Source Byte

Pay2Key: A New Player in the RaaS Market with an Eye on Russia

Threat Intelligence F6 analysts have studied the Pay2Key ransomware service, which has been distributed on Russian-language cybercriminal forums using the RaaS model since late February 2025.

UACMe

Defeating Windows User Account Control by abusing built-in Windows AutoElevate backdoor. This project demonstrates various UAC bypass techniques and serves as an educational resource for understanding Windows security mechanisms.

#uac_bypass

UAC-0001 cyberattacks on the security and defense sector using the LAMEHUG software tool using the LLM (Large Language Model) (CERT-UA#16039) https://cert.gov.ua/article/6284730

Binja 啥时候加了 pseudo rust，真意外

Red Team Tactics: Writing Windows Kernel Drivers for Advanced Persistence (Part 1) Red Team Tactics: Writing Windows Kernel Drivers for Advanced Persistence (Part 2)

This post, as indicated by the title, will cover the topic of writing Windows kernel drivers for advanced persistence. Because the subject matter is relatively complex, I have decided to divide the project into a three or a four part series. This being the first post in the series, it will cover the fundamental information you need to know to get started with kernel development. This includes setting up a development environment, configuring remote kernel debugging and writing your first “Hello World” driver.

🔍 قابل توجه علاقه‌مندان به امنیت سیستم‌عامل و توسعه اکسپلویت در لینوکس من همیشه به تدریس علاقه‌مند بوده‌ام؛ نه صرفاً آموزش تئوری، بلکه انتقال واقعی تجربه‌ها و درک عمیق مفاهیم فنی. از سال‌ها پیش، تمرکزم روی internal سیستم‌عامل‌ها—به‌ویژه ویندوز و لینوکس—و مباحث امنیتی بوده و سعی کرده‌ام این مطالب تخصصی را به زبانی ساده، کاربردی و قابل‌فهم برای دیگران ارائه دهم. 🎓 حالا نوبت یک قدم جدید و متفاوت رسیده: «دوره‌ی Exploit Development در لینوکس» از تحلیل آسیب‌پذیری‌ واقعی گرفته تا نوشتن اکسپلویت‌های عملی و کاربردی. اما تصمیم گرفتم یک شرط خاص برای انتشار این دوره بگذارم: 🎯 اگر اعضای کانالم به ۵۰۰۰ نفر برسند، دوره را به صورت کامل و رایگان منتشر می‌کنم. بیش از ۲۰ ساعت ویدئو و تمرین عملی بدون تبلیغات، بدون پرداخت هزینه—صرفاً برای این‌که دانش تخصصی، راحت‌تر و بی‌واسطه به دست کسانی برسه که واقعاً به یادگیری اهمیت می‌دن. 🧠 اگر شما هم به این مسیر علاقه‌مندید یا فکر می‌کنید افراد دیگری در اطرافتان هستند که این محتوا به دردشان می‌خورد، خوشحال می‌شم با معرفی کانالم به دوستان‌تان از این پروژه حمایت کنید. 📎 لینک کانال: https://t.me/OxAA55 ✍️راستی سرفصل دوره رو هم می‌تونید در لینک زیر مشاهده کنید: https://t.me/OxAA55/140

发了一个新版本 (1.1.0)，这个版本： - 把注入换成 DLL 了方便塞进更多逻辑 - 添加了随机窗口标签的功能 - 添加了隐藏 Evanesco 自己窗口的功能 - 设置窗口 - 修复了显示窗口的时候会把用户看不到的窗口也显示出来的问题 - 做了个 Wnidows 安装包方便安装 https://github.com/k4yt3x/Evanesco/releases/tag/1.1.0

Iran's Internet: A Censys Perspective https://censys.com/blog/irans-internet-a-censys-perspective

As of now, the main message-receiving account of Iran International has been fully breached and taken over. This channel, long used as a so-called "secure line" for communication with informants, spies, traitors, and foreign agents, is now under our complete control. During this operation, all incoming messages, attachments, reports, images, and videos shared with this channel have been extracted in full. The content has been processed and cross-referenced against multiple intelligence and identification databases. We now possess the full identity profiles of over 71,000 individuals who have contacted this network. These names and data are now classified, indexed, and archived. Selected portions will be released soon. Our analysis confirms the existence of a media-based espionage and influence network directed by Mossad, operating under the false flag of “independent journalism”. To everyone who has reached out to this network: You are being watched. Your information has been logged. And your reckoning is near. This is not just a hack. This is a direct declaration of presence by the resistance inside the heart of enemy systems. Expect us. We are closer than you think. @Handala_Channel #Handala

.

Demystifying Firmware Blobs in Linux

Posted Jul 5, 2025 Updated Jul 5, 2025 By Iman Seyed

Most Linux systems rely on binary blobs to activate the full capabilities of hardware like Bluetooth and Wi-Fi chips. But what are these blobs, and how does the kernel load them?

this report is bullshit or is related to past incidents here is statement of the Datin company :

Сеть «Iran Hayom» публикует антиизраильскую пропаганду на иврите и английском языке в X , Instagram , TikTok , Telegram и YouTube . Ее название является игрой слов на популярной израильской газете Israel Hayom , которая публикуется на иврите на israelhayom[.]co[.]il и чей английский веб-сайт israelhayom[.]com . Логотип Iran Hayom даже заимствует элементы дизайна из Israel Hayom . https://www.fdd.org/analysis/2025/07/01/fdd-connects-anti-israel-network-on-social-media-to-iranian-website-pro-regime-actor/