The Gasket and MagicSocks tools were used in an attack that delivered the Mespinoza ransomware (also known as PYSA)...other tools were discovered to facilitate latter parts of the attacks.

LemonDuck, an actively updated and robust malware that’s primarily known for its botnet and cryptocurrency mining objectives, adopted more sophisticated behavior and escalated its operations. Today, beyond using resources for its traditional bot and mining…

An attack primer on how to attack Java RMI services using Java deserialization

A new NTLM relay attack called PetitPotam has been discovered that allows threat actors to take over a domain controller, and thus an entire Windows domain.

Many Windows applications have multiple ways in which the same command line can be expressed, usually for compatibility or ease-of-use reasons. As a result, command-line arguments are implemented inconsistently making detecting specific commands harder due…

Read how this IR team discovered a zero day in popular Aloha Point of Sale software while engaging with a threat actor compromising a live system.

This week a group of global newspapers is running a series of articles detailing abuses of NSO Group’s Pegasus spyware. If you haven’t seen any of these articles, they’re worth re…

The Qualys Research Team has discovered a size_t-to-int type conversion vulnerability in the Linux Kernel’s filesystem layer affecting most Linux operating systems. Any unprivileged user can gain root…

Android Mobile Application Penetration Testing

A high severity flaw in HP, Samsung and Xerox printer drivers has existed since 2005 and could lead to an escalation of privilege.

This blog post analyzes the Frida and Jailbreak detection in PokemonGO for iOS.

An overview of 2021’s vulnerabilities so far.

I guess most of you heard about the Windows Print Spooler Elevation of Privilege vulnerability (CVE-2021-1675) in the last couple of weeks. It is a vulnerability that gives an attacker high privile…

This is the first of a two-part series regarding uses of htaccess for exploitation purposes. I will cover some basic and somewhat well-known methods here, along with a few lesser known me…

I played Google CTF 2021 Quals in zer0pts and I worked on several tasks. In the 6 pwnable challenges I solved during the CTF I liked "Full Chain" the most. This…

In our previous blog post “Detecting IcedID” we provided a global overview of the IcedID threat, its multiple stages and capabilities. This new blog post is focused on how to be proactive and hunt for IcedID DLL components to extract network IOCs. It will…

This workshop will go over the reverse engineering steps for looking at Cryptowall malware for the purposes of extracting information on the code injection technique in order to replicate for red team operation use.