Analysis

탐지 엔지니어링 노트 및 분석 이 저장소는 실험실 테스트, 로그 분석 및 실제 SOC 워크플로에 기반한 실무 탐지 연구를 문서화합니다. 초점은 공격자 기술이 로그에 실제로 어떻게 나타나는지, 어떤 탐지 로직이 실제로 작동하는지, 무엇이 실패하는지, 그리고 오탐이 발생하는 위치에 맞춰져 있습니다. 모든 콘텐츠는 분석가와 탐지 엔지니어를 위한 방어적 관점에서 작성되었습니다. 이는 공격 도구나 익스플로잇 개발이 아닙니다. 이 저장소에 포함된 내용 DLL 하이재킹 및 사이드 로딩 Windows 시스템에서의 DLL 하이재킹 및 사이드 ...

FsquirtCPLPoC

Fsquirt.exe Windows 二进制文件会从当前工作目录尝试加载一个名为 bthprops.cpl 的控制面板小程序 CPL。当 bthprops.cpl 与 fsquirt.exe 位于同一目录时，该二进制文件会加载它，并从 DLLMain 中执行一个 MessageBox。 该 PoC 代码生成一个恶意的 bthprops.cpl 文件，该文件可由 fsquirt.exe 加载。附带的 build.sh 脚本会为您编译该 CPL 模块。...

CVE-2026-4255

CVE-2026-4255 Thermalright TR-VISION HOME DLL 사이드로딩 권한 상승 심각도: 높음 CVSS 8.4 CWE: CWE-829 신뢰할 수 없는 제어 영역의 기능 포함 공개일: 2026-03-16 CNA: Toreon 영향 받는 버전: Thermalright TR-VISION HOME ≤ 2.0.5 Windows 64-bit 발견자: Ard33 설명 Thermalright TR-VISION HOME은 기본 Windows DLL 검색 순서를 사용하여 Ftd2xx.dllFTDI USB-시리얼 라이브러리...

CVE-2021-40444

Fully Weaponized CVE-2021-40444 CVE-2021-40444（Microsoft Office Word リモートコード実行）を悪用する悪意のある docx ジェネレーター。任意の DLL ファイルで動作します。 背景 多くの PoC がすでにインターネット上に存在しますが、この脆弱性を武器化するために自分自身で試してみることにしました。見つけた既存のものには共有する価値のある有益な情報が不足していたためです。また、Microsoft がこの脆弱性に対するパッチをすでにリリースしていることも考慮しました。...

ScareCrow

이 저장소는 보관되었습니다 ScareCrow의 최신 버전을 확인하거나 이슈를 제출하려면 https://github.com/Tylous/ScareCrow를 참조하십시오. ScareCrow 추가 정보 이 프레임워크에서 사용된 기술에 대해 더 자세히 알고 싶다면 Part 1 및 Part 2를 참조하십시오. 설명 ScareCrow는 합법적인 Windows 프로세스에 사이드 로딩주입이 아닌을 위한 페이로드 생성 프레임워크입니다애플리케이션 허용 목록 제어 우회. DLL 로더가 메모리에 로드되면, 프로세스 메모리에서 실행 중인 시스템...

Spark RAT Targets Cambodia, Abuses Vulnerable OPSWAT Driver to Disable Security Tools

Individuals and organizations in Cambodia have emerged as the target of a new campaign that delivers an open-source remote access trojan RAT called Spark RAT. "The samples employ diverse lure themes, suggesting an effort to appeal to a broad range of potential victims. These include government...

New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode

An independent malware researcher has documented a previously unreported Windows backdoor, dubbed SLEEPWALKER , that stays inert in memory until a specifically crafted network packet reaches the machine and then runs commands written in a 23-instruction language of its own design. The sample is a...

Silver Fox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT

The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver BYOVD attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT aka Winos 4.0 for persistent remote access. "In...

Malicious code in ts-precision (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7d2534408d7dd1d7f02c3ef470bc697d0803e8acd58941de5974a250127cb8c Package ships a verbatim copy of big.js v7.0.1 including the original author metadata 'Michael Mclaughlin ' and repo reference MikeMcl/big.js under a...

DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic

Threat actors associated with the DragonForce ransomware have been observed using a custom Go-based remote access trojan RAT called Backdoor.Turn to conceal command-and-control C2 traffic inside Microsoft Teams relay infrastructure. According to findings from Broadcom-owned Symantec and Carbon...

ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures

Cybersecurity researchers have flagged multiple ClickFix campaigns that deliver three malware loaders called BabaDeda Loader , Lorem Ipsum Loader , and Potemkin , per independent reports from Morphisec, BlueVoyant, and Huntress, respectively. Attacks involving BabaDeda Loader, observed in April...

China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan

A new cyber espionage campaign codenamed Operation Dragon Weave has been observed targeting officials and citizens in the Czech Republic and Taiwan to deliver an AdaptixC2 agent. According to Seqrite Labs, targets of the campaign include government, research, academic, technology, and financial...

Grandoreiro Malware and BTMOB RAT Campaigns Target Windows and Android Users

Latin America and Europe become the target of two banking trojan campaigns that are designed to infect Windows and Android devices with Grandoreiro and BTMOB malware, respectively. That's according to new findings from WatchGuard and ESET, which have observed the two malware families being used t...

MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries

The Iranian hacking group known as MuddyWater has been linked to a new campaign affecting at least nine organizations across nine countries on four continents in the first quarter of 2026. The activity targeted industrial and electronics manufacturing, education and public-sector bodies, financia...

TCLBANKER Banking Trojan Targets Financial Platforms via WhatsApp and Outlook Worms

Threat hunters have flagged a previously undocumented Brazilian banking trojan dubbed TCLBANKER that's capable of targeting 59 banking, fintech, and cryptocurrency platforms. The activity is being tracked by Elastic Security Labs under the moniker REF3076. The malware family is assessed to be a...

CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads

Unknown threat actors compromised CPUID "cpuid.com", a website that hosts popular hardware monitoring tools like CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor, for less than 24 hours to serve malicious executables for the software and deploy a remote access trojan called STX RAT. The incident...

UAT-10362 Targets Taiwanese NGOs with LucidRook Malware in Spear-Phishing Campaigns

A previously undocumented threat cluster dubbed UAT-10362 has been attributed to spear-phishing campaigns targeting Taiwanese non-governmental organizations NGOs and suspected universities to deploy a new Lua-based malware called LucidRook. "LucidRook is a sophisticated stager that embeds a Lua...

ScreenToGif 安全漏洞

ScreenToGif is a screen recording and GIF creation tool developed by Nicke Manarin himself. Versions of ScreenToGif 2.42.1 and earlier contained security vulnerabilities, which were caused by a DLL-side loading vulnerability. This vulnerability could allow arbitrary code to be executed in user...

CVE-2026-4255

A DLL search order hijacking vulnerability in Thermalright TR-VISION HOME on Windows 64-bit allows a local attacker to escalate privileges via DLL side-loading. The application loads certain dynamic-link library DLL dependencies using the default Windows search order, which includes directories...

CVE-2026-4255

The CVE-2026-4255 entry describes a DLL search order hijacking in Thermalright TR-VISION HOME (Windows 64-bit) that allows local privilege escalation via DLL side-loading. Affected: TR-VISION HOME versions up to 2.0.5. Root cause: the application loads DLL dependencies using the default Windows s...