现已上线！2025 年 Telegram 研究 — 年度关键洞察 
Proxy Bar
前往频道在 Telegram
Exploits, Hacking and Leaks Чат группы - https://t.me/chat_proxy_bar Связь с администрацией и реклама: @NULL_vm Поддержать проект: BTC bc1qmrt229eghjyj9wqa7nmr9j8zuq6khz6km2pker
显示更多📈 Telegram 频道 Proxy Bar 的分析概览
频道 Proxy Bar (@proxy_bar) 俄语 语言赛道中的 是活跃参与者。目前社区聚集了 20 633 名订阅者，在 技术与应用 类别中位列第 6 561，并在 俄罗斯 地区排名第 32 792 位。
📊 受众指标与增长动态
自 невідомо 创建以来，项目保持高速增长，吸引了 20 633 名订阅者。
根据 09 六月, 2026 的最新数据，频道保持稳定运转。过去 30 天订阅人数变化为 168，过去 24 小时变化为 4，整体触达仍然可观。
- 认证状态： 未认证
- 互动率 (ER)： 平均受众互动率为 19.36%。内容发布后 24 小时内通常能获得 12.83% 的反应，占订阅者总量。
- 帖子覆盖： 每篇帖子平均可获得 3 994 次浏览，首日通常累积 2 647 次浏览。
- 互动与反馈： 受众积极参与，单帖平均反应数为 13。
- 主题关注点： 内容集中在 cve-2025, exploit, linux, birth, define 等核心主题上。
📝 描述与内容策略
作者将该频道定位为表达主观观点的平台：
“Exploits, Hacking and Leaks
Чат группы - https://t.me/chat_proxy_bar
Связь с администрацией и реклама:
@NULL_vm
Поддержать проект:
BTC bc1qmrt229eghjyj9wqa7nmr9j8zuq6khz6km2pker”
凭借高频更新（最新数据采集于 10 六月, 2026），频道始终保持新鲜度与高覆盖。分析显示受众积极互动，使其成为 技术与应用 类别中的关键影响点。
20 633
订阅者
+424 小时
+257 天
+16830 天
数据加载中...
吸引订阅者
六月 '26
六月 '26
+69
在2个频道中
五月 '26
+309
在4个频道中
Get PRO
四月 '26
+349
在14个频道中
Get PRO
三月 '26
+392
在13个频道中
Get PRO
二月 '26
+362
在11个频道中
Get PRO
一月 '26
+310
在12个频道中
Get PRO
十二月 '25
+262
在8个频道中
Get PRO
十一月 '25
+332
在8个频道中
Get PRO
十月 '25
+268
在6个频道中
Get PRO
九月 '25
+256
在6个频道中
Get PRO
八月 '25
+275
在9个频道中
Get PRO
七月 '25
+303
在8个频道中
Get PRO
六月 '25
+312
在11个频道中
Get PRO
五月 '25
+299
在9个频道中
Get PRO
四月 '25
+400
在7个频道中
Get PRO
三月 '25
+506
在14个频道中
Get PRO
二月 '25
+403
在9个频道中
Get PRO
一月 '25
+292
在12个频道中
Get PRO
十二月 '24
+229
在8个频道中
Get PRO
十一月 '24
+362
在14个频道中
Get PRO
十月 '24
+368
在8个频道中
Get PRO
九月 '24
+300
在9个频道中
Get PRO
八月 '24
+510
在13个频道中
Get PRO
七月 '24
+484
在10个频道中
Get PRO
六月 '24
+398
在10个频道中
Get PRO
五月 '24
+600
在15个频道中
Get PRO
四月 '24
+411
在11个频道中
Get PRO
三月 '24
+503
在6个频道中
Get PRO
二月 '24
+578
在13个频道中
Get PRO
一月 '24
+211
在3个频道中
Get PRO
十二月 '23
+321
在12个频道中
Get PRO
十一月 '23
+452
在11个频道中
Get PRO
十月 '23
+521
在10个频道中
Get PRO
九月 '23
+325
在0个频道中
Get PRO
八月 '23
+417
在0个频道中
Get PRO
七月 '23
+508
在0个频道中
Get PRO
六月 '23
+402
在0个频道中
Get PRO
五月 '23
+623
在0个频道中
Get PRO
四月 '23
+293
在0个频道中
Get PRO
三月 '23
+890
在0个频道中
Get PRO
二月 '23
+336
在0个频道中
Get PRO
一月 '23
+680
在0个频道中
Get PRO
十二月 '22
+371
在0个频道中
Get PRO
十一月 '22
+403
在0个频道中
Get PRO
十月 '22
+862
在0个频道中
Get PRO
九月 '22
+461
在0个频道中
Get PRO
八月 '22
+264
在0个频道中
Get PRO
七月 '22
+228
在0个频道中
Get PRO
六月 '22
+395
在0个频道中
Get PRO
五月 '22
+664
在0个频道中
Get PRO
四月 '22
+1 013
在0个频道中
Get PRO
三月 '22
+2 137
在0个频道中
Get PRO
二月 '22
+1 158
在0个频道中
Get PRO
一月 '22
+646
在0个频道中
Get PRO
十二月 '21
+622
在0个频道中
| 日期 | 订阅者增长 | 提及 | 频道 | |
| 10 六月 | +11 | |||
| 09 六月 | +5 | |||
| 08 六月 | +4 | |||
| 07 六月 | +4 | |||
| 06 六月 | +2 | |||
| 05 六月 | +1 | |||
| 04 六月 | +7 | |||
| 03 六月 | +14 | |||
| 02 六月 | +9 | |||
| 01 六月 | +12 |
频道帖子
| 2 | ЧТО то мне эта копирка сильно напоминает, ну слово в слово
read
#damage #рукалицо | 588 |
| 3 |  Covert Kernel/User Communication Channels on Windows: Rootkits, Game Cheats, and Detection
Original text: “Covert Kernel/User Communication Channels on Windows: Rootkits, Game Cheats, and Detection” — kernullist, Kernullist’s Blog (Jun 10, 2026). Classification tables, ASCII flow diagrams, and C-language structure declarations below are reproduced verbatim with attribution captions.
Executive Summary
A modern Windows kernel-assisted threat is almost never a single user-mode binary doing all the work. It…
https://core-jmp.org/2026/06/covert-kernel-user-communication-channels-windows-rootkits-cheats-detection/ | 981 |
| 4 |  没有文字... | 2 862 |
| 5 |  Patching the Windows Kernel via BYOVD: ThrottleStop.sys, MmMapIoSpace and the NtAddAtom Trampoline
Original text: “Whoops! I did it again. I patched Windows Kernel at Milan0day 2026” — zer0matt, zer0matt’s blog (29 May 2026). PoC: github.com/zer0matt/Milan0day2026. Diagrams below are reproduced from the original with attribution; prose is paraphrased.
Executive Summary
zer0matt’s Milan0day 2026 talk and accompanying writeup demonstrate a clean Bring Your Own Vulnerable Driver (BYOVD) chain that…
https://core-jmp.org/2026/06/patching-windows-kernel-byovd-throttlestop-mmmapiospace-ntaddatom/ | 3 111 |
| 6 | Client-Side Container Attack: DLL Sideloading wab.exe via Email Archive Delivery
Original text: “Initial access. Client side container attack” — Leigh Gilbert, Exploitz (exploitz.ca, June 2026). The diagrams below are reproduced with attribution; prose is paraphrased. MITRE ATT&CK reference: T1574.001 — DLL Search Order Hijacking.
Executive Summary
Leigh Gilbert’s walkthrough chains together a long-known but still effective initial-access pattern: ship a signed Microsoft binary that has…
https://core-jmp.org/2026/06/client-side-container-attack-dll-sideloading-wab-exe-email-archive/ | 2 835 |
| 7 |  Microsoft Defender Now Monitors Remote RPC Activity: What It Catches and How to Hunt
Original text: “Microsoft Defender now monitors RPC activity” — EdanZwick, Microsoft Tech Community / Microsoft Defender for Endpoint Blog (08 Jun 2026). The three KQL hunting queries below are reproduced verbatim with attribution. Prose is paraphrased; for the Defender XDR alert / detection screenshots, see the original post.
Executive Summary
Microsoft has extended Defender’s existing…
https://core-jmp.org/2026/06/microsoft-defender-monitors-remote-rpc-activity/ | 2 640 |
| 8 | OOBdump: Single-Shot Heap-OOB Exploitation of objdump -g via FR30 Relocations
Original text: “OOBdump: Relocation Oriented Programming” — Calif, blog.calif.io (08 Jun 2026, no individual byline). PoCs and writeups: github.com/califio/publications/…/oobdump. Short illustrative code excerpts and the original article’s diagrams are reproduced with attribution; the prose is paraphrased.
Executive Summary
The Calif team has been quietly collecting trophy bugs in reverse-engineering tooling for a while — IDA…
https://core-jmp.org/2026/06/oobdump-objdump-fr30-relocation-oriented-programming/ | 2 560 |
| 9 |  BusyWork: Replacing Sleep with Real Work to Break Behavioral Detection
Original text: “BusyWork: Replacing Sleep with Real Work to Break Behavioral Detection” — patchi.fyi (07 Jun 2026, byline shows only the site handle — author not publicly attributed). Library source: github.com/PatchRequest/BusyWork. Short illustrative code excerpts are reproduced with attribution; longer routines are summarised — consult the upstream repo for full sources.
Executive Summary
A thread…
https://core-jmp.org/2026/06/busywork-replacing-sleep-with-real-work-behavioral-detection/ | 2 612 |
| 10 | BOF Cocktails in Cobalt Strike: Instrumenting BOFs with BEACON_INLINE_EXECUTE and Crystal Palace
Original text: “BOF Cocktails in Cobalt Strike” — Rasta Mouse, rastamouse.me (05 Jun 2026). Code blocks and the screenshot below are reproduced verbatim from the source with attribution.
Executive Summary
Post-exploitation Beacon Object Files (BOFs) historically inherited their evasion posture from whatever agent or loader executed them. If the loader took care of unhooking, masking,…
https://core-jmp.org/2026/06/bof-cocktails-cobalt-strike-beacon-inline-execute-crystal-palace/ | 2 842 |
| 11 |  Qualcomm QAIC Kernel Driver Page Use-After-Free: From Stale Mmap to Pipe-Buffer-Backed Kernel R/W (Walk-through of Lukas Maar’s Linux v6.18 Exploit)
Original text: “Privilege Escalation via a Page Use-After-Free in Qualcomm’s AI Accelerator Linux Kernel Driver” — Lukas Maar, Security Blog (23 May 2026). Code blocks and figures below are reproduced verbatim with attribution captions.
Executive Summary
Lukas Maar’s post writes up a clean page-level use-after-free in the upstream drivers/accel/qaic Linux kernel driver. The bug is…
https://core-jmp.org/2026/06/qualcomm-qaic-kernel-driver-page-uaf-pipe-buffer-kernel-rw-lukas-maar/ | 4 395 |
| 12 | CVE-2026-23631 DarkReplica
*
Redis Post-Auth RCE Exploit | 4 615 |
| 13 | Social Engineering: Attacking Networks with a BadUSB-ETH, Part 2
Original text by CO11ATERAL
A small USB device can cause a lot of damage when it’s physically plugged into a machine. In this scenario, a BadUSB turns a connection into a bridge for capturing authentication data and gaining network access, even on locked systems.
Welcome back, aspiring cyberwarriors!
In Part 1, we set the foundation…
https://core-jmp.org/2026/06/social-engineering-attacking-networks-with-a-badusb-eth-part-2/ | 4 488 |
| 14 | Reverse-engineering Valorant’s Vanguard Guarded Regions: PML4 Cloning, CR3 Swaps, and the SwapContext Hook PoC (Walk-through of Xyrem’s Post)
Original text: “In-depth analysis on Valorant’s Guarded Regions” — Xyrem, reversing.info (2023). Code blocks and figures below are reproduced verbatim with attribution captions.
Executive Summary
Riot’s Vanguard anti-cheat keeps a slice of Valorant’s game state in memory that is, from any other process or unprivileged thread’s point of view, simply not mapped. Xyrem’s post walks…
https://core-jmp.org/2026/06/reverse-engineering-valorant-vanguard-guarded-regions-pml4-cr3-swap-context-hook/ | 4 011 |
| 15 |  Red Team Tactics: Utilizing Syscalls in C# — Writing the Code (Walk-through of Jack Halon’s Direct-Syscall PoC)
Original text: “Red Team Tactics: Utilizing Syscalls in C# – Writing The Code” — Jack Halon, Jack Hacks (16 April 2020, updated). Code blocks and figures below are reproduced verbatim with attribution captions.
Executive Summary
Jack Halon’s second “Utilizing Syscalls in C#” post is the implementation half of the series: take the conceptual understanding of…
https://core-jmp.org/2026/06/red-team-tactics-utilizing-syscalls-in-csharp-writing-the-code/ | 3 640 |
| 16 | Hidden HTTP/2 Bomb
*
FOR nginx, Apache httpd, Microsoft IIS, Envoy, Cloudflare Pingora
*
WriteUP + LABs + PoCs | 3 913 |
| 17 | One Click, One Hash: Unpatched NTLM Coercion in Windows Search URI Handler
Original text by Andrew Schwartz
Key Takeaways
Same bug class. No CVE. No fix. The NTLM coercion primitive in the Windows search: URI handler is technically identical to CVE-2026-33829 in the Snipping Tool. Same severity rating, same mechanism, same potential impact. Microsoft closed it without a CVE or a patch, describing its triage process as…
https://core-jmp.org/2026/06/one-click-one-hash-unpatched-ntlm-coercion-in-windows-search-uri-handler/ | 4 366 |
| 18 | Bypassing Windows Defender and AMSI: A Practical Defense Evasion Guide for Red Team Operators
Original text: “Обход Windows Defender и AMSI: практический гайд по defense evasion для Red Team” — Сергей Попов, Codeby.net (21 April 2026). Code blocks below are reproduced verbatim with attribution captions.
Executive Summary
Modern Microsoft Defender is not a single antivirus process — it is a stack of independent layers (static engine, kernel-mode filesystem filter,…
https://core-jmp.org/2026/06/bypassing-windows-defender-amsi-defense-evasion-red-team-guide/ | 3 909 |
| 19 |  Two-Shot Kernel Shellcode: Bypassing CR4 Pinning With KProbes for Linux Kernel Control-Flow Hijack to Shellcode
Original text: “Revisiting Two-Shot Kernel Shellcode Execution From Control Flow Hijacking” — zolutal, zolutal’s blog (10 February 2026). Code blocks below are reproduced verbatim with attribution captions.
Executive Summary
Andrey Konovalov’s 2017 Project Zero write-up showed a clean way to turn a control-flow hijack on the Linux kernel into shellcode execution: pivot into native_write_cr4 with…
https://core-jmp.org/2026/06/two-shot-kernel-shellcode-cr4-pinning-bypass-kprobes/ | 3 558 |
| 20 | Kernel Karnage Part 1: Patching Windows Kernel Callbacks to Disable EDR from a Driver
Original text: “Kernel Karnage – Part 1” — Sander (@cerbersec), NVISO Labs (21 October 2021). Code blocks and figures below are reproduced verbatim with attribution captions.
Executive Summary
The first post of NVISO Labs’ Kernel Karnage series walks through the opening move of an EDR-bypass research project: write a small Windows kernel driver, locate the…
https://core-jmp.org/2026/06/kernel-karnage-part-1-patching-windows-kernel-callbacks-edr-bypass/ | 3 443 |
