28 matches found
ModTracer
ModTracer v1.0 ModTracer 查找隐藏的 Linux 内核 Rootkit 并使其再次可见。 另一种使 LKM 可见的方法是使用 imperius 技巧：https://github.com/MatheuZSecurity/Imperius 加入 Rootkit 研究人员小组 https://discord.gg/66N5ZQppU7...
FakeMBR
FakeMBR Rootkit estilo TDL4 para falsificar solicitudes de lectura/escritura al registro de arranque maestro MBR Debe compilarse con NTDDK. Ver: http://www.malwaretech.com/2015/01/using-kernel-rootkits-to-conceal.html...
Nidhogg
Nidhogg Nidhogg 是一个多功能 Rootkit，用于展示内核空间中可以执行的各种操作。Nidhogg 的目标是提供一个一体化且易于使用的 Rootkit，具有多种对操作有用的功能。此外，它还可以轻松与你的 C2 框架集成。 Nidhogg 可在任何版本的 x64 Windows 10 和 Windows 11 上运行。 此仓库包含一个内核驱动程序以及一个用于与之通信的 C++ 程序。 如果你想了解更多信息，请查看 Wiki 获得详细说明。 当前功能 !IMPORTANT 所有功能均已完全测试至 Windows 11 25H2。 如果遇到问题，请先检查是否已有未关闭的...
shadow
shadow-rs 🦀 shadow-rs es un rootkit del kernel de Windows escrito en Rust, que demuestra técnicas avanzadas de manipulación del kernel aprovechando las características de seguridad y rendimiento de Rust. Este proyecto está destinado a fines educativos y de investigación. Tabla de Contenidos Aviso...
Singularity
Singularity - Rootkit Stealth de Kernel Linux "¿Le damos un poco de trabajo a la forense?" Este proyecto fue inspirado por una mujer muy especial para mí: Mocinha Singularity es un potente rootkit de módulo de kernel de Linux LKM diseñado para kernels modernos 6.x. Proporciona capacidades...
rvbbit-arsenal
RVBBIT 武器库：终极攻防双重性 概述 本仓库包含同一枚硬币的两面： attack/ – RVBBIT 项目，一个内嵌挖矿程序与网络蠕虫的经典 Linux 内核 Rootkit。 defense/ – RvbbitSafe，可检测、中和并清除 RVBBIT 一切痕迹的终极对策。 二者共同构成了现代 Linux Rootkit 攻防的综合性教育资源。 快速开始 构建噩梦（攻击） root@kitploit: cd attack First, embed the XMRig payload see attack/README.md ./build.sh Deploy...
Black-Angel-Rootkit
Black Angel Rootkit Black Angel es un rootkit en modo kernel de Windows 11/10 x64. El rootkit puede cargarse con DSE habilitado manteniendo toda su funcionalidad. Diseñado para Red Teams. Características del Rootkit El rootkit puede cargarse con kdmapper para omitir DSE; Black Angel Loader puede...
Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel
rootpacket CVE-2026-31431 A Linux Docker-to-host cryptojack...
MAL-2026-5912 Malicious code in js-digest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52847ff329757e0777e62c1c060455abc4ddd6f002c295a7f38d0e0489daf76f Package impersonates crypto-js: name is js-digest but package.json carries crypto-js's exact description "JavaScript library of cryptography...
MAL-2026-5191 Malicious code in wdb-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 146faaf0d97c6a533a969bc3f3f117811f9317dc865ed4ab37f1679842ddeaae This package was compromised as part of the IronWorm campaign. This campaign executes a malicious binary payload during installation via a...
MAL-2026-5190 Malicious code in hbsig (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96b3a65aade5ea74ab5761d7ad3a332834594752f34fdb69a095efe59a681c90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-5192 Malicious code in weavedb-contracts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a352d761eba6aa71b41fc09bb621d3f04e8c7c0e74487392a7c69e77719426b9 No concrete indicators of installer-side harm were identified in this version of weavedb-contracts. No lifecycle scripts, network beacons, credential...
Malicious code in javascript-yaml (npm)
--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security d83c3b506a10b770a8c1f98d280262478cccc65708bb1066a72e0708dccaaf75 This malicious package is part the IronWorm campaign. This campaign executes a malicious binary payload during installation via a preinsta...
MAL-2026-5194 Malicious code in yaml-javascript (npm)
--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security d83c3b506a10b770a8c1f98d280262478cccc65708bb1066a72e0708dccaaf75 This malicious package is part the IronWorm campaign. This campaign executes a malicious binary payload during installation via a preinsta...
MAL-2026-5193 Malicious code in javascript-yaml (npm)
--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security d83c3b506a10b770a8c1f98d280262478cccc65708bb1066a72e0708dccaaf75 This malicious package is part the IronWorm campaign. This campaign executes a malicious binary payload during installation via a preinsta...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...