Adversary Simulation vs Penetration Testing: Which?
Discover the key differences between adversary simulation and penetration testing, and learn which security assessment your business actually needs to...
https://www.redfoxsec.com/blog/adversary-simulation-vs-penetration-testing-which-does-your-business-need
🎖@malwr
Discover the key differences between adversary simulation and penetration testing, and learn which security assessment your business actually needs to...
https://www.redfoxsec.com/blog/adversary-simulation-vs-penetration-testing-which-does-your-business-need
🎖@malwr
Redfoxsec
Adversary Simulation vs Penetration Testing: Which?
Discover the key differences between adversary simulation and penetration testing, and learn which security assessment your business actually needs to...
SindriKit 1.4.0: Stealth Execution with COFF Object Loading and Injection
How SindriKit's new COFF loader and injection orchestrator enable seamless execution of Beacon Object Files (BOFs) both locally and remotely.
https://sibouzitoun.tech/articles/sindrikit-v1o4/
🎖@malwr
How SindriKit's new COFF loader and injection orchestrator enable seamless execution of Beacon Object Files (BOFs) both locally and remotely.
https://sibouzitoun.tech/articles/sindrikit-v1o4/
🎖@malwr
sibouzitoun.tech
SindriKit 1.4.0: Stealth Execution with COFF Object Loading and Injection
How SindriKit's new COFF loader and injection orchestrator enable seamless execution of Beacon Object Files (BOFs) both locally and remotely.
❤2
Writing an Evasive .NET Shellcode Loader | slashsec
A technical overview of how to load malicious code into .NET assemblies
https://slashsec.at/en/blog/writing-an-evasive-dotnet-shellcode-loader
🎖@malwr
A technical overview of how to load malicious code into .NET assemblies
https://slashsec.at/en/blog/writing-an-evasive-dotnet-shellcode-loader
🎖@malwr
slashsec
Writing an Evasive .NET Shellcode Loader | slashsec
A technical overview of how to load malicious code into .NET assemblies
Kratos PhaaS Targets US and EU Companies
Discover how Kratos PhaaS threatens Microsoft 365 accounts and how ANY.RUN helps security teams reduce fraud risk, speed detection, and contain compromise.
https://any.run/cybersecurity-blog/kratos-phaas-account-takeover/
🎖@malwr
Discover how Kratos PhaaS threatens Microsoft 365 accounts and how ANY.RUN helps security teams reduce fraud risk, speed detection, and contain compromise.
https://any.run/cybersecurity-blog/kratos-phaas-account-takeover/
🎖@malwr
any.run
Kratos PhaaS Targets US and EU Companies
Discover how Kratos PhaaS threatens Microsoft 365 accounts and how ANY.RUN helps security teams reduce fraud risk, speed detection, and contain compromise.
How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist | Hudson Rock
How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist A shared research investigation…
https://www.hudsonrock.com/blog/how-an-infostealer-infection-led-to-a-sophisticated-clickfix-campaign-at-artlist
🎖@malwr
How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist A shared research investigation…
https://www.hudsonrock.com/blog/how-an-infostealer-infection-led-to-a-sophisticated-clickfix-campaign-at-artlist
🎖@malwr
Hudson Rock
How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist | Hudson Rock
How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist A shared research investigation…
From EtherHiding to a native RAT: ClickFix on new-blog.artlist[.]io
Static teardown of a ClickFix chain on new-blog.artlist[.]io, from Polygon EtherHiding and PowerShell delivery to a manually mapped native Windows RAT.
https://www.derp.ca/research/artlist-clickfix-native-rat/
🎖@malwr
Static teardown of a ClickFix chain on new-blog.artlist[.]io, from Polygon EtherHiding and PowerShell delivery to a manually mapped native Windows RAT.
https://www.derp.ca/research/artlist-clickfix-native-rat/
🎖@malwr
Derp
From EtherHiding to a native RAT: ClickFix on new-blog.artlist[.]io
Static teardown of a ClickFix chain on new-blog.artlist[.]io, from Polygon EtherHiding and PowerShell delivery to a manually mapped native Windows RAT.
The serpent’s tongue: Luring the Python out of its den
This blog examines the full lifecycle of a Python package, from hosting on repositories such as PyPI or custom web servers, through source and wheel distribution formats, to the final installation into virtual or system-wide Python environments.
https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
🎖@malwr
This blog examines the full lifecycle of a Python package, from hosting on repositories such as PyPI or custom web servers, through source and wheel distribution formats, to the final installation into virtual or system-wide Python environments.
https://blog.talosintelligence.com/the-serpents-tongue-luring-the-python-out-of-its-den/
🎖@malwr
Cisco Talos
The serpent’s tongue: Luring the Python out of its den
This blog examines the full lifecycle of a Python package, from hosting on repositories such as PyPI or custom web servers, through source and wheel distribution formats, to the final installation into virtual or system-wide Python environments.
S3N4T0R-0X0/RustyWater-ShellCode-Dropper: RustyWater represents the main payload and the backbone of the entire adversarial operation in Static Kitten group attacks.
https://github.com/S3N4T0R-0X0/RustyWater-ShellCode-Dropper
🎖@malwr
https://github.com/S3N4T0R-0X0/RustyWater-ShellCode-Dropper
🎖@malwr
GitHub
GitHub - S3N4T0R-0X0/RustyWater-ShellCode-Dropper: RustyWater represents the main payload and the backbone of the entire adversarial…
RustyWater represents the main payload and the backbone of the entire adversarial operation in Static Kitten group attacks. - S3N4T0R-0X0/RustyWater-ShellCode-Dropper
AgentRE-Bench
AI agents can write code. Can they reverse engineer it? AgentRE-Bench evaluates compiled-binary reverse engineering with deterministic scoring.
https://www.agentre-bench.ai/
https://github.com/agentrebench/AgentRE-Bench
🎖@malwr
AI agents can write code. Can they reverse engineer it? AgentRE-Bench evaluates compiled-binary reverse engineering with deterministic scoring.
https://www.agentre-bench.ai/
https://github.com/agentrebench/AgentRE-Bench
AgentRE-Bench gives an LLM agent a compiled ELF binary and a set of Linux static analysis tools (strings, objdump, readelf, etc.), then measures how well it can identify C2 infrastructure, encoding schemes, anti-analysis techniques, and communication protocols — all without human guidance.
🎖@malwr
www.agentre-bench.ai
AgentRE-Bench — Reverse-engineering intelligence, measured
The benchmark and evaluation platform for AI agents that understand compiled software.
DomainTools Investigations | Threat Intelligence Report: The Pro-Iran Hacktivist Ecosystem 2026
Threat Intelligence Report: The Pro-Iran Hacktivist Ecosystem 2026
https://dti.domaintools.com/research/threat-intelligence-report-the-pro-iran-hacktivist-ecosystem-2026
🎖@malwr
Threat Intelligence Report: The Pro-Iran Hacktivist Ecosystem 2026
https://dti.domaintools.com/research/threat-intelligence-report-the-pro-iran-hacktivist-ecosystem-2026
🎖@malwr
WallabyDesigns/windows-telemetry-guard
https://github.com/WallabyDesigns/windows-telemetry-guard
🎖@malwr
https://github.com/WallabyDesigns/windows-telemetry-guard
A reversible Windows 10/11 telemetry and tracking hardening toolkit, from Wallaby Designs. Everything it changes is recorded in a timestamped backup first, so Revert restores your machine to exactly the state it was in before Apply.
🎖@malwr
GitHub
GitHub - WallabyDesigns/windows-telemetry-guard
Contribute to WallabyDesigns/windows-telemetry-guard development by creating an account on GitHub.
Analyzing a Linux/Ext4 disk image using The Sleuth Kit (TSK) and other utilities — PART-1
https://osintteam.blog/analyzing-a-linux-ext4-disk-image-using-the-sleuth-kit-tsk-and-other-utilities-part-1-9cde7d700df5
🎖@malwr
https://osintteam.blog/analyzing-a-linux-ext4-disk-image-using-the-sleuth-kit-tsk-and-other-utilities-part-1-9cde7d700df5
🎖@malwr
Medium
Analyzing a Linux/Ext4 disk image using The Sleuth Kit (TSK) and other utilities — PART-1
Hello Everyone! Welcome back, I hope you’ll are doing great. In this write-up we’ll walkthrough a linux/ext4 disk image and try to analyze…
I Detonated Real Ransomware in a VM. Hereâs the Forensic Trail It Left. - Freedium
Static analysis hit a wall immediately. The only way to understand this malware was to actually let it run.
https://freedium-mirror.cfd/https://osintteam.blog/i-detonated-real-ransomware-in-a-vm-heres-the-forensic-trail-it-left-8a386d32d3f3
🎖@malwr
Static analysis hit a wall immediately. The only way to understand this malware was to actually let it run.
https://freedium-mirror.cfd/https://osintteam.blog/i-detonated-real-ransomware-in-a-vm-heres-the-forensic-trail-it-left-8a386d32d3f3
🎖@malwr
freedium-mirror.cfd
I Detonated Real Ransomware in a VM. Here’s the Forensic Trail It Left. - Freedium
Static analysis hit a wall immediately. The only way to understand this malware was to actually let it run.
Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet
TrendAI™ Research analyzed over 200 Gemini CLI session logs showing how a Russian-speaking threat actor used AI to run a live botnet, finishing a full C&C migration in six minutes while doing just 11% of the work himself.
https://www.trendmicro.com/en_us/research/26/g/actor-behind-patriot-bait-used-ai-to-deploy-c2-botnet.html
🎖@malwr
TrendAI™ Research analyzed over 200 Gemini CLI session logs showing how a Russian-speaking threat actor used AI to run a live botnet, finishing a full C&C migration in six minutes while doing just 11% of the work himself.
https://www.trendmicro.com/en_us/research/26/g/actor-behind-patriot-bait-used-ai-to-deploy-c2-botnet.html
🎖@malwr
Trend Micro
Six Minutes to Compromise: How ‘Patriot Bait’ Actor Used AI to Build and Deploy a C&C Botnet
TrendAI™ Research analyzed over 200 Gemini CLI session logs showing how a Russian-speaking threat actor used AI to run a live botnet, finishing a full C&C migration in six minutes while doing just 11% of the work himself.
❤1
TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
TuxBot v3 Evolution, an IoT botnet framework built with LLMs. Read our analysis of its cross-compiled binaries, C2 architecture and bugs.
https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/
🎖@malwr
TuxBot v3 Evolution, an IoT botnet framework built with LLMs. Read our analysis of its cross-compiled binaries, C2 architecture and bugs.
https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/
🎖@malwr
Unit 42
TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development
TuxBot v3 Evolution, an IoT botnet framework built with LLMs. Read our analysis of its cross-compiled binaries, C2 architecture and bugs.
Bind Link Abuse: One Windows Feature, Many Ways to Blind Your EDR
I’d like to thank my coauthors, Andrei-Marius Muntea, Andrei Mermeze, Radu-Marian Portase, and Vlad Lazar, for their invaluable contributions to this research.
https://www.bitdefender.com/en-us/blog/businessinsights/bind-link-abuses-windows-feature-edr-evasion-technique
🎖@malwr
I’d like to thank my coauthors, Andrei-Marius Muntea, Andrei Mermeze, Radu-Marian Portase, and Vlad Lazar, for their invaluable contributions to this research.
https://www.bitdefender.com/en-us/blog/businessinsights/bind-link-abuses-windows-feature-edr-evasion-technique
🎖@malwr
Bitdefender
Bind Link Abuse: One Windows Feature, Many Ways to Blind Your EDR
I’d like to thank my coauthors, Andrei-Marius Muntea, Andrei Mermeze, Radu-Marian Portase, and Vlad Lazar, for their invaluable contributions to this research.
🕊1
Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries
An exposed open directory revealed a suspected Chinese campaign using Claude Code and DeepSeek-v4-pro to breach government systems in Afghanistan, Thailand, and Taiwan, with parallel probing of financial services worldwide.
https://hunt.io/blog/chinese-operators-claude-deepseek-government-intrusion
🎖@malwr
An exposed open directory revealed a suspected Chinese campaign using Claude Code and DeepSeek-v4-pro to breach government systems in Afghanistan, Thailand, and Taiwan, with parallel probing of financial services worldwide.
https://hunt.io/blog/chinese-operators-claude-deepseek-government-intrusion
🎖@malwr
hunt.io
Suspected Chinese Operators Use Claude Code and DeepSeek to Breach Government Systems Across Four Countries
An exposed open directory revealed a suspected Chinese campaign using Claude Code and DeepSeek-v4-pro to breach government systems in Afghanistan, Thailand, and Taiwan, with parallel probing of financial services worldwide.
Anatomy of a CUDA Binary
When you compile a CUDA kernel, the final artifact is a cubin — a CUDA binary. It is a standard ELF64 file with NVIDIA-specific sections that encode everything the CUDA driver needs to load and launch a kernel: the machine code, the parameter layout, register allocation metadata, and a collection of attributes that have no public documentation.
https://hiraditya.github.io/posts/anatomy-of-a-cuda-binary/
🎖@malwr
When you compile a CUDA kernel, the final artifact is a cubin — a CUDA binary. It is a standard ELF64 file with NVIDIA-specific sections that encode everything the CUDA driver needs to load and launch a kernel: the machine code, the parameter layout, register allocation metadata, and a collection of attributes that have no public documentation.
https://hiraditya.github.io/posts/anatomy-of-a-cuda-binary/
🎖@malwr
Aditya Kumar
Anatomy of a CUDA Binary
When you compile a CUDA kernel, the final artifact is a cubin — a CUDA binary. It is a standard ELF64 file with NVIDIA-specific sections that encode everything the CUDA driver needs to load and launch a kernel: the machine code, the parameter layout, register…
2026-06-22: SHub Stealer infection (macOS)
https://www.malware-traffic-analysis.net/2026/06/22/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2026/06/22/index.html
🎖@malwr
2026-06-01: SmartApeSG ClickFix --> Unidentified RAT
https://www.malware-traffic-analysis.net/2026/06/01/index.html
🎖@malwr
https://www.malware-traffic-analysis.net/2026/06/01/index.html
🎖@malwr
1❤1
endgamec2framework/endgame: ENDGAME C2 FRAMEWORK — AI-powered command and control for professional red team operations
https://github.com/endgamec2framework/endgame
🎖@malwr
https://github.com/endgamec2framework/endgame
🎖@malwr
GitHub
GitHub - endgamec2framework/endgame: ENDGAME C2 FRAMEWORK — AI-powered command and control for professional red team operations
ENDGAME C2 FRAMEWORK — AI-powered command and control for professional red team operations - endgamec2framework/endgame