NovaLdr

NovaLdr ⚜️ NovaLdr 是一个用 Rust 编写的无线程模块踩踏（Threadless Module Stomping）工具，旨在作为探索恶意软件开发世界的学习项目。它使用间接系统调用和字符串加密等高级技术来实现其功能。该项目并非旨在成为完整或完善的产品，而是深入恶意软件技术层面的旅程，展示各种技术和特性。 功能概览 💡 间接系统调用 字符串加密 Shellcode 加密 : 简单 XOR 并将 Shellcode 字节转换为 MAC 地址 无线程执行 无线程注入: 将蹦床写入给定 DLL 内的指定函数，并重定向以加载另一个 DLL。 JMPThreadHijack: 在不调...

chimera

基于 Rust 的 MobaXterm DLL 劫持加载器（CVE-2026-6421），带持久化功能...

China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan

A new cyber espionage campaign codenamed Operation Dragon Weave has been observed targeting officials and citizens in the Czech Republic and Taiwan to deliver an AdaptixC2 agent. According to Seqrite Labs, targets of the campaign include government, research, academic, technology, and financial...

Silver Fox Deploys ABCDoor Malware via Tax-Themed Phishing in India and Russia

The China-based cybercrime group known as Silver Fox aka Monarch, SwimSnake, The Great Thief of Valley, UTG-Q-1000, and Void Arachne has been linked to a new campaign targeting organizations in Russia and India with a new malware called ABCDoor. The activity involved using phishing emails that...

Chinese Hackers Exploit Trimble Cityworks Flaw to Infiltrate U.S. Government Networks

A Chinese-speaking threat actor tracked as UAT-6382 has been linked to the exploitation of a now-patched remote-code-execution vulnerability in Trimble Cityworks to deliver Cobalt Strike and VShell. "UAT-6382 successfully exploited CVE-2025-0944, conducted reconnaissance, and rapidly deployed a...

New Rilide Malware Targeting Chromium-Based Browsers to Steal Cryptocurrency

Chromium-based web browsers are the target of a new malware calledRilide that masquerades itself as a seemingly legitimate extension to harvest sensitive data and siphon cryptocurrency. "Rilide malware is disguised as a legitimate Google Drive extension and enables threat actors to carry out a...