MalDev | GaK3r
前往频道在 Telegram
Delve into advanced malware development, injection methods, BoFs exploitation, and cybersecurity research. Join a community of experts! Русский свинка 🐽 теряйтесь нахуй
显示更多未指定国家技术与应用44 960
727
订阅者
+324 小时
+47 天
+1330 天
数据加载中...
吸引订阅者
七月 '26
七月 '26
+18
在0个频道中
六月 '26
+18
在0个频道中
Get PRO
五月 '26
+17
在0个频道中
Get PRO
四月 '26
+10
在0个频道中
Get PRO
三月 '26
+11
在0个频道中
Get PRO
二月 '26
+16
在0个频道中
Get PRO
一月 '26
+76
在1个频道中
Get PRO
十二月 '25
+32
在0个频道中
Get PRO
十一月 '25
+42
在1个频道中
Get PRO
十月 '25
+31
在0个频道中
Get PRO
九月 '25
+353
在1个频道中
Get PRO
八月 '250
在2个频道中
Get PRO
七月 '25
+186
在1个频道中
| 日期 | 订阅者增长 | 提及 | 频道 | |
| 29 七月 | +3 | |||
| 28 七月 | +1 | |||
| 27 七月 | +1 | |||
| 26 七月 | +1 | |||
| 25 七月 | +1 | |||
| 24 七月 | 0 | |||
| 23 七月 | 0 | |||
| 22 七月 | 0 | |||
| 21 七月 | 0 | |||
| 20 七月 | +1 | |||
| 19 七月 | 0 | |||
| 18 七月 | +1 | |||
| 17 七月 | 0 | |||
| 16 七月 | +1 | |||
| 15 七月 | 0 | |||
| 14 七月 | 0 | |||
| 13 七月 | +1 | |||
| 12 七月 | 0 | |||
| 11 七月 | +1 | |||
| 10 七月 | 0 | |||
| 09 七月 | 0 | |||
| 08 七月 | 0 | |||
| 07 七月 | 0 | |||
| 06 七月 | 0 | |||
| 05 七月 | +1 | |||
| 04 七月 | 0 | |||
| 03 七月 | 0 | |||
| 02 七月 | +3 | |||
| 01 七月 | +2 |
频道帖子
| 2 | FalkonC2 is Getting Ridiculously Stealthy
🛡️ Flare Research breaks down FalkonC2 — a commercial C2 framework written from scratch in C++/MASM64, built around sub-35 KB memory-only stubs with zero disk footprint and no CRT dependencies. Rotemelli2 targets enterprise EDR/XDR, rotating 17 private C2 servers with full domain burn every 72 hours, falling back across HTTP/HTTPS (MM4 + ChaCha20), DNS tunneling and ICMP beacons. Highlights: RMM Loader Nohost abusing renamed ScreenConnect/Datto/SimpleHelp for silent Defender bypass and SYSTEM escalation, a Ring0 “BSOD Screen Disrupter” that blinds responders mid-investigation via HVNC, QuickBooks/Sage50 profiling for automated exfil, and Chrome token theft. Full write-up with leaked Tor dashboard telemetry and defensive recommendations: https://flare.io/learn/resources/blog/falkonc2 🚀
https://flare.io/learn/resources/blog/falkonc2
🔗 Link
🕹Subscribe to MalDev | GaK3r | 160 |
| 3 | https://x.com/fried_rice/status/2080200610985689222?s=46 | 181 |
| 4 | CET-Compliant Callstack Spoofing via Thread Pool Enum Callback Trampolining
🛡️ New research shows a CET‑compliant call‑stack spoofing trick that hijacks Windows thread‑pool enum callbacks as syscall trampolines—bypassing EDR stack telemetry while keeping Intel shadow‑stack invariants intact.
Dive into the methodology, timeline of syscall evasion, and the underlying mechanics (RtlVirtualUnwind, TEB tricks, etc.) in the full write‑up: https://mrtiz.github.io/cet-callstack-spoofing-thread-pool-trampoline 🚀
https://mrtiz.github.io/cet-callstack-spoofing-thread-pool-trampoline
🔗 Link
🕹Subscribe to MalDev | GaK3r | 205 |
| 5 | https://github.com/Astharot15/COMLoaderAstharot/ | 312 |
| 6 |  Accelerating EDR Evasion with LLM-Driven Analysis
SpecterOps (Adam Chester) shows how a dead-simple LLM harness running in a loop—GPT‑5.5‑Cyber in Codex with Binary Ninja exposed over MCP—reverse engineers Palo Alto’s Cortex XDR to pull out its YARA rules, behavioral detections (DSE/BIOC, CLIPS), and local ML models, auto-generating the Python decryption tooling and evasion test harnesses along the way. No multi-agent orchestration—just Codex, Binary Ninja, and a while loop.
🔗 Link
https://specterops.io/blog/2026/06/29/llm-powered-edr-analysis
🕹Subscribe to MalDev | GaK3r | 457 |
| 7 | WindowsSentinel
WindowsSentinel is a lightweight C# utility that continuously monitors key Windows system events—such as file, process, and registry changes—and logs them in real‑time for easy auditing and troubleshooting.
🔗 Link
🕹Subscribe to MalDev | GaK3r | 409 |
| 8 |  Mini Shai-Hulud / Miasma / Hades
🚨 Malware is now weaponizing your own AI scanner against you.
A new wave of worms — Mini Shai-Hulud, Miasma, and Hades — ship with a fake “CLASSIFIED BRIEFING” header stuffed with nuclear & bioweapon design text, placed as a non-executing JavaScript comment at the top of _index.js. The point isn’t to run anything — it’s to trip the safety refusals of LLM-based malware triage so the scanner bails before it ever reaches the obfuscated Hades payload below. Refusal → false negative → package ships clean. The campaign targets bioinformatics and MCP developers, with newer variants using .pth loaders and native extensions to drop Bun-powered stealers that scrape GCP, Azure, and CI/CD secrets on install.
This is second-order alignment blindspots turned into a real-world evasion primitive. Lesson for anyone building an AI analysis pipeline: separate untrusted sample content from instructions, and never let a refusal silently equal “benign.”
👉 Full breakdown: https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious
🔗 Link
🕹Subscribe to MalDev | GaK3r | 383 |
| 9 |  没有文字... | 36 |
| 10 |  HijackLibs.net
🚨 DLL Hijacking just got a lot easier to track (and exploit).
HijackLibs.net is a curated database mapping vulnerable executables to exploitable DLLs—complete with metadata for defenders to detect attacks and red teamers to plan operations. It covers key techniques like DLL Sideloading, Phantom DLL Hijacking, and Search Order Hijacking—all critical for modern threat hunting and red teaming.
👉 Dive in: https://hijacklibs.net
https://hijacklibs.net
🔗 Link
🕹Subscribe to MalDev | GaK3r | 412 |
| 11 | HijackLibs.net
🚨 DLL Hijacking just got way easier to track—and exploit.
HijackLibs.net is a curated database mapping vulnerable executables to exploitable DLLs—perfect for red teamers hunting attack paths or defenders spotting suspicious load patterns. With clear breakdowns of sideloading, phantom hijacking, and search-order abuse (T1574.001), it’s the go-to resource for mastering this stealthy, often undetected technique.
👉 Dive in: https://hijacklibs.net
https://hijacklibs.net
🔗 Link
🕹Subscribe to MalDev | GaK3r | 1 |
