine Learning.
Cinnamon is a POC of detecting Software Debuggers trough Machine Learning. - ioallocate/Cinnamon
NHCM-dev/BytecodeVM: Obfuscator obfuscate using pure java bytecode virtual machine to interpret mutated java bytecodes of original java program.
https://github.com/NHCM-dev/BytecodeVM
🎖@malwr
https://github.com/NHCM-dev/BytecodeVM
🎖@malwr
GitHub
GitHub - NHCM-dev/BytecodeVM: Obfuscator obfuscate using pure java bytecode virtual machine to interpret mutated java bytecodes…
Obfuscator obfuscate using pure java bytecode virtual machine to interpret mutated java bytecodes of original java program. - NHCM-dev/BytecodeVM
Oros42/IMSI-catcher: This program show you IMSI numbers of cellphones around you.
https://github.com/Oros42/IMSI-catcher
🎖@malwr
https://github.com/Oros42/IMSI-catcher
🎖@malwr
GitHub
GitHub - Oros42/IMSI-catcher: This program show you IMSI numbers of cellphones around you.
This program show you IMSI numbers of cellphones around you. - Oros42/IMSI-catcher
VMMap Basics: How to Read a Windows Process's Memory Layout » TrainSec
Pavel Yosifovich uses VMMap to break down a process's memory layout, for developers and researchers who want to see what memory a process really uses.
https://trainsec.net/library/windows-internals/vmmap-basics-how-to-read-a-windows-processs-memory-layout/
🎖@malwr
Pavel Yosifovich uses VMMap to break down a process's memory layout, for developers and researchers who want to see what memory a process really uses.
https://trainsec.net/library/windows-internals/vmmap-basics-how-to-read-a-windows-processs-memory-layout/
🎖@malwr
TrainSec - CyberSecurity online training
VMMap Basics: How to Read a Windows Process's Memory Layout » TrainSec
Pavel Yosifovich uses VMMap to break down a process's memory layout, for developers and researchers who want to see what memory a process really uses.
Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon
Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers, analyze the APK builder internals, and document a successor platform called Night Dragon targeting Chinese users.
https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon
🎖@malwr
Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers, analyze the APK builder internals, and document a successor platform called Night Dragon targeting Chinese users.
https://hunt.io/blog/flying-eagle-android-rat-170-servers-night-dragon
🎖@malwr
hunt.io
Flying Eagle Android RAT: Leaked Source Code, 170 Active Servers, and a New Platform Called Night Dragon
Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers, analyze the APK builder internals, and document a successor platform called Night Dragon targeting Chinese users.
gavamedia/deltafin: Run full Kimi K3 on a single device. And an OpenAI-compatible API server for local chat and coding agents.
https://github.com/gavamedia/deltafin
🎖@malwr
https://github.com/gavamedia/deltafin
🎖@malwr
GitHub
GitHub - gavamedia/deltafin: Run full Kimi K3 on a single device. And an OpenAI-compatible API server for local chat and coding…
Run full Kimi K3 on a single device. And an OpenAI-compatible API server for local chat and coding agents. - gavamedia/deltafin
OctLurk and SilkLurk: new Backdoors in Central Asia
Our experts discovered OctLurk and SilkLurk, backdoors operating primarily in memory, targeting Central Asia. They inject plugins to launch shells, scan networks, dump credentials, and keylogging.
https://securelist.com/octlurk-silklurk-backdoors-central-asia/120840/
🎖@malwr
Our experts discovered OctLurk and SilkLurk, backdoors operating primarily in memory, targeting Central Asia. They inject plugins to launch shells, scan networks, dump credentials, and keylogging.
https://securelist.com/octlurk-silklurk-backdoors-central-asia/120840/
🎖@malwr
ENISA Secure by Design and Default Playbook | ENISA
ENISA is the EU agency dedicated to enhancing cybersecurity in Europe. They offer guidance, tools, and resources to safeguard citizens and businesses from cyber threats.
https://www.enisa.europa.eu/publications/enisa-secure-by-design-and-default-playbook
https://www.enisa.europa.eu/sites/default/files/2026-07/ENISA_Secure_By_Design_and_Default_Playbook_v1.pdf
🎖@malwr
ENISA is the EU agency dedicated to enhancing cybersecurity in Europe. They offer guidance, tools, and resources to safeguard citizens and businesses from cyber threats.
https://www.enisa.europa.eu/publications/enisa-secure-by-design-and-default-playbook
https://www.enisa.europa.eu/sites/default/files/2026-07/ENISA_Secure_By_Design_and_Default_Playbook_v1.pdf
🎖@malwr
cellebrite-labs/ida-bridge: Bridge between agents and IDA Pro.
https://github.com/cellebrite-labs/ida-bridge
🎖@malwr
https://github.com/cellebrite-labs/ida-bridge
🎖@malwr
GitHub
GitHub - cellebrite-labs/ida-bridge: Bridge between agents and IDA Pro.
Bridge between agents and IDA Pro. Contribute to cellebrite-labs/ida-bridge development by creating an account on GitHub.
❤1
bl4ckr0ss3/argus-vr-agent: Autonomous malware analysis + rootkit/bootkit forensics: detonate → triangulated verdict (behavior + YARA + VirusTotal) → auto-generated detection. Pure-Python, human-gated, tested.
https://github.com/bl4ckr0ss3/argus-vr-agent
🎖@malwr
https://github.com/bl4ckr0ss3/argus-vr-agent
🎖@malwr
GitHub
GitHub - bl4ckr0ss3/argus-vr-agent: Autonomous malware analysis + rootkit/bootkit forensics: detonate → triangulated verdict (behavior…
Autonomous malware analysis + rootkit/bootkit forensics: detonate → triangulated verdict (behavior + YARA + VirusTotal) → auto-generated detection. Pure-Python, human-gated, tested. - bl4ckr0ss3/ar...
0xMR007/Lab4PurpleSec: Lab4PurpleSec is a modular Purple Team homelab combining a vulnerable Active Directory environment (GOAD), a Docker-based web DMZ, pfSense + Suricata, and a Wazuh SIEM. It provides a realistic, open-source training environment for web exploitation, pivoting, Active Directory attacks, and Blue Team detection.
https://github.com/0xMR007/Lab4PurpleSec
🎖@malwr
https://github.com/0xMR007/Lab4PurpleSec
🎖@malwr
GitHub
GitHub - 0xMR007/Lab4PurpleSec: Lab4PurpleSec is a modular Purple Team homelab combining a vulnerable Active Directory environment…
Lab4PurpleSec is a modular Purple Team homelab combining a vulnerable Active Directory environment (GOAD), a Docker-based web DMZ, pfSense + Suricata, and a Wazuh SIEM. It provides a realistic, ope...
Fake Xeno Roblox Cheats Deliver Powerful Java Stealer Through Discord and Forums
A malware campaign disguised as an “undetected” version of the Xeno Roblox script executor is directly affecting players
https://www.bitdefender.com/en-us/blog/labs/fake-xeno-roblox-discord-executor
🎖@malwr
A malware campaign disguised as an “undetected” version of the Xeno Roblox script executor is directly affecting players
https://www.bitdefender.com/en-us/blog/labs/fake-xeno-roblox-discord-executor
🎖@malwr
Bitdefender
Fake Xeno Roblox Cheats Deliver Powerful Java Stealer Through Discord and Forums
A malware campaign disguised as an “undetected” version of the Xeno Roblox script executor is directly affecting players
Meowmycks/EkkoNtProtect: Arbitrary NtProtectVirtualMemory calls from Ekko-style timer-based sleep obfuscation using internal ntdll functions
https://github.com/Meowmycks/EkkoNtProtect
🎖@malwr
https://github.com/Meowmycks/EkkoNtProtect
🎖@malwr
GitHub
GitHub - Meowmycks/EkkoNtProtect: Use NtProtectVirtualMemory in Ekko timers without needing to use stack pivoting or other RSP…
Use NtProtectVirtualMemory in Ekko timers without needing to use stack pivoting or other RSP shifting tricks - Meowmycks/EkkoNtProtect
Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus)
https://memn0ps.github.io/rusty-windows-uefi-bootkit/
🎖@malwr
https://memn0ps.github.io/rusty-windows-uefi-bootkit/
🎖@malwr
memN0ps
Rusty Bootkit - Windows UEFI Bootkit in Rust (Codename: RedLotus)
https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/
Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs
🎖@malwr
Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs
🎖@malwr
SOCRadar® Cyber Intelligence Inc.
Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs
SOCRadar’s Threat Research Unit (STRU) identified and analyzed DOUBLECUP, a Russian Loader-as-a-Service (LaaS) for ClickFix campaigns. Operating...
kaandemir993/ShellcodeRunner-Anti-Forensic-Privilege-Escalation-Payload-Analysis: "Reverse engineering analysis of ShellcodeRunner, a malware that uses anti-forensic techniques, token manipulation for privilege escalation, and clipboard stealing payload. Includes .rdata API extraction and memory trace cleaning."
https://github.com/kaandemir993/ShellcodeRunner-Anti-Forensic-Privilege-Escalation-Payload-Analysis
🎖@malwr
https://github.com/kaandemir993/ShellcodeRunner-Anti-Forensic-Privilege-Escalation-Payload-Analysis
🎖@malwr
GitHub
GitHub - kaandemir993/ShellcodeRunner-Anti-Forensic-Privilege-Escalation-Payload-Analysis: "Reverse engineering analysis of ShellcodeRunner…
"Reverse engineering analysis of ShellcodeRunner, a malware that uses anti-forensic techniques, token manipulation for privilege escalation, and clipboard stealing payload. Includes .rdata...
Provisioning Packages
Windows Provisioning Packages are used by Administrators to deploy configuration scripts on Windows environments by using a container format. Threat actors with elevated privileges could abuse prov…
https://ipurple.team/2026/08/04/provisioning-packages/
🎖@malwr
Windows Provisioning Packages are used by Administrators to deploy configuration scripts on Windows environments by using a container format. Threat actors with elevated privileges could abuse prov…
https://ipurple.team/2026/08/04/provisioning-packages/
🎖@malwr
Purple Team
Provisioning Packages
Windows Provisioning Packages are used by Administrators to deploy configuration scripts on Windows environments by using a container format. Threat actors with elevated privileges could abuse prov…