process_overwriting

Process Overwriting Process Overwriting is a PE injection technique, closely related to Process Hollowing and Module Overloading. With its help, you can replace the main executable not a DLL of the target process. It works only for a newly created process - injection to existing processes is not...

LdrShuffle

LdrShuffle 通过修改运行时已加载模块的 EntryPoint 实现隐蔽代码执行。 摘要 Windows 进程在运行时加载了各种模块。其中每个模块都定义了一个 DllMain 函数，该函数会在进程或线程创建/销毁时被调用（共有四种可能的情形）。 为了在进程生命周期内正确调用这些函数，Windows 加载器函数（ntdll!Ldrp）会引用一个条目列表，其中包含每个模块的关键参数（包括 EntryPoint 字段）。 通过覆写某个 DLL 的 EntryPoint，我们可以确保代码执行被重定向到我们选择的位置。 使用场景 这既可以用作代码执行原语，也可以用于 API...

China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks

An exposed Alibaba Cloud server has revealed a China-nexus operation that Group-IB tracks as JadeProx. The cluster has targeted government, healthcare, and education organizations across Asia and Latin America with a previously undocumented Windows loader called TriBack Loader. Group-IB found the...

GHSA-H3X4-HC5V-V2GM OpenClaw: Windows media loaders accepted remote-host file URLs before local path validation

Summary Windows local-media handling accepted remote-host file URLs and UNC-style paths before local-path validation, so network-hosted file targets could be treated as local content. Affected Packages / Versions - Package: openclaw npm - Affected: = 2026.3.22 - Latest released tag checked:...

The vulnerability of the New Horizon Data Systems loader for Windows operating systems allows a hacker to circumvent existing security restrictions.

The vulnerability of the New Horizon Data Systems driver for Windows operating systems is related to security configuration errors. Exploiting this vulnerability could allow a hacker to circumvent existing security restrictions...

CallObfuscator - Obfuscate Specific Windows Apis With Different APIs

Obfuscate hide the PE imports from static/dynamic analysis tools. Theory This's pretty forward, let's say I've used VirtualProtect and I want to obfuscate it with Sleep, the tool will manipulate the IAT so that the thunk that points to VirtualProtect will point instead to Sleep, now at executing...