Fileless Remcos RAT Delivered via LNK Files and MSHTA in PowerShell-Based Attacks

Cybersecurity researchers have shed light on a new malware campaign that makes use of a PowerShell-based shellcode loader to deploy a remote access trojan called Remcos RAT. "Threat actors delivered malicious LNK files embedded within ZIP archives, often disguised as Office documents," Qualys...

The Windows Registry Adventure #6: Kernel-mode objects

Posted by Mateusz Jurczyk, Google Project Zero Welcome back to the Windows Registry Adventure! In the previous installment of the series, we took a deep look into the internals of the regf hive format. Understanding this foundational aspect of the registry is crucial, as it illuminates the design...

Windows Registry Enumerated Software Report

Reports details about software enumerated using the registry TRUSTED...

CVE-2025-27254

CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify...

CVE-2025-27254

CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify...

CVE-2025-27254

The CVE-2025-27254 entry concerns GE Vernova EnerVista UR Setup and is supported by multiple sources. Affected component: EnerVista UR Setup; issue: CWE-282 Improper Ownership Management leading to an authentication bypass. Root cause described as the startup authentication being disable-able via...

CVE-2025-27254

CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The software's startup authentication can be disabled by altering a Windows registry setting that any user can modify...

PNGPlug Loader Delivers ValleyRAT Malware Through Fake Software Installers

Cybersecurity researchers are calling attention to a series of cyber attacks that have targeted Chinese-speaking regions like Hong Kong, Taiwan, and Mainland China with a known malware called ValleyRAT. The attacks leverage a multi-stage loader dubbed PNGPlug to deliver the ValleyRAT payload,...

Enumerate the Microsoft Windows Registry

Using the supplied credentials, Nessus was unable to log into the remote Windows host, enumerate registry keys and values required for vulnerability scans and store them in the knowledge base for other plugins to use. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

RUSTSEC-2025-0026 registry is unmaintained

The author has archived the GitHub repository and mentions deprecation in project's README. Possible alternatives windows-registry...

registry is unmaintained

The author has archived the GitHub repository and mentions deprecation in project's README. Possible alternatives windows-registry...

CVE-2015-0073

creationtimestamp| type| source ---|---|--- 2024-12-19 18:03:00+00:00| seen| https://googleprojectzero.blogspot.com/2024/12/the-windows-registry-adventure-5-regf.html 2026-07-29 12:01:22+00:00| seen| Telegram/7S6GTcGTrOkazNYM6aCjvvQCh58ZZ0xQJO4nXoU5wy4UXQ 2026-07-30 00:01:53+00:00| seen|...

The Windows Registry Adventure #5: The regf file format

Posted by Mateusz Jurczyk, Google Project Zero As previously mentioned in the second installment of the blog post series "A brief history of the feature", the binary format used to encode registry hives from Windows NT 3.1 up to the modern Windows 11 is called regf. In a way, it is quite special,...

CVE-2024-49114

creationtimestamp| type| source ---|---|--- 2024-12-10 17:33:56+00:00| seen| https://www.thezdi.com/blog/2024/12/10/the-december-2024-security-update-review 2024-12-10 20:52:38+00:00| seen| https://infosec.exchange/users/cve/statuses/113630508328834714 2025-01-07 05:40:37+00:00| seen|...

CVE-2024-8785

In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in registry path HKEYLOCALMACHINE\SOFTWARE\WOW6432Node\Ipswitch...

The vulnerability of the Windows Registry system allows attackers to increase their privileges.

The vulnerability of the Windows Registry system in operating systems is related to numerical overflow. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the Windows Registry component of the Microsoft Windows operating system, which allows a hacker to increase their privileges

The vulnerability of the Windows Registry component of the Microsoft Windows operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2024-43641

Windows Registry Elevation of Privilege Vulnerability...

CVE-2024-43452

Windows Registry Elevation of Privilege Vulnerability...

CVE-2024-43452

creationtimestamp| type| source ---|---|--- 2024-11-12 18:10:52+00:00| seen| https://infosec.exchange/users/cve/statuses/113471327527148804 2024-11-12 18:26:35+00:00| seen| https://www.thezdi.com/blog/2024/11/12/the-november-2024-security-update-review 2024-12-19 18:03:00+00:00| seen|...