Exciting times. I'm publishing Dittobytes today after presenting it at @OrangeCon_nl !
Dittobytes is a true metamorphic cross-compiler aimed at evasion. Use Dittobytes to compile your malware. Each compilation produces unique, functional shellcode.
github.com/tijme/dittobyt…
Four months of development and maintenance have yielded considerable results. With the new changes introduced, the old demo was somewhat obsolete, so I decided to upload a new one where you can better see the current improvements to Neo4LDAP.
youtube.com/watch?v=f2vkcr…
AvePoint has fixed a vulnerability in DocAve, Perimeter and Compliance Guardian discovered by our researchers @m1ntko and @Calvaruga.
This vulnerability can be used to achieve Remote Code Execution (RCE) in affected systems.
➡️ Advisory: avepoint.com/company/docave…
Proactively creating processes with Protected Process Light (PPL) protection will give you more opportunities to abuse these processes. Detailed article:
zerosalarium.com/2025/08/counte…
I remember that I had to do some research online on how to make exploits for vulnerabilities over MS-RPC. With this blog, I hope to fill the gap on the lacking information available online on how to make these yourself.
incendium.rocks/posts/Exploit-…
This is so much! 🔥🔥😎
Found two new Potato triggers just today. Not only Potato but can also be used for LPE as remote auth is done which could be relayed to LDAP without Signing enabled. Or relayed to ADCS for a certificate.
github.com/warpnet/MS-RPC…
Who doesn't love a sequel? Part one our series on secure #enclaves for #offensive operations highlighted how enclaves work and how to develop your own.
Part two is out now and shares what we discovered while digging into enclave internals:
outflank.nl/blog/2025/06/1…
Windows 11 24H2 broke a popular malware evasion technique! The Lloyd Labs self-deletion method now fails because of NTFS changes, so I spent time with kernel debugging to figure out why and how to fix it.
Full technical breakdown: tkyn.dev/2025-6-8-The-N…
Im happy to announce Neo4LDAP — a query and visualization tool focused on Active Directory environments.
It combines LDAP syntax with graph-based data analysis in Neo4j, offering an alternative approach to tools like BloodHound.
youtube.com/watch?v=5V22K3…
🧵: 1/4
hOw Do I lEaRn MaLwArE StUfF
If you're new to malware stuff, and want to learn malware stuff, go to our paper collection.
If you read 10% of our malware analysis paper collection (took notes, seriously understood it), you'd be a fuckin' monster.
If you know how to code…
hOw Do I lEaRn MaLwArE StUfF
If you're new to malware stuff, and want to learn malware stuff, go to our paper collection.
If you read 10% of our malware analysis paper collection (took notes, seriously understood it), you'd be a fuckin' monster.
If you know how to code…
Attacks against AD CS are de rigueur these days, but sometimes a working attack doesn’t work somewhere else, and the inscrutable error messages are no help. Jacques replicated the most infuriating and explains what’s happening under the hood in this post sensepost.com/blog/2025/divi…
If you're into WinDbg and debugging, check out my GitHub repository! I’ve put together content on getting started, practicing with kernel memory dumps, analyzing user-mode dumps with exploits, and more. github.com/DebugPrivilege…
I've just released Eclipse, a PoC of what I call Activation Context Hijack. This technique redirects any application to load an arbitray DLL, allowing to inject code into any trusted process. More info available on Github. github.com/Kudaes/Eclipse
I didn't realize that LoadLibrary allows UNC paths, meaning you can load a dll from a remote share without writing it to the current host. Doesn't this directly bypass some static/sandbox analysis performed by some security products? 🤔
Analyzing Procmon stack trace is always a great source of knowledge. Today it showed me that in current versions of Windows win32u.dll performs syscalls in a legitimate way. Idk if its needed, but I guess it can be used as an alternative to ntdll to perform indirect syscalls🙃
12K Followers 490 FollowingSr. Penetration Tester / Red Team Operator @ptswarm :: Author of the Pentester’s Promiscuous Notebook :: He/him :: Tweets’re my pwn 🐣
1 Followers 63 FollowingAdventure-seeker, coffee enthusiast, and occasional shower singer 🤟☕️ | Living life one epic story at a time! #LifeOfAdventure #CoffeeLover
312 Followers 1K FollowingLoco autodidacta. A veces hago cosas de informáticos, pero no, no sé cómo se hace 'eso' en Office. Transhumanista bostromiano. FALC
12K Followers 490 FollowingSr. Penetration Tester / Red Team Operator @ptswarm :: Author of the Pentester’s Promiscuous Notebook :: He/him :: Tweets’re my pwn 🐣
30K Followers 561 FollowingCyBeRsEcUrItY | Not afraid to put down with some THICC malware on disk | securing and breaking AI @PaloAltoNtwks | Ex @spacex
14K Followers 917 FollowingWindows Internals expert, author, and trainer. Teaching system programming & debugging at TrainSec. Check out my books & courses! 🚀 #WindowsInternals #TrainSec
4K Followers 706 FollowingElastic Security Labs is democratizing security by sharing knowledge and capabilities necessary to prepare for threats. Spiritually serving humanity since 2019.
499K Followers 372 FollowingMedia platform covering global conflict zones. Focus on the Russian-Ukrainian war. If you'd like to support our voluntary work: https://t.co/PmM2wwDA1Y.
13K Followers 309 FollowingThreat Researcher, Blue Team, DFIR, Malware Analysis, and Reverse Engineering.
“⚔️What do we say to God of malware, Not today⚔️”
462K Followers 274 FollowingJungler for ? / Variety Streamer / Degen / I like to miss skillshots Streamer/Content creator https://t.co/ozrDZBRSW0 https://t.co/FovbaBPT4D