Source Byte

RansomHub ransomware abuses Kaspersky TDSSKiller to disable EDR software https://www.bleepingcomputer.com/news/security/ransomhub-ransomware-abuses-kaspersky-tdsskiller-to-disable-edr-software/

⚙️From COM Object Fundamentals To UAC Bypasses A 25-minute crash course covering Tokens, Privileges, UAC, COM, and ultimately bypassing UAC. 🔗Research: https://www.youtube.com/watch?v=481SI_HWlLs 🔗Source: https://github.com/tijme/conferences/tree/master/2024-09%20OrangeCon/code #windows #com #uac #bypass

RedTeam Workshop - Part 3

Execution + T1059.001 | PowerShell + T1059.003 | Windows Command Shell + T1059.005 | Visual Basic + T1106 | Native API + T1053.005 | Scheduled Task + T1569.002 | Service Execution + T1024.002 | Malicious File Persistence + T1543.003 | Windows Service

https://www.youtube.com/watch?v=XjeIPE4g33s slides / notes : https://github.com/soheilsec/RT-workshop-2024 credit : @soheilsec language : persian

Bear C2 is a compilation of C2 scripts, payloads, and stagers used in simulated attacks by Russian APT groups

Bear features a variety of encryption methods, including AES, XOR, DES, TLS, RC4, RSA and ChaCha to secure communication between the payload and the operator machine.

GitHub

Schools need to stop teaching kids malware is like, 'trojans', and 'worms', etc. It's not 1996 anymore. New malware types: - Ransomware - Loaders - Information Stealers - Piles of shit that doesn't work - RATs

A set of programs for analyzing common vulnerabilities in COM

PS A:\mzhmo> .\PermissionHunter.exe -h ,

-. \ .-' ,-"````""-\__ | / '-.._ _.-' '-o, _>--:{{< ) |) .-'' '-.__.-o '-._..-/ | \ ,-' / -. ` PermissionHunter - hunt for incorrect LaunchPermission and ActivatePermission CICADA8 Research Team From Michael Zhmaylo (MzHmO) PermissionHunter.exe Small tool that allows you to find vulnerable COM objects with incorrect LaunchPermission and ActivatePermission [OPTIONS] -outfile : output filename -outformat : output format. Accepted 'csv' and 'xlsx' -h/--help : shows this windows CICADA8-Research #windows #com

Windows 10 Segment Heap Internals #binary #windows #internals ——— 🆔 @Infosec_Fortress

RedTeam Workshop - Part 2

+ Description of the simulation scenario + Overview on TTP Explanation + why we chose Cobalt Strike CS + Simulation of IA Tactics Initial Access + T1189 | Drive by compromise + T1566.001 | Spear-Phishing Attachment Defense Evasion + T1027.006 | HTML smuggling

https://www.youtube.com/watch?v=mRl7o7Uq-IE slides / notes : https://github.com/soheilsec/RT-workshop-2024 credit : @soheilsec language : persian

The (Anti-)EDR Compendium EDR functionality and bypasses in 2024, with focus on undetected shellcode loader. https://blog.deeb.ch/posts/how-edr-works/

Analysis of a Caddy Wiper Sample Targeting Ukraine Credit: Ali Mosajjal

FindFirstFileA FindNextFileA CreateFileA GetFileSize LocalAlloc SetFilePointer WriteFile LocalFree CloseHandle FindClose

https://blog.n0p.me/2022/03/2022-03-26-caddywiper/

RedTeam Workshop - Part 1

+ What is RedTeam + What is APT Group + Types of Hackers + Why RedTeam Matters + The Cost of Data Leakage and Data Breach + What is MitreAttack

https://www.youtube.com/watch?v=8drwwezrrYU slides / notes : https://github.com/soheilsec/RT-workshop-2024 credit : @soheilsec language : persian

Cobalt Strike 4.9 Download: https://ponies.cloud/c2/CobaltStrike%204.9%20Cracked%20uCare@Pwn3rzs.7z Password: 20231004_2218 Full Black client: https://ponies.cloud/c2/CobaltStrike%204.9%20Client%20Only%20Full%20Theme%20uCare@Pwn3rzs.7z Password: 20231005_2033 Enjoy! NOTE: Our releases of Cobalt Strike will always be packed and obfuscated. Unlike the crack previously shared by the Chinese website, to which we are not linked.

Rust for Malware Development

This repository contains source codes of various techniques used by real-world malware authors, red teamers, threat actors, state-sponsored hacking groups etc. These techniques are well-researched and implemented in Rust.

Repository managed by @5mukx