FsquirtCPLPoC

Fsquirt.exe Windows 二进制文件会从当前工作目录尝试加载一个名为 bthprops.cpl 的控制面板小程序 CPL。当 bthprops.cpl 与 fsquirt.exe 位于同一目录时，该二进制文件会加载它，并从 DLLMain 中执行一个 MessageBox。 该 PoC 代码生成一个恶意的 bthprops.cpl 文件，该文件可由 fsquirt.exe 加载。附带的 build.sh 脚本会为您编译该 CPL 模块。...

Analysis

检测工程笔记与分析 此仓库记录了基于实验室测试、日志分析和真实SOC工作流的实操检测研究。 重点在于攻击技术在实际日志中的呈现方式、哪些检测逻辑在实践中有效、哪些会失效，以及误报在何处产生。所有内容均从防御视角编写，面向分析师和检测工程师。 这不是攻击性工具或漏洞利用开发。 此仓库包含的内容 DLL劫持与侧载 针对Windows系统上DLL劫持与侧载活动的分析与检测笔记。 涵盖的主题： 合法可执行文件如何加载恶意DLL 侧载过程中常被滥用的常见执行路径 进程执行、文件创建与镜像加载事件之间的关联 基于行为的检测逻辑，而非文件名匹配 真实测试中观察到的误报 已识别的常见误报：...

CVE-2026-4255

CVE-2026-4255 Thermalright TR-VISION HOME DLL 侧加载特权提升漏洞 严重性: 高 CVSS 8.4 CWE: CWE-829 包含来自不受信任控制域的功能 发布时间: 2026年3月16日 CNA: Toreon 受影响版本: Thermalright TR-VISION HOME ≤ 2.0.5 Windows 64位 发现者: Ard33 描述 Thermalright TR-VISION HOME 使用默认的 Windows DLL 搜索顺序加载 Ftd2xx.dll（FTDI...

CVE-2021-40444

完全武器化的 CVE-2021-40444 用于利用 CVE-2021-40444（Microsoft Office Word 远程代码执行）的恶意 docx 生成器，可配合任意 DLL 文件使用。 背景 尽管互联网上已经有很多 PoC，我还是想亲自尝试武器化这个漏洞，因为我发现现有的资料缺少值得分享的有价值信息，而且微软已经为此漏洞发布了补丁。 到目前为止，我见过的能够创建完全可用的生成器的有价值资源只有： Ret2Pwn 的博客 j00sean 的推文 上述资源概述了构建完整利用链所需的许多要求。为避免重复太多不必要的信息，我只总结相关细节。 利用链 1. 打开 Docx 2...

ScareCrow

此仓库已归档 要查看最新版本的 ScareCrow 或提交问题，请参考 https://github.com/Tylous/ScareCrow。 ScareCrow 更多信息 如果你想了解本框架所用技术的更多细节，请查看第1部分和第2部分 描述 ScareCrow 是一个载荷生成框架，用于侧加载（而非注入）到合法的 Windows 进程中（绕过应用程序白名单控制）。一旦 DLL 加载器被加载到内存中，它就会利用一种技术清除进程内存中运行的系统 DLL 上的 EDR 钩子。这之所以有效，是因为我们知道 EDR 的钩子是在进程生成时放置的。 ScareCrow 可以针对这些 DLL，通过使用...

PT-2026-97782

Name of the Vulnerable Software and Affected Versions Evope Collector versions prior to 1.1.7.13 Description An unchecked search path element allows a local attacker without privileges to perform local privilege escalation. By placing a malicious wtsapi32.dll file in the C:ProgramDataEvope...

Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools

Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan RAT called Spark RAT. "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims. These include government...

New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode

An independent malware researcher has documented a previously unreported Windows backdoor, dubbed SLEEPWALKER , that stays inert in memory until a specifically crafted network packet reaches the machine and then runs commands written in a 23-instruction language of its own design. The sample is a...

Silver Fox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT

The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver BYOVD attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT aka Winos 4.0 for persistent remote access. "In...

Malicious code in ts-precision (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7d2534408d7dd1d7f02c3ef470bc697d0803e8acd58941de5974a250127cb8c Package ships a verbatim copy of big.js v7.0.1 including the original author metadata 'Michael Mclaughlin ' and repo reference MikeMcl/big.js under a...

DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic

Threat actors associated with the DragonForce ransomware have been observed using a custom Go-based remote access trojan RAT called Backdoor.Turn to conceal command-and-control C2 traffic inside Microsoft Teams relay infrastructure. According to findings from Broadcom-owned Symantec and Carbon...

ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures

Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader , Lorem Ipsum Loader , and Potemkin , per independent reports from Morphisec, BlueVoyant, and Huntress, respectively. Attacks involving BabaDeda Loader, observed in April...

China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan

A new cyber espionage campaign codenamed Operation Dragon Weave has been observed targeting officials and citizens in the Czech Republic and Taiwan to deliver an AdaptixC2 agent. According to Seqrite Labs, targets of the campaign include government, research, academic, technology, and financial...

Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users

Latin America and Europe become the target of two banking trojan campaigns that are designed to infect Windows and Android devices with Grandoreiro and BTMOB malware, respectively. That's according to new findings from WatchGuard and ESET, which have observed the two malware families being used t...

MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries

The Iranian hacking group known as MuddyWater has been linked to a new campaign affecting at least nine organizations across nine countries on four continents in the first quarter of 2026. The activity targeted industrial and electronics manufacturing, education and public-sector bodies, financia...

TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook Worms

Threat hunters have flagged a previously undocumented Brazilian banking trojan dubbed TCLBANKER that's capable of targeting 59 banking, fintech, and cryptocurrency platforms. The activity is being tracked by Elastic Security Labs under the moniker REF3076. The malware family is assessed to be a...

CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads

Unknown threat actors compromised CPUID "cpuid.com", a website that hosts popular hardware monitoring tools like CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor, for less than 24 hours to serve malicious executables for the software and deploy a remote access trojan called STX RAT. The incident...

UAT-10362 Targets Taiwanese NGOs with LucidRook Malware in Spear-Phishing Campaigns

A previously undocumented threat cluster dubbed UAT-10362 has been attributed to spear-phishing campaigns targeting Taiwanese non-governmental organizations NGOs and suspected universities to deploy a new Lua-based malware called LucidRook. "LucidRook is a sophisticated stager that embeds a Lua...

ScreenToGif 安全漏洞

ScreenToGif is a screen recording and GIF creation tool developed by Nicke Manarin himself. Versions of ScreenToGif 2.42.1 and earlier contained security vulnerabilities, which were caused by a DLL-side loading vulnerability. This vulnerability could allow arbitrary code to be executed in user...

CVE-2026-4255

A DLL search order hijacking vulnerability in Thermalright TR-VISION HOME on Windows 64-bit allows a local attacker to escalate privileges via DLL side-loading. The application loads certain dynamic-link library DLL dependencies using the default Windows search order, which includes directories...