OpenPetya

OpenPetya A Proof-of-Concept bootkit and UEFI boot application inspired by Petya ransomware, written in Assembly, C, and C++ If you find this project helpful or informative, I would truly appreciate a ⭐ on the repository. Your support would be a great motivation for me to continue improving this...

Exploit-CVE-2014-4210-

START WITH A COOL THING DUDEUSE IT TO F&CK UPGRADES TO CAUSE HUMAN SUFFERING: 1. Self-Replicating Worm : Spreads via SSH brute-force/SMB exploits to all connected networks. 2. MBR Overwrite : Brick physical hardware by destroying partition tables no recovery possible. 3. Zero-Day RCE : Exploits...

cve-2025-24985

cve-2025-24985 Compute the number of cluster of a VHD file to detect overflow. Supportted boot sectors: MBR GPT Usage python -m cve202524985 -f Setup Nix With direnv: direnv allow Or Without direnv: nix develop Peotry WIP Docker WIP TODO: Auto build libvhdi with poetry Setup poetry install Fix...

FakeMBR

FakeMBR TDL4 style rootkit to spoof read/write requests to master boot record Needs to be compile with NTDDK. See: http://www.malwaretech.com/2015/01/using-kernel-rootkits-to-conceal.html...

Rocky Linux 8 [CIQ] Security Update: hivex / hivex-debuginfo / hivex-debugsource / hivex-devel / etc Multiple Vulnerabilities (crlsa-2024_2962)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242962 advisory. QEMU: VNC: infinite loop in inflatebuffer leads to denial of service CVE-2023-3255 QEMU: improper IDE controller reset can lead to MBR overwrite...

Rocky Linux 9 [CIQ] Security Update: qemu-guest-agent / qemu-guest-agent-debuginfo / qemu-img / etc Multiple Vulnerabilities (crlsa-2024_2135)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242135 advisory. QEMU: e1000e: heap use-after-free in e1000ewritepackettoguest CVE-2023-3019 QEMU: VNC: infinite loop in inflatebuffer leads to denial of service...

Malicious code in india-mbr-project (npm)

The package india-mbr-project was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in osinthell (npm)

Source: amazon-inspector 458757b4c185e84321b45bd7fec158459300d68106826e5774df2399818c7916 The package's only exported function, sorgu, invokes 26 sibling modules under public/a/b/.../z/ that carry out an immediate, irreversible destructive attack on the caller's Windows host. Observed behaviors...

Ventoy v1.1.17

Ventoy Ventoy is an open source tool to create bootable USB drive for ISO/WIM/IMG/VHDx/EFI files. With Ventoy, you don't need to format the disk over and over, just copy the image files to the USB drive and boot them. You can copy many image files at a time and Ventoy will give you a boot menu to...

MAL-2025-23144 Malicious code in india-mbr-project (npm)

The package india-mbr-project was found to contain malicious code...

QEMU: improper IDE controller reset can lead to MBR overwrite

A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead potentially overwriting the VM's boot code. This could be used, for example, by L2 guests with a virtual disk vdiskL2 stored on a virtual disk of an L1 vdiskL1...

QEMU: improper IDE controller reset can lead to MBR overwrite

A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead potentially overwriting the VM's boot code. This could be used, for example, by L2 guests with a virtual disk vdiskL2 stored on a virtual disk of an L1 vdiskL1...

Moderate: Red Hat Security Advisory: qemu-kvm security update

An update for qemu-kvm is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2023-5088 Qemu: improper ide controller reset can lead to mbr overwrite

A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead potentially overwriting the VM's boot code. This could be used, for example, by L2 guests with a virtual disk vdiskL2 stored on a virtual disk of an L1 vdiskL1...

Moderate: Red Hat Security Advisory: gdisk security update

An update for gdisk is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

RLSA-2022:7700 Moderate: gdisk security update

The gdisk packages provide the gdisk partitioning utility for GUID Partition Table GPT disks. The utility features a command-line interface similar to fdisk, direct manipulation of partition table structures, recovery tools to deal with corrupt partition tables, and the ability to convert Master...

Return of Pseudo Ransomware

Return of Pseudo Ransomware By Trellix, Max Kersten and Raj Samani · January 20, 2022 Arnab Roy, Filippo Sitzia and Mo Cashman contributed to the research supporting this blog Recent news reports of a “ransomware” campaign targeting Ukraine has resulted in significant press coverage regarding not...

Destructive malware targeting Ukrainian organizations

Microsoft Threat Intelligence Center MSTIC has identified evidence of a destructive malware operation targeting multiple organizations in Ukraine. This malware first appeared on victim systems in Ukraine on January 13, 2022. Microsoft is aware of the ongoing geopolitical events in Ukraine and...

ESPecter Bootkit Malware Haunts Victims with Persistent Espionage

A rare Windows UEFI bootkit malware has been discovered, offering attackers a path to cyber-espionage, researchers are warning. According to ESET, the bootkit’s goal is to install a full featured backdoor on a target PC, which “supports a rich set of commands and contains various automatic data...

FinSpy: unseen findings

FinSpy, also known as FinFisher or Wingbird, is an infamous surveillance toolset. Kaspersky has been tracking deployments of this spyware since 2011. Historically, its Windows implant was distributed through a single-stage installer. This version was detected and researched several times up to...