87 matches found
ClickonceHunter
ClickonceHunter Tool released in combination with the Less SmartScreen More Caffeine: ClickOnce AbUse for Trusted Code Execution conference presentation / blog post by 0xthirteen and myself. Golang web scraper that makes use of both chromedp, as well as normal HTTP requests to scrape search engin...
frostbyte
FrostByte Progolue: In the past few days I've been experimenting with the AppDomain manager injection technique had a decent success with it in my previous Red Team engagements against certain EDRs. Although, this is really good for initial access vector, I wanted to release a POC which will help...
April 14, 2026-KB5082425 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows Server 2022
April 14, 2026-KB5082425 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows Server 2022 Applies To .NET Note Release Date: April 14, 2026 Version: .NET Framework 3.5 and 4.8.1 The April 14, 2026 update for Windows Server 2022 includes security and cumulative reliability improvements i...
April 14, 2026-KB5082419 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 10 Version 21H2 and Windows 10 Version 22H2
April 14, 2026-KB5082419 Cumulative Update for .NET Framework 3.5 and 4.8.1 for Windows 10 Version 21H2 and Windows 10 Version 22H2 Applies To .NET Note Revised April 22, 2026: Revised on April 22nd, 2026 to add the known issue section. Note Release Date: April 14, 2026 Version: .NET Framework 3....
April 14, 2026-KB5082413 Cumulative Update for .NET Framework 3.5 and 4.7.2 for Windows 10, version 1809 and Windows Server 2019
April 14, 2026-KB5082413 Cumulative Update for .NET Framework 3.5 and 4.7.2 for Windows 10, version 1809 and Windows Server 2019 Applies To .NET Note Release Date: April 14, 2026 Version: .NET Framework 3.5 and 4.7.2 The April 14, 2026 update for Windows 10, version 1809 and Windows Server 2019...
February 10, 2026-KB5074837 Cumulative Update for .NET Framework 4.8.1 for Windows 11, version 26H1
February 10, 2026-KB5074837 Cumulative Update for .NET Framework 4.8.1 for Windows 11, version 26H1 Applies To .NET Note Release Date: February 10, 2026 Version: .NET Framework 4.8.1 The February 10, 2026 update for Windows 11, version 26H1 includes security and cumulative reliability improvement...
SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian Diplomats
A European embassy located in the Indian capital of New Delhi, as well as multiple organizations in Sri Lanka, Pakistan, and Bangladesh, have emerged as the target of a new campaign orchestrated by a threat actor known as SideWinder in September 2025. The activity "reveals a notable evolution in...
SideWinder Adopts New ClickOnce-Based Attack Chain Targeting South Asian Diplomats
A European embassy located in the Indian capital of New Delhi, as well as multiple organizations in Sri Lanka, Pakistan, and Bangladesh, have emerged as the target of a new campaign orchestrated by a threat actor known as SideWinder in September 2025. The activity "reveals a notable evolution in...
SideWinder's Shifting Sands: Click Once for Espionage
SideWinder's Shifting Sands: Click Once for Espionage By Ernesto Fernández Provecho and Pham Duy Phuc · October 22, 2025 In September 2025, the Trellix Advanced Research Center ARC detected a campaign targeting a European embassy located in New Delhi, India. Further investigation led to the...
SideWinder's Shifting Sands: Click Once for Espionage
SideWinder's Shifting Sands: Click Once for Espionage By Ernesto Fernández Provecho and Pham Duy Phuc · October 22, 2025 In September 2025, the Trellix Advanced Research Center ARC detected a campaign targeting a European embassy located in New Delhi, India. Further investigation led to the...
EUVD-2024-26504
Malicious code in bioql PyPI...
OneClik: A ClickOnce-Based APT Campaign Targeting Energy, Oil and Gas Infrastructure
OneClik: A ClickOnce-Based Red Team Campaign Simulating APT Tactics in Energy Infrastructure By Nico Paulo Yturriaga and Pham Duy Phuc · Updated : June 30, 2025 The Trellix Advanced Research Center previously uncovered what appeared to be a sophisticated APT malware campaign, which we dubbed...
OneClik: A ClickOnce-Based APT Campaign Targeting Energy, Oil and Gas Infrastructure
OneClik: A ClickOnce-Based Red Team Campaign Simulating APT Tactics in Energy Infrastructure By Nico Paulo Yturriaga and Pham Duy Phuc · Updated : June 30, 2025 The Trellix Advanced Research Center previously uncovered what appeared to be a sophisticated APT malware campaign, which we dubbed...
OneClik Red Team Campaign Targets Energy Sector Using Microsoft ClickOnce and Golang Backdoors
Cybersecurity researchers have detailed a new campaign dubbed OneClik that leverages Microsoft's ClickOnce software deployment technology and bespoke Golang backdoors to compromise organizations within the energy, oil, and gas sectors. "The campaign exhibits characteristics aligned with...
OneClik Red Team Campaign Targets Energy Sector Using Microsoft ClickOnce and Golang Backdoors
Cybersecurity researchers have detailed a new campaign dubbed OneClik that leverages Microsoft's ClickOnce software deployment technology and bespoke Golang backdoors to compromise organizations within the energy, oil, and gas sectors. "The campaign exhibits characteristics aligned with...
OneClik: A ClickOnce-Based APT Campaign Targeting Energy, Oil and Gas Infrastructure
OneClik: A ClickOnce-Based APT Campaign Targeting Energy, Oil and Gas Infrastructure By Nico Paulo Yturriaga and Pham Duy Phuc · June 24, 2025 The Trellix Advanced Research Center has uncovered a sophisticated APT malware campaign that we’ve dubbed OneClik. It specifically targets the energy, oil...
CVE-2024-29500
An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce application instance...
CVE-2024-29500
An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary code via running a ClickOnce application instance...
