Reverse engineering a miner malware
Introduction I wanted a reverse engineering project, so I decided to analyse a piece of real malware.

https://gustavvising.se/2026/07/17/reverse-engineering-a-miner-malware.html


🎖@malwr

Binary Ninja - The Binary Hiding in Your Registry: Cracking Windows UCPD's Dynamic Rules
Binary Ninja is a modern reverse engineering platform with a scriptable and extensible decompiler.

https://binary.ninja/2026/08/04/ucpd-dynamic-rules.html


🎖@malwr

🚨 CVE-2026-59309
VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may exploit this issue to bypass authentication and gain unauthorized access to the system.

🎖@cveNotify

🚨 CVE-2026-59310
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

🎖@cveNotify

CILFI: Automatic Function Identification in .NET Binaries
There is a specific stage of grief every .NET reverse-engineer goes through when writing the next .NET deobfuscator or config extractor. It is the realization you have to write yet another ugly pattern-matching algorithm to find the exact same string decryptor, VM opcode handler, or C2 connection initializer functions to extract obfuscator configurations or IoCs.

https://blog.washi.dev/posts/cilfi/


🎖@malwr

Malware Development Essentials for Operators
Today’s post is a full pipeline walkthrough from a MessageBoxA call all the way to a kernel rootkit doing DKOM process hiding and callback abuse. Dynamic function loading, PEB walking, IAT hooking, process hollowing, DLL injection, shellcode encryption, APC injection all of it, with code.

https://f00crew.org/0x33


🎖@malwr

Windows tcpip.sys ICMP Timestamp Bug: EnableICMPTimestampRep=0 Registry Bypass & RFC 792 Violation | Kernel RE
EnableICMPTimestampRep=0 does not suppress ICMP Timestamp Replies (Type 14) on Windows 11. Ghidra RE of tcpip.sys 10.0.26100.8457 confirms Ipv4pHandleTimestampRequest generates T14 unconditionally, plus a second bug: Receive/Transmit timestamps written little-endian in violation of RFC 792. Only effective mitigation: WFP firewall rule.

https://netacoding.com/posts/windows-icmp-timestamp-bugs/


🎖@malwr

LockBit 5.0 Linux Malware Analysis: ChaCha20 + Curve25519 Offline Encryption, strace Evasion & IOCs
Full reverse engineering of LockBit 5.0 Linux (LINUX Locker v1.01 amd64): offline-capable ChaCha20+Curve25519 encryption, strace anti-analysis evasion, aggressive free space wiping, and zero network activity during encryption. eBPF dynamic tracing, Ghidra static RE, triple-confirmed network behavior, and complete IOC list.

https://netacoding.com/posts/lockbit5-analysis/


🎖@malwr

Dopamine
An iOS 15.0 - 18.7.1 / 26.0 - 26.0.1 jailbreak for A8 - A17 and M1 - M2 devices

https://ellekit.space/dopamine/


🎖@malwr