Shell3er

Shell3er Shell3er — обратная оболочка PowerShell Возможности обратной оболочки Shell3er Функция Get-RandomProcessName Функция Get-RandomProcessName генерирует случайное имя процесса, объединяя «PS» с новым GUID. Это используется для создания уникальных и внешне случайных имён процессов, что...

RustyWater-ShellCode-Dropper

RustyWater ShellCode Dropper RustyWater представляет собой основную полезную нагрузку и основу всей атакующей операции в атаках группировки Static Kitten. RustyWater — это скомпилированный исполняемый файл на Rust замаскированный под reddit.exe с поддельной иконкой Cloudflare, известный как...

SharpHide

SharpHide Просто хороший трюк для персистентности, чтобы запутать расследование DFIR. Использует нативный API NtSetValueKey для создания скрытого с нулевым символом в конце ключа реестра. Это работает путем добавления нулевого байта перед именем значения ключа UNICODESTRING. Дополнительную...

Palsy-Virus

Palsy Virus 실행되면 PC를 마비시키는 Python 바이러스로, 스스로를 숨기고 레지스트리 시작 항목에 자신을 추가합니다 ^^ 플랫폼 : -- Windows 전용 :P...

BOF_Collection

BOFCollection 다양한 Cobalt Strike BOF 요구 사항 beacon.h 컴파일 지침 및 BOF 개요는 help-bof를 참조하십시오. ActiveDirectory GetDomainInfo.c 현재 도메인 및 도메인 컨트롤러에 대한 정보를 반환합니다. inline-execute GetDomainInfo.o 수집 GetClipboard.c 클립보드의 모든 텍스트를 출력합니다. inline-execute GetClipboard.o dumpwifi.c WiFi 인터페이스를 열거하고 평문 자격 증명을 덤프합니다...

-Remcos-RAT-Fileless-svchost-Injection-Obfuscated-Payload-Analysis-

1. Remcos – внедрение в svchost через вызовы Native API Следующий фрагмент из Binary Ninja раскрывает основной механизм внедрения, используемый Remcos для инжекции своей нагрузки в svchost.exe. Что делает этот код: CreateProcessW с флагом CREATESUSPENDED запускает новый процесс svchost в...

Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. References 4. Learn more Microsoft Threat Intelligence has identified an active multi-stage intrusion campaign targeting organizations in the hospitality and hotel industry since April 2026. We’ve observed this...

Malicious code in clobprice.api (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Malicious code in clob.api (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Malicious code in @devcarron/clob (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

Dust Specter Targets Iraqi Officials with New SPLITDROP and GHOSTFORM Malware

A suspected Iran-nexus threat actor has been attributed to a campaign targeting government officials in Iraq by impersonating the country's Ministry of Foreign Affairs to deliver a set of never-before-seen malware. Zscaler ThreatLabz, which observed the activity in January 2026, is tracking the...

MAL-2026-811 Malicious code in grokwrapper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a7ae896464be7f195243e35231a2435d0a1eb055cc7fa8cfaef707c7e11c55b2 During importing the module, package silently execute code hidden in an embedded config file, and downloads remote executable. It's then added to Run registry...

Accessibility Features (Sticky Keys) Persistence via Debugger Registry Key

This module makes it possible to apply the 'sticky keys' hack to a session with appropriate rights. The hack provides a means to get a SYSTEM shell using UI-level interaction at an RDP login screen or via a UAC confirmation dialog. The module modifies the Debug registry setting for certain...

Russian APT28 Deploys "NotDoor" Outlook Backdoor Against Companies in NATO Countries

The Russian state-sponsored hacking group tracked as APT28 has been attributed to a new Microsoft Outlook backdoor called NotDoor in attacks targeting multiple companies from different sectors in NATO member countries. NotDoor "is a VBA macro for Outlook designed to monitor incoming emails for a...

Malicious Package

Overview colorinal is a malicious package. This package is part of a multi-stage attack and its content was removed from the official package manager. The attack utilizes a seemingly harmless package to introduce a malicious dependency. The goal of this attack is to gain remote code execution on...

Malicious Package

Overview termncolor is a malicious package. This package is part of a multi-stage attack and its content was removed from the official package manager. The attack utilizes a seemingly harmless package to introduce a malicious dependency. The goal of this attack is to gain remote code execution on...

Malicious code in planweb-core-ui (npm)

This package contains code to download a second stage payload which establishes a C2 connection and persistence via registry keys. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acc967a53ff92a71f6b9518c692bf641aa3595a3b65f28cc403b471c0474b175 Any computer that has...

MULTI#STORM Campaign Targets India and U.S. with Remote Access Trojans

A new phishing campaign codenamed MULTISTORM has set its sights on India and the U.S. by leveraging JavaScript files to deliver remote access trojans on compromised systems. "The attack chain ends with the victim machine infected with multiple unique RAT remote access trojan malware instances, su...

LOBSHOT: A Stealthy, Financial Trojan and Info Stealer Delivered through Google Ads

In yet another instance of how threat actors are abusing Google Ads to serve malware, a threat actor has been observed leveraging the technique to deliver a new Windows-based financial trojan and information stealer called LOBSHOT. "LOBSHOT continues to collect victims while staying under the...

‘Fully Undetected’ SysJoker Backdoor Malware Targets Windows, Linux & macOS

A brand-new multiplatform malware, likely distributed via malicious npm packages, is spreading under the radar with Linux and Mac versions going fully undetected in VirusTotal, researchers warned. The Windows version, according to a Tuesday writeup from Intezer, has only six detections as of this...