<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
<channel>
<title><![CDATA[ ParaCyberBellum Security Review ]]></title>
<description><![CDATA[ Cybersecurity technical stuff on the fly ]]></description>
<link>https://library.paracyberbellum.io/rss</link>
<atom:link href="https://library.paracyberbellum.io/rss" rel="self" type="application/rss+xml"/>
<language>en</language>
<pubDate>Thu, 07 May 2026 05:26:27 +0000</pubDate>
<item>
<title><![CDATA[ [ARTICLE] Jenny was a Friend of Mine - MCPs and Friends ]]></title>
<link>https://blog.zsec.uk/bullyingllms/</link>
<guid>https://blog.zsec.uk/bullyingllms/</guid>
<pubDate>Thu, 07 May 2026 04:12:31 +0000</pubDate>
<description><![CDATA[ [ Code Analysis - Machine Learning & AI ] I'm going to deep dive into how I built an autonomous vulnerability hunting system using Claude Code and MCP, and some of the bugs it's found along the way.  ]]></description>
<author><![CDATA[ Andy Gill ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Make it Blink: Over-the-Air Exploitation of the Philips Hue Bridge ]]></title>
<link>https://www.synacktiv.com/en/publications/make-it-blink-over-the-air-exploitation-of-the-philips-hue-bridge</link>
<guid>https://www.synacktiv.com/en/publications/make-it-blink-over-the-air-exploitation-of-the-philips-hue-bridge</guid>
<pubDate>Thu, 07 May 2026 04:09:58 +0000</pubDate>
<description><![CDATA[ [ Exploits & Payloads - IoT & ICS ] This article details the research conducted on the Philips Hue Bridge to achieve remote code execution (RCE) from the Zigbee network. ]]></description>
<author><![CDATA[ Mehdi Talbi, Matthieu Breuil ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Chaining ISC DHCP Server Features for Unauthenticated Root Remote Code Execution ]]></title>
<link>https://shells.systems/chaining-isc-dhcp-server-features-for-unauthenticated-root-remote-code-execution/</link>
<guid>https://shells.systems/chaining-isc-dhcp-server-features-for-unauthenticated-root-remote-code-execution/</guid>
<pubDate>Thu, 07 May 2026 04:07:24 +0000</pubDate>
<description><![CDATA[ [ Exploits & Payloads ] I found an interseting chain of intended features and behaviors in ISC DHCP Server (dhcpd), a common DHCP implementation in Linux environments. When combined together, give you unauthenticated remote code execution as root. ]]></description>
<author><![CDATA[ Askar ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook ]]></title>
<link>https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan</link>
<guid>https://www.elastic.co/security-labs/tclbanker-brazilian-banking-trojan</guid>
<pubDate>Thu, 07 May 2026 03:52:59 +0000</pubDate>
<description><![CDATA[ [ Malware Analysis ] Technical analysis of TCLBANKER, a banking trojan deployed by a trojanized Logitech installer,  with environment-gated payloads, WPF fraud overlays, and self-propagating WhatsApp and Outlook worm modules. ]]></description>
<author><![CDATA[ Daniel Stepanic, Jia Yu Chan, Seth Goodwin, Terrance Dejesus ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] The Accidental C2: Exploring Dev Tunnels for Remote Access ]]></title>
<link>https://specterops.io/blog/2026/05/06/dev-tunnels-the-accidental-c2/</link>
<guid>https://specterops.io/blog/2026/05/06/dev-tunnels-the-accidental-c2/</guid>
<pubDate>Thu, 07 May 2026 03:46:04 +0000</pubDate>
<description><![CDATA[ [ C2 & Exfiltration ] Peel back the layers of Microsoft Dev Tunnels and you'll find embedded protocols, RPC message exchanges, and a full command-and-control architecture hiding in plain sight. ]]></description>
<author><![CDATA[ Adam Chester ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] SQLRecon ]]></title>
<link>https://github.com/skahwah/SQLRecon</link>
<guid>https://github.com/skahwah/SQLRecon</guid>
<pubDate>Thu, 07 May 2026 03:41:19 +0000</pubDate>
<description><![CDATA[ [ Application Security - Enumeration, Reconnaissance & Scanning - Post-Exploitation & Lateral Movement ] A C# MS SQL toolkit designed for offensive reconnaissance and post-exploitation.  ]]></description>
<author><![CDATA[ Sanjiv Kawa ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] dMSA Ouroboros: Self-Sustaining Credential Extraction in Windows Server 2025 ]]></title>
<link>https://www.huntress.com/blog/dmsa-ouroboros-credential-extraction-windows-server-2025</link>
<guid>https://www.huntress.com/blog/dmsa-ouroboros-credential-extraction-windows-server-2025</guid>
<pubDate>Thu, 07 May 2026 03:37:01 +0000</pubDate>
<description><![CDATA[ [ Credentials Dumps, Theft and Cracking ] A fully patched Windows Server 2025 domain is vulnerable to dMSA Ouroboros - a self-sustaining credential extraction technique requiring only standard delegated permissions. This article discusses how this attack works, why remediation fails, and how to detect it. ]]></description>
<author><![CDATA[ Andrew Schwartz ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] The New Ouroboros Technique and How It Fits in dMSA's Security Model ]]></title>
<link>https://www.akamai.com/blog/security-research/ouroboros-technique-how-fits-dmsas-security-model</link>
<guid>https://www.akamai.com/blog/security-research/ouroboros-technique-how-fits-dmsas-security-model</guid>
<pubDate>Thu, 07 May 2026 03:29:48 +0000</pubDate>
<description><![CDATA[ [ Credentials Dumps, Theft and Cracking ] Delegated Managed Service Accounts (dMSAs) move away from LDAP-based password retrieval toward a Kerberos-based credential issuance flow, introducing new logic-based risks. Specifically, the Ouroboros primitive demonstrates that if an attacker controls dMSA permissions, they can inherit the privileges of the superseded legacy account. ]]></description>
<author><![CDATA[ Yuval Gordon ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Auditing Application Permissions in Microsoft Entra ID: Hidden Risks, Pitfalls, and Quarkslab's QAZPT Tool ]]></title>
<link>https://blog.quarkslab.com/auditing-application-permissions-in-microsoft-entra-id-hidden-risks-pitfalls-and-quarkslabs-qazpt-tool.html</link>
<guid>https://blog.quarkslab.com/auditing-application-permissions-in-microsoft-entra-id-hidden-risks-pitfalls-and-quarkslabs-qazpt-tool.html</guid>
<pubDate>Thu, 07 May 2026 03:25:32 +0000</pubDate>
<description><![CDATA[ [ Active Directory - Public Cloud - Tooling ] This blog post explores Entra ID applications, the complexities of auditing application permissions in Microsoft Entra ID, highlighting hidden risks and pitfalls. It introduces QAZPT tool, designed to compute and visualize effective permissions in an Entra ID tenant, providing insights into the full picture of permissions and inheritance paths. ]]></description>
<author><![CDATA[ Sebastien Rolland ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Ghosts of Encryption Past - How we Read All Your Emails in Salesforce Marketing Cloud ]]></title>
<link>https://slcyber.io/research-center/ghosts-of-encryption-past-salesforce-exacttarget/</link>
<guid>https://slcyber.io/research-center/ghosts-of-encryption-past-salesforce-exacttarget/</guid>
<pubDate>Wed, 06 May 2026 03:50:11 +0000</pubDate>
<description><![CDATA[ [ Exploits & Payloads ] We discovered multiple critical flaws in Salesforce Marketing Cloud’s templating engine and its “view‑email” link encryption:  unsafe AMPScript/SSJS template injection, double‑evaluation of subject lines, and a weak, exploitable CBC‑based encryption scheme. Chained together they let attackers read or alter any subscriber data and emails across tenants. ]]></description>
<author><![CDATA[ Adam Kues, Dylan Pindur, Shubham Shah, Tomais Williamson ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] The AWS Bedrock API Keys Security Guide Part 1: Risks, Vulnerabilities, and Attack Techniques ]]></title>
<link>https://www.beyondtrust.com/blog/entry/aws-bedrock-security-api-keys</link>
<guid>https://www.beyondtrust.com/blog/entry/aws-bedrock-security-api-keys</guid>
<pubDate>Wed, 06 May 2026 03:42:13 +0000</pubDate>
<description><![CDATA[ [ Authentication - Public Cloud ] This article documents the security risks introduced by AWS Bedrock API keys, the authentication method AWS for Amazon Bedrock. The most critical risk being the "phantom user" problem: when long-term Bedrock API key is created through the AWS Console, AWS automatically provisions an IAM user and attaches the AmazonBedrockLimitedAccess managed policy without explicit user confirmation. ]]></description>
<author><![CDATA[ Sergio Garcia ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Fuzzing to Zero-Day: Pwning V8CTF With TurboFan Type Confusion, CVE-2025-2135 ]]></title>
<link>https://www.zellic.io/blog/pwning-v8ctf/</link>
<guid>https://www.zellic.io/blog/pwning-v8ctf/</guid>
<pubDate>Wed, 06 May 2026 03:37:50 +0000</pubDate>
<description><![CDATA[ [ Exploits & Payloads ] We discovered a type-confusion vulnerability in Chrome’s V8 engine that can be exploited to achieve remote code execution (CVE-2025-2135). In this post, we’ll walk through the bug’s root cause, demonstrate a proof of concept, detail the step-by-step exploitation process, and examine how Google patched the vulnerability. ]]></description>
<author><![CDATA[ Sakura ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Malware Analysis: How to Analyze and Understand Malware ]]></title>
<link>https://www.blackhillsinfosec.com/malware-analysis-how-to-analyze-and-understand-malware/</link>
<guid>https://www.blackhillsinfosec.com/malware-analysis-how-to-analyze-and-understand-malware/</guid>
<pubDate>Tue, 05 May 2026 03:50:39 +0000</pubDate>
<description><![CDATA[ [ Malware Analysis - Tooling ] A list of tools, tips, and advice to help you understand how to begin your malware analysis journey. ]]></description>
<author><![CDATA[ John Hammond ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Windows Privilege Escalation - Part 2: Running through PrivEsc Paths from Zero ]]></title>
<link>https://niklas-heringer.com/skills-lab/windows-privilege-escalation-02-privesc-paths/</link>
<guid>https://niklas-heringer.com/skills-lab/windows-privilege-escalation-02-privesc-paths/</guid>
<pubDate>Tue, 05 May 2026 03:45:51 +0000</pubDate>
<description><![CDATA[ [ Active Directory - Labs & Simulation ] Working through HackTheBox's Windows Privilege Escalation module as a beginner, we will document every token abuse, group membership exploit, and real mistake identified. This journey will lead us to SYSYEM through SeImpersonate, DnsAdmins, Server Operators, SeBackupPrivilege and more. ]]></description>
<author><![CDATA[ Niklas Heringer ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Recursively fuzzing MS-RPC structures and monitoring using ETW ]]></title>
<link>https://www.incendium.rocks/posts/Fuzzing-MS-RPC-structures-and-monitoring/</link>
<guid>https://www.incendium.rocks/posts/Fuzzing-MS-RPC-structures-and-monitoring/</guid>
<pubDate>Tue, 05 May 2026 03:41:07 +0000</pubDate>
<description><![CDATA[ [ Fuzzing - Privilege Escalation ] We detail how we improved the MS-RPC fuzzer woth support for  fuzzing over complex structures and logging using ETW, and how we found a way to escalate to nt authority\system. ]]></description>
<author><![CDATA[ Remco Van Der Meer ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Offensive Security: Speeding up Active Directory Pentests with ADScan and ADPulse ]]></title>
<link>https://hackers-arise.com/offensive-security-speeding-up-active-directory-pentests-with-adscan-and-adpulse/</link>
<guid>https://hackers-arise.com/offensive-security-speeding-up-active-directory-pentests-with-adscan-and-adpulse/</guid>
<pubDate>Tue, 05 May 2026 03:39:05 +0000</pubDate>
<description><![CDATA[ [ Active Directory - Pentests & Red Teams - Tooling ] We review how ADScan and ADPulse can speed up reconnaissance steps in an Active Directory pentesting context. ]]></description>
<author><![CDATA[ Co11Ateral ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Understanding Windows Artefacts as Evidence, Not Indicators ]]></title>
<link>https://sethenoka.com/understanding-windows-artefacts-as-evidence-not-indicators/</link>
<guid>https://sethenoka.com/understanding-windows-artefacts-as-evidence-not-indicators/</guid>
<pubDate>Mon, 04 May 2026 04:47:50 +0000</pubDate>
<description><![CDATA[ [ Incident Response & Forensics ] Windows forensic artefacts are one of the core evidence sources used in digital forensics and incident response (DFIR) investigations. In this article, we’ll cover why Windows artefacts are evidence, the difference between indicators and evidence, how scope, retention, environment, and noise affect interpretation, a model for building defensible evidence claims, and common cognitive traps that lead analysts to overstate conclusions. ]]></description>
<author><![CDATA[ Seth Enoka ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] VEN0m Ransomware ]]></title>
<link>https://github.com/samftggr/VEN0m-Ransomware</link>
<guid>https://github.com/samftggr/VEN0m-Ransomware</guid>
<pubDate>Mon, 04 May 2026 04:44:36 +0000</pubDate>
<description><![CDATA[ [ Malwares - Obfuscation, Evasion & LoL ] Demonstrate how a signed driver can bypass defenses to deploy ransomware on Windows 11 with advanced AV and UAC evasion techniques. ]]></description>
<author><![CDATA[ samftggr ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] SSRF - Redis - RCE ]]></title>
<link>https://github.com/Manlware/SSRF_Redis_RCE</link>
<guid>https://github.com/Manlware/SSRF_Redis_RCE</guid>
<pubDate>Mon, 04 May 2026 04:43:53 +0000</pubDate>
<description><![CDATA[ [ Application Security - Labs & Simulation ] This lab simulates a vulnerable web application that allows Server-Side Request Forgery (SSRF). The goal is to escalate this into Remote Code Execution (RCE) by interacting with an internal Redis service. ]]></description>
<author><![CDATA[ Mahmoud Abdelhamid ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] From Zero to SYSTEM: Building PrintSpoofer from Scratch ]]></title>
<link>https://bl4ckarch.github.io/posts/PrintSpoofer_from_scratch/</link>
<guid>https://bl4ckarch.github.io/posts/PrintSpoofer_from_scratch/</guid>
<pubDate>Mon, 04 May 2026 04:42:05 +0000</pubDate>
<description><![CDATA[ [ Exploits & Payloads ] A complete journey from understanding Named Pipes to building an undetectable PrintSpoofer learning Windows internals, token impersonation, RPC, and evasion techniques along the way. ]]></description>
<author><![CDATA[ Bl4Ckarch ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] EDR Silencing ]]></title>
<link>https://ipurple.team/2026/01/12/edr-silencing/</link>
<guid>https://ipurple.team/2026/01/12/edr-silencing/</guid>
<pubDate>Mon, 04 May 2026 04:38:29 +0000</pubDate>
<description><![CDATA[ [ EDR - Obfuscation, Evasion & LoL ] We detail how attackers with elevated privileges can disable or hide EDR sensors by blocking the agents' outbound traffic, using Windows Filtering Platform filters, hosts‑file or DNS policy edits, routing/IPSec tweaks, and secondary IP assignment. We also outline the corresponding detection methods and mitigation steps. ]]></description>
</item>
<item>
<title><![CDATA[ [TOOL] Libghidra ]]></title>
<link>https://github.com/0xeb/libghidra</link>
<guid>https://github.com/0xeb/libghidra</guid>
<pubDate>Mon, 04 May 2026 04:29:37 +0000</pubDate>
<description><![CDATA[ [ Reverse Engineering ] SDK for automating Ghidra from Python, Rust, and C++. Decompile, rename, annotate, inspect symbols/types/xrefs, and manage project lifecycle programmatically - treat Ghidra like infrastructure, not just a GUI. ]]></description>
<author><![CDATA[ Elias Bachaalany ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] The Bot Left a Fingerprint: Detecting and Attributing LLM-Generated Passwords ]]></title>
<link>https://blog.gitguardian.com/the-bot-fingerprint-detecting-llm-passwords/</link>
<guid>https://blog.gitguardian.com/the-bot-fingerprint-detecting-llm-passwords/</guid>
<pubDate>Mon, 04 May 2026 04:17:13 +0000</pubDate>
<description><![CDATA[ [ Credentials Dumps, Theft and Cracking - Machine Learning & AI ] LLMs leave statistical fingerprints in the passwords they generate. We built a 100-year-old model to find them and detected 28,000 in the wild. ]]></description>
<author><![CDATA[ Gaetan Ferry ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] CI/CD pipeline abuse: the problem no one is watching ]]></title>
<link>https://www.elastic.co/security-labs/detecting-cicd-pipeline-abuse-with-llm-augmented-analysis</link>
<guid>https://www.elastic.co/security-labs/detecting-cicd-pipeline-abuse-with-llm-augmented-analysis</guid>
<pubDate>Mon, 04 May 2026 04:08:32 +0000</pubDate>
<description><![CDATA[ [ DevOps - Incident Response & Forensics - Tooling ] How we built an open-source, drop-in CI template that uses signal extraction and LLM reasoning to catch CI/CD abuse in GitHub Actions, GitLab CI, and Azure DevOps pipelines. ]]></description>
<author><![CDATA[ Mika Ayenson ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Jenkins honeypot reveals botnet exploiting scriptText to launch DDoS attacks on game servers ]]></title>
<link>https://www.darktrace.com/blog/darktrace-malware-analysis-jenkins-honeypot-reveals-emerging-botnet-targeting-online-games</link>
<guid>https://www.darktrace.com/blog/darktrace-malware-analysis-jenkins-honeypot-reveals-emerging-botnet-targeting-online-games</guid>
<pubDate>Mon, 04 May 2026 04:06:05 +0000</pubDate>
<description><![CDATA[ [ Malware Analysis ] We observed attackers exploiting a Jenkins honeypot to deploy a new DDoS botnet targeting video game servers. Leveraging Jenkins scriptText abuse, the malware installs a multi-platform payload, evades detection, and launches UDP, TCP, and application-layer attacks. ]]></description>
</item>
<item>
<title><![CDATA[ [ARTICLE] AI-powered honeypots: Turning the tables on malicious AI agents ]]></title>
<link>https://blog.talosintelligence.com/ai-powered-honeypots-turning-the-tables-on-malicious-ai-agents/</link>
<guid>https://blog.talosintelligence.com/ai-powered-honeypots-turning-the-tables-on-malicious-ai-agents/</guid>
<pubDate>Mon, 04 May 2026 03:59:28 +0000</pubDate>
<description><![CDATA[ [ Deception & Mitigation - Machine Learning & AI ] This blog shows how generative AI allows defenders to instantly create diverse honeypots, like Linux shells or Internet of Things (IoT) devices, using simple text prompts. ]]></description>
<author><![CDATA[ Martin Lee ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Boutique phishing kit Saiga 2FA hides behind 'lorem ipsum' metadata ]]></title>
<link>https://blog.barracuda.com/2026/04/28/threat-spotlight--boutique-phishing-kit-saiga-2fa</link>
<guid>https://blog.barracuda.com/2026/04/28/threat-spotlight--boutique-phishing-kit-saiga-2fa</guid>
<pubDate>Mon, 04 May 2026 03:56:39 +0000</pubDate>
<description><![CDATA[ [ Phishing ] Saiga 2FA is a rare but highly sophisticated boutique phishing kit that uses adversary-in-the-middle (AitM) techniques to bypass multifactor authentication and steal session cookies in real time. Phishing campaigns leverage DocuSign-themed lures, QR code phishing, and layered redirection chains to appear legitimate. ]]></description>
<author><![CDATA[ Ashitosh Deshnur ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Hunting NTDS.dit Theft via VSS & NTFS Logs ]]></title>
<link>https://vikas891.github.io/posts/secrets-and-shadows/</link>
<guid>https://vikas891.github.io/posts/secrets-and-shadows/</guid>
<pubDate>Mon, 04 May 2026 03:51:44 +0000</pubDate>
<description><![CDATA[ [ Incident Response & Forensics ] We explain how attackers can steal a domain controller's Active Directory database (NTDS.dit) by using Volume Shadow Copy (VSS) and how investigators can detect this theft by correlating low‑level NTFS operational logs and related artifacts to reconstruct the exfiltration timeline. ]]></description>
<author><![CDATA[ Vikas Singh ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] DeadMatter ]]></title>
<link>https://github.com/qsecure-labs/DeadMatter</link>
<guid>https://github.com/qsecure-labs/DeadMatter</guid>
<pubDate>Mon, 04 May 2026 03:43:14 +0000</pubDate>
<description><![CDATA[ [ Credentials Dumps, Theft and Cracking ] DeadMatter is a specialized tool written in C#, designed to extract sensitive information, such as password hashes of active logon sessions, from memory dumps. It employs carving techniques to retrieve credentials from various file types, such as process or full memory dumps, either in raw or minidump format, decompressed hibernation files, virtual machine memory files, or other types of files that may contain logon credentials. ]]></description>
</item>
<item>
<title><![CDATA[ [ARTICLE] A Practical Guide to BloodHound Data Collection ]]></title>
<link>https://www.blackhillsinfosec.com/bloodhound-data-collection/</link>
<guid>https://www.blackhillsinfosec.com/bloodhound-data-collection/</guid>
<pubDate>Mon, 04 May 2026 03:39:41 +0000</pubDate>
<description><![CDATA[ [ Active Directory - Enumeration, Reconnaissance & Scanning - Tooling ] BloodHound is a tool used to enumerate Active Directory (AD) information. It provides a visual view of relationships between AD objects, which can be used to identify paths of domain privilege escalation. In this blog , we will focus on various methods to collect AD data to provide BloodHound as input. ]]></description>
<author><![CDATA[ Alyssa Snow ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] AIDA ]]></title>
<link>https://github.com/Vasco0x4/AIDA</link>
<guid>https://github.com/Vasco0x4/AIDA</guid>
<pubDate>Mon, 04 May 2026 03:32:28 +0000</pubDate>
<description><![CDATA[ [ Machine Learning & AI - Pentests & Red Teams ] Turn any LLM into an autonomous pentester. You define the scope, the agent does the work, you review the findings. ]]></description>
<author><![CDATA[ Vasco  ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] ECHO ]]></title>
<link>https://github.com/Mr-Spect3r/ECHO</link>
<guid>https://github.com/Mr-Spect3r/ECHO</guid>
<pubDate>Mon, 04 May 2026 03:30:23 +0000</pubDate>
<description><![CDATA[ [ RAT & Reverse Shells ] ECHO - Encrypted ChaCha20 Remote Shell with Dynamic Port Hopping ]]></description>
<author><![CDATA[ Specter ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Komari Red: The Monitoring Tool with a Built-in Reverse Shell ]]></title>
<link>https://www.huntress.com/blog/komari-c2-agent-abuse</link>
<guid>https://www.huntress.com/blog/komari-c2-agent-abuse</guid>
<pubDate>Mon, 04 May 2026 03:28:39 +0000</pubDate>
<description><![CDATA[ [ Incident Response & Forensics ] A threat actor walked in on stolen VPN credentials, pivoted via Impacket's smbexec.py, and installed Komari, a 4.3k-star open-source monitoring agent, as a SYSTEM-level backdoor masquerading as the "Windows Update Service". No custom loader, no attacker-controlled staging - the installer came straight from GitHub. ]]></description>
<author><![CDATA[ Josh Kiriakoff ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] Titanis ]]></title>
<link>https://github.com/trustedsec/Titanis</link>
<guid>https://github.com/trustedsec/Titanis</guid>
<pubDate>Fri, 01 May 2026 04:45:36 +0000</pubDate>
<description><![CDATA[ [ Network & WiFi - Pentests & Red Teams ] Windows protocol library, including SMB and RPC implementations, among others. ]]></description>
</item>
<item>
<title><![CDATA[ [ARTICLE] KYCShadow: An Android Banking Malware Exploiting Fake KYC Workflows for Credential and OTP Theft ]]></title>
<link>https://www.cyfirma.com/research/kycshadow-an-android-banking-malware-exploiting-fake-kyc-workflows-for-credential-and-otp-theft/</link>
<guid>https://www.cyfirma.com/research/kycshadow-an-android-banking-malware-exploiting-fake-kyc-workflows-for-credential-and-otp-theft/</guid>
<pubDate>Fri, 01 May 2026 04:40:33 +0000</pubDate>
<description><![CDATA[ [ Malware Analysis - Mobile ] Analysis of an Android malware that operates as a multi-stage dropper that installs a secondary payload and establishes persistent command-and-control (C2) communication. It combines native code obfuscation, Firebase-based remote execution, VPN-based traffic manipulation, and WebView-based phishing to systematically harvest sensitive user data. ]]></description>
</item>
<item>
<title><![CDATA[ [ARTICLE] Bypassing Windows authentication reflection mitigations for SYSTEM shells - Part 2 ]]></title>
<link>https://www.synacktiv.com/en/publications/bypassing-windows-authentication-reflection-mitigations-for-system-shells-part</link>
<guid>https://www.synacktiv.com/en/publications/bypassing-windows-authentication-reflection-mitigations-for-system-shells-part</guid>
<pubDate>Fri, 01 May 2026 04:37:12 +0000</pubDate>
<description><![CDATA[ [ Authentication - Exploits & Payloads - Privilege Escalation ] In this second part, we turn to Kerberos and explain how we achieved a full-blown RCE primitive as a domain user, via a completely novel Kerberos authentication coercion technique that abuses discrepancies in how different Windows components handle Unicode characters. ]]></description>
<author><![CDATA[ Guillaume Andre ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] ARP Around and Find Out: Hijacking GPO UNC Paths for Code Execution and NTLM Relay ]]></title>
<link>https://trustedsec.com/blog/arp-around-and-find-out-hijacking-gpo-unc-paths-for-code-execution-and-ntlm-relay</link>
<guid>https://trustedsec.com/blog/arp-around-and-find-out-hijacking-gpo-unc-paths-for-code-execution-and-ntlm-relay</guid>
<pubDate>Fri, 01 May 2026 04:32:49 +0000</pubDate>
<description><![CDATA[ [ Active Directory - Privilege Escalation ] If you have WriteGPLink on an Active Directory Organizational Unit (OU) and you're on the same network segment as a computer within that OU, you can abuse that permission to link an existing Group Policy Objects (GPO) with a software installation policy and ARP spoof the server it references, resulting in code execution as SYSTEM without modifying SYSVOL. ]]></description>
<author><![CDATA[ Austin Coontz ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Arbitrary code execution and Claude Code CLI: How Claude executed code before you click 'trust' ]]></title>
<link>https://www.sonarsource.com/blog/claude-arbitrary-code-execution</link>
<guid>https://www.sonarsource.com/blog/claude-arbitrary-code-execution</guid>
<pubDate>Fri, 01 May 2026 04:30:07 +0000</pubDate>
<description><![CDATA[ [ Exploits & Payloads - Machine Learning & AI ] We discovered different ways an untrusted folder can execute arbitrary code in Claude Code before the user is prompted with the trust dialog, allowing for potential compromise when cloning untrusted projects. ]]></description>
<author><![CDATA[ Yaniv Nizry ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Here We Go Again: A Five-Bug Chain to Arbitrary APK Install on Samsung S25 ]]></title>
<link>https://bugscale.ch/blog/here-we-go-again-a-five-bug-chain-to-arbitrary-apk-install-on-samsung-s25/</link>
<guid>https://bugscale.ch/blog/here-we-go-again-a-five-bug-chain-to-arbitrary-apk-install-on-samsung-s25/</guid>
<pubDate>Fri, 01 May 2026 04:27:56 +0000</pubDate>
<description><![CDATA[ [ Exploits & Payloads - Mobile ] We discovered a five‑bug chain in Samsung’s Galaxy Store (weak Cloud‑Games signature checks, an unprotected SmartSwitch broadcast receiver, a path‑traversal write primitive, a predictable‑randomness authentication flaw, and a DoS crash in IapReceiver) that lets an unprivileged app arbitrarily write a crafted APK into the Store's shell‑APK location and force its silent installation ]]></description>
<author><![CDATA[ Sacha Kozma, Yichen Chai ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] DoomSyscalls ]]></title>
<link>https://github.com/SilentisVox/DoomSyscalls</link>
<guid>https://github.com/SilentisVox/DoomSyscalls</guid>
<pubDate>Fri, 01 May 2026 04:24:44 +0000</pubDate>
<description><![CDATA[ [ Obfuscation, Evasion & LoL ] Clean Indirect Syscalls with Hook Evasion & Return Address Spoofing. ]]></description>
<author><![CDATA[ Silent ]]></author>
</item>
<item>
<title><![CDATA[ [TOOL] Flexphish ]]></title>
<link>https://github.com/P0cL4bs/flexphish</link>
<guid>https://github.com/P0cL4bs/flexphish</guid>
<pubDate>Fri, 01 May 2026 04:23:09 +0000</pubDate>
<description><![CDATA[ [ Pentests & Red Teams - Phishing ] Flexphish is a flexible and modular phishing framework designed for security professionals, red teams, and researchers to simulate real-world phishing campaigns in controlled environments. ]]></description>
</item>
<item>
<title><![CDATA[ [ARTICLE] Living off the Cloud ]]></title>
<link>https://www.sans.org/blog/living-off-the-cloud</link>
<guid>https://www.sans.org/blog/living-off-the-cloud</guid>
<pubDate>Fri, 01 May 2026 04:21:42 +0000</pubDate>
<description><![CDATA[ [ Obfuscation, Evasion & LoL - Post-Exploitation & Lateral Movement - Public Cloud ] AWS Systems Manager and Azure Run Command provide threat actors are attracted by the ability to execute commands with the highest privileges on a host without needing host credentials, providing reliable lateral movement and persistence paths that bypasses traditional network controls entirely. ]]></description>
<author><![CDATA[ Megan Roddie-Fonseca ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] Building an Encrypted C2 Implant Using QUIC ]]></title>
<link>https://g3tsyst3m.com/encrypted%20shell/Building-an-Encrypted-C2-Implant-Using-QUIC/</link>
<guid>https://g3tsyst3m.com/encrypted%20shell/Building-an-Encrypted-C2-Implant-Using-QUIC/</guid>
<pubDate>Fri, 01 May 2026 04:17:27 +0000</pubDate>
<description><![CDATA[ [ C2 & Exfiltration ] In this article, we're going to ditch TCP sockets entirely and build a C2 implant that communicates over QUIC, an encrypted transport protocol that runs over UDP.  ]]></description>
<author><![CDATA[ R.B.C (G3Tsyst3M) ]]></author>
</item>
<item>
<title><![CDATA[ [ARTICLE] WebAssembly Canonical vs. Relative Type Index Confusion Leading to RCE ]]></title>
<link>https://ssd-disclosure.com/webassembly-canonical-vs-relative-type-index-confusion-leading-to-rce/</link>
<guid>https://ssd-disclosure.com/webassembly-canonical-vs-relative-type-index-confusion-leading-to-rce/</guid>
<pubDate>Thu, 30 Apr 2026 07:07:42 +0000</pubDate>
<description><![CDATA[ [ Exploits & Payloads ] Technical analysis of CVE -2024 -12053, an arbitrary WebAssembly type confusion vulnerability stemming from a mix-up between the canonical and relative indices of WebAssembly types. ]]></description>
</item>
<item>
<title><![CDATA[ [ARTICLE] Hooked on Linux - Part 2: Rootkit Detection Engineering ]]></title>
<link>https://www.elastic.co/security-labs/linux-rootkits-2-caught-in-the-act</link>
<guid>https://www.elastic.co/security-labs/linux-rootkits-2-caught-in-the-act</guid>
<pubDate>Thu, 30 Apr 2026 07:00:47 +0000</pubDate>
<description><![CDATA[ [ Incident Response & Forensics - Keyloggers, Backdoors & Rootkits ] In this second pars, we explore Linux rootkit detection engineering, focusing on the limitations of static detection reliance, and the importance of rootkit behavioral detection. ]]></description>
<author><![CDATA[ Remco Sprooten, Ruben Groenewoud ]]></author>
</item>
</channel>
</rss>