RedTeaming-Tactics-and-Techniques

description: - These are notes about all things focusing on, but not limited to, red teaming and offensive security. What is ired.team notes? This is publicly accessible personal red teaming notes at https://ired.team and https://github.com/mantvydasb/RedTeam-Tactics-and-Techniques about my...

Ransomware-Tool-Matrix

Ransomware Tool Matrix This repository contains a list of which tools each ransomware gang or extortionist gang uses As defenders, we should exploit the fact that many of the tools used by these cybercriminals are often reused We can threat hunt, deploy detections, and block these tools to...

Kraken

Kraken Kraken, a modular multi-language webshell coded by @secux11. Requirements • Support • Install • Usage • Advanced Usage • Contributing • FAQ • Acknowledgments Kraken is a modular multi-language webshell focused on web post-exploitation and defense evasion. It supports three technologies PHP...

frostbyte

FrostByte Progolue: In the past few days I've been experimenting with the AppDomain manager injection technique had a decent success with it in my previous Red Team engagements against certain EDRs. Although, this is really good for initial access vector, I wanted to release a POC which will help...

RecycledInjector

RecycledInjector Description Currently Fully Undetected same-process native/.NET assembly shellcode injector based on RecycledGate by thefLink, which is also based on HellsGate + HalosGate + TartarusGate to ensure undetectable native syscalls even if one technique fails. To remain stealthy and ke...

BEAR-C2

BEAR-C2 Adversary Simulation Framework BEAR-C2 is an adversary simulation and emulation framework built around real world TTPs inspired by Russian, Chinese, North Korean, and Iranian APT groups. It provides a flexible environment for diverse engagement scenarios and delivers a realistic foundatio...

DonPAPI

DonPAPI DonPAPI automates secrets dump remotely on multiple Windows computers, with defense evasion in mind. Collected credentials: Chromium browser Credentials, Cookies and Chrome Refresh Token Windows Certificates Credential Manager Firefox browser Credentials and Cookies Mobaxterm Credentials...

SelectMyParent

What's this This is a project for parent process spoofing. How to use step 1:Select a parent process and remember the pid Step 2:Execute the following command. Implement parent process spoofing SelectMyParent.exe notepad 928 Step 3:Using process explorer to view the process tree, you can see the...

acCOMplice

acCOMplice Your COM hijacking accomplice Author: David Tulis @kafkaesqu3 Overview This repository contains code samples and proofs-of-concept for exploring COM hijacking. COM hijacking is a Windows post exploitation technique, which can be used for persistence or defense evasion. For more...

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection. Threat actors are known to name their malicious software after a legitimate operating system...

Malicious npm Packages That Evade Defenses

This is an impressive piece of malware. Its sophistication says nation-state to me, but there is no direct evidence and certainly no attribution...

Counterfeit installers to system compromise: Tracking a deceptive software download campaign

In this article 1. Attack chain overview 2. Campaign scope and targeting 3. Mitigation and protection guidance 4. References 5. Learn more Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to impersonate trusted vendors and distribu...

Low-ASR Backdoors: Exploiting Attack Success Rate Reduction and Attacker-Defender Asymmetry

Backdoor attacks are among the most effective and stealthy attacks in deep learning. Existing attacks and defenses are largely designed and evaluated under the assumption that successful backdoors exhibit high Attack Success Rates ASRs. In this paper, we show that this assumption creates a...

A Decade of Healthcare Cyber Threats: Empirical Analysis, Evidence-Based Prioritisation, and AI Threat Model

Healthcare systems face persistent and evolving cyber threats, yet how adversarial tactics and techniques have shifted over time has not been systematically characterised using empirical, multi-source data. This paper analyses 1,214 threat records drawn from three authoritative sources: the MITRE...

Code-Poisoning Property Inference Attacks

The flourishing code hosting platforms and coding agents enable even beginners with private data to build tailored Machine Learning ML models using available code quickly. The training data for ML models, often regarded as private property e.g., clinical records, transaction information, is at...

New Avalon Malware Framework Packs CrownX Ransomware Capabilities

Cybersecurity researchers have discovered a previously undocumented modular malware framework codenamed Avalon that's distributed by means of a multi-stage phishing chain capable of bypassing traditional security controls. Avalon combines credential collection, lateral movement, remote access,...

Exploit for CVE-2026-48907

CVE-2026-48907 Description هذا الملف CVE-2025-9209.py هو أداة...

State of ransomware in 2026

With International Anti-Ransomware Day taking place on May 12, Kaspersky presents its annual report on the evolving global and regional ransomware cyberthreat landscape. Ransomware remains one of the most persistent and adaptive cyberthreats. In 2026: New families continue to emerge, adopting...

shadowforge

ShadowForge "Trust no one. Suspect ev...

Qilin EDR killer infection chain

Endpoint detection and response EDR tools are widely deployed and far more capable than traditional antivirus. As a result, attackers use EDR killers to disable or bypass them. Disabling telemetry collection process, memory, network activity limits what defenders can see and analyze. As defenders...