RedTeam-Physical-Tools

レッドチーム – フィジカルセキュリティ – コバートエントリー – EDC 許可された フィジカルセキュリティアセスメント、レッドチーム活動、およびコバートエントリーのトレーニングで一般的に参照される、市販ツールの厳選リスト。 法的および倫理的注意: 現地の法律に従い、書面による許可 を得た場合にのみ使用してください。多くのツールは、管轄区域において burglary tools（侵入工具）とみなされる可能性があります。作者は誤用について一切責任を負いません 。 アフィリエイト開示:...

hollows_hunter

hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...

sliver

Sliver Sliverは、あらゆる規模の組織が許可されたセキュリティテストを実施できるように設計された、オープンソースのクロスプラットフォーム敵対者エミュレーションおよびレッドチームフレームワークです。 Sliverインプラントは、Mutual TLS mTLS、WireGuard、HTTPS、およびDNSを介したコマンドアンドコントロール C2 をサポートしています。インプラントはバイナリごとに固有の非対称暗号化キーで動的にコンパイルされ、macOS、Windows、Linuxにわたる幅広いポストエクスプロイト機能をサポートしています。...

CrucibleC2

HardHat C2 クロスプラットフォームで協調的な、Cで書かれたコマンド＆コントロールフレームワーク。レッドチーム活動と使いやすさを考慮して設計されています。 HardHatは、レッドチーム活動やペネトレーションテストを支援するために設計された、マルチユーザー対応のC .NETベースのコマンド＆コントロール（C2）フレームワークです。堅牢で使いやすいC2フレームワークを提供することで、活動中のクオリティ・オブ・ライフを向上させることを目指しています。 HardHatには3つの主要コンポーネントがあります： 1. ASP.NETチームサーバー 2. Blazor .NETクライアント ...

EQGRP_Lost_in_Translation

EQGRP ロスト・イン・トランスレーション odd.tar.xz.gpg、swift.tar.xz.gpg、windows.tar.xz.gpg の復号化されたコンテンツ https://yadi.sk/d/NJqzpqo3GxZA4 からダウンロード ShadowBrokers の元の投稿: https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation windows : Windows のエクスプロイト、インプラント、ペイロードが含まれています swift : 銀行攻撃に関する運用ノートが含まれていま...

CoffeeLdr

CoffeeLdr CoffeeLdr 是一个用于加载所谓 Beacon Object FilesBOF的加载器。 该项目可用于在不使用 Cobalt Strike 框架的情况下测试 Beacon Object Files，也可用于为自定义植入体提供执行专为 Cobalt Strike 设计的 BOF 的方法。 但大多数 Beacon APIfork&run 和注入函数为空，需自行实现。 待办事项 x86 对象文件支持 致谢 当然，如果没有 Trustedsec 的 COFFLoader 项目，这一切都不可能实现。...

Beyond the Trust Boundary: A Critical Reassessment of the FIDO2 Threat Model

FIDO2/WebAuthn has been widely deployed as a phishing-resistant authentication scheme. Because FIDO2 relies on public-key cryptography and hardware-backed authenticators, its security is often assumed to be guaranteed by design, provided that the cryptographic implementation is correct. In this...

CVE-2026-84696: Missing Authentication for Critical Function

Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write...

nationstate-cyber-tools

NATION-STATE CYBER WEAPONS ARSENAL Live Web Page: htt...

MAL-2026-2278 Malicious code in python-aiogram-telegram-updater (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 94b286136c318836563c0eaddf44e8d1b21f217086b444a3266d91b69ace79b8 When run, the package exfiltrates files from a cryptowallet and modifies its executable placing an implant exfiltrating passphrase later. --- Category: MALICIO...

China-Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks

A long-term and ongoing campaign attributed to a China-nexus threat actor has embedded itself in telecom networks to conduct espionage against government networks. The strategic positioning activity, which involves implanting and maintaining stealthy access mechanisms within critical environments...

Free real estate: GoPix, the banking Trojan living off your memory

Introduction GoPix is an advanced persistent threat targeting Brazilian financial institutions' customers and cryptocurrency users. It represents an evolved threat targeting internet banking users through memory-only implants and obfuscated PowerShell scripts. It evolved from the RAT and Automate...

Transparent Tribe Uses AI to Mass-Produce Malware Implants in Campaign Targeting India

The Pakistan-aligned threat actor known as Transparent Tribe has become the latest hacking group to embrace artificial intelligence AI-powered coding tools to strike targets with various implants. The activity is designed to produce a "high-volume, mediocre mass of implants" that are developed...

China-Linked Hackers Use TernDoor, PeerTime, BruteEntry in South American Telecom Attacks

A China-linked advanced persistent threat APT actor has been targeting critical telecommunications infrastructure in South America since 2024, targeting Windows and Linux systems and edge devices with three different implants. The activity is being tracked by Cisco Talos under the moniker UAT-924...

New threat actor, UAT-9921, leverages VoidLink framework in campaigns

Cisco Talos recently discovered a new threat actor, UAT-9921, leveraging VoidLink in campaigns. Their activities may go as far back as 2019, even without VoidLink. The VoidLink compile-on-demand feature lays down the foundations for AI-enabled attack frameworks, which can create tools on-demand f...

China-Linked DKnife AitM Framework Targets Routers for Traffic Hijacking, Malware Delivery

Cybersecurity researchers have taken the wraps off a gateway-monitoring and adversary-in-the-middle AitM framework dubbed DKnife that's operated by China-nexus threat actors since at least 2019. The framework comprises seven Linux-based implants that are designed to perform deep packet inspection...

Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework

Cisco Talos uncovered "DKnife," a fully featured gateway-monitoring and adversary-in-the-middle AitM framework comprising seven Linux-based implants that perform deep-packet inspection, manipulate traffic, and deliver malware via routers and edge devices. Based on the artifact metadata, DKnife ha...

CVE-2025-59109

The dormakaba registration units 9002 PIN Pad Units have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly built as Plug-and-Play to be easily replaced, an...

CVE-2025-59109

The dormakaba registration units 9002 PIN Pad Units have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly built as Plug-and-Play to be easily replaced, an...

Cloud Atlas activity in the first half of 2025: what changed

Known since 2014, the Cloud Atlas group targets countries in Eastern Europe and Central Asia. Infections occur via phishing emails containing a malicious document that exploits an old vulnerability in the Microsoft Office Equation Editor process CVE-2018-0802 to download and execute malicious cod...