SelectMyParent

¿Qué es esto? Este es un proyecto de suplantación del proceso padre. Cómo usar Paso 1: Selecciona un proceso padre y recuerda el pid Paso 2: Ejecuta el siguiente comando. Implementa la suplantación del proceso padre SelectMyParent.exe notepad 928 Paso 3: Usando Process Explorer para ver el árbol ...

RedTeaming-Tactics-and-Techniques

description: - 这些笔记主要关注但不限于红队和攻防安全相关内容。 什么是 ired.team 笔记？ 这是公开的个人红队笔记，托管在 https://ired.team 和 https://github.com/mantvydasb/RedTeam-Tactics-and-Techniques 上，内容涉及我在受控环境中进行的渗透测试/红队实验，包括使用渗透测试人员、红队和实际对手常用的各种工具和技术。 这是我学习的方式——通过实践、跟随、修补、探索、重复和做笔记。 在 ired.team...

frostbyte

FrostByte Progolue: In the past few days I've been experimenting with the AppDomain manager injection technique had a decent success with it in my previous Red Team engagements against certain EDRs. Although, this is really good for initial access vector, I wanted to release a POC which will help...

Ransomware-Tool-Matrix

Matriz de Herramientas de Ransomware Este repositorio contiene una lista de las herramientas que utiliza cada banda de ransomware o banda de extorsión Como defensores, debemos aprovechar el hecho de que muchas de las herramientas utilizadas por estos ciberdelincuentes se reutilizan con frecuencia...

DonPAPI

DonPAPI DonPAPI 可在多台 Windows 计算机上远程自动转储机密，同时具备防御规避意识。 收集的凭据： Chromium 浏览器凭据、Cookie 和 Chrome 刷新令牌 Windows 证书 凭据管理器 Firefox 浏览器凭据和 Cookie Mobaxterm 凭据 MRemoteNg 凭据 RDC Manager 凭据 桌面和最近文件夹中的文件 SCCM 凭据 保险库凭据 VNC 凭据 Wi-Fi 凭据 我们曾用法语做过一次关于 DPAPI 的演讲，标题为 DPAPI - Don't Put Administration Passwords In 🇫🇷 ：...

RecycledInjector

RecycledInjector 描述 （当前）完全未被检测的同一进程原生/.NET 汇编 shellcode 注入器，基于 thefLink 的 RecycledGate，而 RecycledGate 本身又基于 HellsGate + HalosGate + TartarusGate，以确保即使某种技术失败，原生系统调用也无法被检测。 要保持隐蔽并降低最终可执行文件的熵值，请确保 shellcode 始终从外部加载，因为大多数 AV/EDR 无论如何都不会对非可执行文件或 DLL 文件进行签名检查。 同样重要的是，完全未被检测的部分指的是 shellcode 的加载过程，但...

acCOMplice

acCOMplice Tu cómplice en el secuestro de COM Autor: David Tulis @kafkaesqu3 Resumen Este repositorio contiene ejemplos de código y pruebas de concepto para explorar el secuestro de COM. El secuestro de COM es una técnica de post-explotación de Windows que puede utilizarse para la persistencia o ...

Kraken

Kraken Kraken，一款由 @secux11 编码的模块化多语言网页后门。 系统要求 • 支持 • 安装 • 用法 • 高级用法 • 贡献 • 常见问题 • 致谢 Kraken 是一个模块化的多语言网页后门，专注于 Web 后渗透利用与防御规避。它支持三种技术（PHP、JSP 和 ASPX ），其核心由 Python 开发。 Kraken 遵循 "避免命令执行" 的原则，通过所使用编程语言的功能来重新实现命令执行。Kraken 旨在提供可用性、可扩展性，并改善正在进行的操作的 OPSEC。...

BEAR-C2

BEAR-C2 Framework de Simulación de Adversarios BEAR-C2 es un framework de simulación y emulación de adversarios construido en torno a TTPs del mundo real inspiradas por grupos APT rusos, chinos, norcoreanos e iraníes. Proporciona un entorno flexible para diversos escenarios de compromiso y ofrece...

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection. Threat actors are known to name their malicious software after a legitimate operating system...

Malicious npm Packages That Evade Defenses

This is an impressive piece of malware. Its sophistication says nation-state to me, but there is no direct evidence and certainly no attribution...

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

In this article 1. Attack chain overview 2. Campaign scope and targeting 3. Mitigation and protection guidance 4. References 5. Learn more Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribu...

Low-ASR Backdoors: Exploiting Attack Success Rate Reduction and Attacker-Defender Asymmetry

Backdoor attacks are among the most effective and stealthy attacks in deep learning. Existing attacks and defenses are largely designed and evaluated under the assumption that successful backdoors exhibit high Attack Success Rates ASRs. In this paper, we show that this assumption creates a...

A Decade of Healthcare Cyber Threats: Empirical Analysis, Evidence-Based Prioritisation, and AI Threat Model

Healthcare systems face persistent and evolving cyber threats, yet how adversarial tactics and techniques have shifted over time has not been systematically characterised using empirical, multi-source data. This paper analyses 1,214 threat records drawn from three authoritative sources: the MITRE...

Code-Poisoning Property Inference Attacks

The flourishing code hosting platforms and coding agents enable even beginners with private data to build tailored Machine Learning ML models using available code quickly. The training data for ML models, often regarded as private property e.g., clinical records, transaction information, is at...

New Avalon Malware Framework Packs CrownX Ransomware Capabilities

Cybersecurity researchers have discovered a previously undocumented modular malware framework codenamed Avalon that's distributed by means of a multi-stage phishing chain capable of bypassing traditional security controls. Avalon combines credential collection, lateral movement, remote access,...

Exploit for CVE-2026-48907

CVE-2026-48907 Description هذا الملف CVE-2025-9209.py هو أداة...

State of ransomware in 2026

With International Anti-Ransomware Day taking place on May 12, Kaspersky presents its annual report on the evolving global and regional ransomware cyberthreat landscape. Ransomware remains one of the most persistent and adaptive cyberthreats. In 2026: New families continue to emerge, adopting...

shadowforge

ShadowForge "Trust no one. Suspect ev...

Qilin EDR killer infection chain

Endpoint detection and response EDR tools are widely deployed and far more capable than traditional antivirus. As a result, attackers use EDR killers to disable or bypass them. Disabling telemetry collection process, memory, network activity limits what defenders can see and analyze. As defenders...