nopowershell

NoPowerShell NoPowerShell 是一个用 C 实现的工具，支持执行类似 PowerShell 的命令，同时保持对任何 PowerShell 日志记录机制不可见。这个 .NET Framework 2 兼容的二进制文件可加载到 Cobalt Strike 中，以在内存中执行命令。未使用 System.Management.Automation.dll；仅使用原生 .NET 库。NoPowerShell 的另一个用途是在受限环境中通过 rundll32.exe 将其作为 DLL 启动：rundll32 NoPowerShell.dll,main。 该项目让每个人都能仅用几...

dnsteal

dnsteal v 2.0 This is a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests. Below are a couple of different images showing examples of multiple file transfer and single verbose file transfer: Support for multiple files Gzip compression supported...

dnsteal

dnsteal v 2.0 これは、偽のDNSサーバーであり、DNSリクエストを通じて被害者のマシンからファイルをステルス的に抽出できるようにするものです。 以下に、複数ファイル転送と単一の詳細ファイル転送の例を示すいくつかの画像を示します。 複数ファイルのサポート Gzip圧縮対応 サブドメイン、サブドメインあたりのバイト数、ファイル名の長さのカスタマイズをサポート ヘルプは以下を参照： ヘルプが理解できない場合は、デフォルトオプションでプログラムを使用してください！ python dnsteal.py 127.0.0.1 -z -v...

s3enum

s3enum s3enumは、高速でステルス性の高いAmazon S3バケット列挙ツールです。DNSを利用するためHTTPを使わず、リクエストがS3サーバーアクセスログに記録されません。 元々は2016年にGitHubへの攻撃を目的として作成されました。 インストール go install github.com/koenrh/s3enum@latest 使い方 ターゲットのベース名（例:...

cleanldap

CleanLdap 用于通过 AD WS 执行隐蔽 LDAP 查询的 BOF 参数 直接切入正题，以下是参数及其含义： Z: DC Hostname "dc01.example.com" Z: LDAP query "objectClass=" Z: Comma separated list of LDAP attributes "samaccountname,distinguishedName,cn" - if empty, collect all Z: Base DN "DC=example,DC=com" - if empty parse from hostname Z: Max...

twittor

Twittor Twitter（ダイレクトメッセージ）をC2サーバとして使用する、ステルス性の高いPythonベースのバックドアです。 このプロジェクトは、Gmailアカウントを使用して同様の動作を行うGcatに触発されました。 セットアップ 動作には以下が必要です： Twitterアカウント（専用アカウントを使用してください！個人アカウントは使わないでください！ ） Twitterでアプリを登録し、読み取り、書き込み、ダイレクトメッセージ のアクセスレベルに設定してください。 依存関係をインストールします： $ pip install -r requirements.txt...

ntqueueapcthreadex-ntdll-gadget-injection

🧪 NtQueueApcThreadEx NTDLL Gadget 注入 简介 这种新颖的方式通过滥用 ApcRoutine 和 SystemArgument0-3 参数来使用 NtQueueApcThreadEx，传入一个随机的 pop r32; ret gadget，可用于隐蔽的代码注入。在此 PoC 中，该 gadget 是从 ntdll.dll 内存区域中随机挑选的、与特定模式匹配的 gadget。这意味着该 gadget 会 返回到 shellcode 中。 1. 在目标进程中分配 shellcode。为获得最佳效果，应配合 shellcode-plain-sight 项目使用...

gcat

Gcat 一个基于 Python 的隐蔽后门，使用 Gmail 作为命令与控制服务器 本项目灵感来源于 Benjamin Donnelly 的原始 PoC 代码 这是 PoC 代码... ... 发布该代码是为了让组织测试其对这类攻击的防御能力。要检测此类攻击，请参阅 RITA 等项目。 有关此项目的最新维护版本，请参见 GDog 设置 要让此工具工作，你需要： 一个 Gmail 账户（请使用专用账户！不要使用你的个人账户！ ） 在账户安全设置中打开“允许不够安全的应用” 可能还需要在账户设置中启用 IMAP 本仓库包含两个文件： gcat.py 用于枚举可用客户端并向其发送命令的脚本...

Malicious code in devplatform-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c On require'devplatform-sdk', index.js loads polyfill.js which auto-invokes start: it selects a per-OS payload path, fetches a binary from...

Malicious code in abi-encode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afc61427f74a028242a032b9436c09c43b1df60fef5688aa5389ef107e899259 The package advertises ABI encoding but on require schedules a 37-second timer that decodes test/fixtures/keypairs.dat base64-encoded stealer, staged...

Customization under Fire: Plugin Poisoning in Text-To-Image Ecosystem

The prosperity of text-to-image T2I models has fostered a vibrant share-and-play ecosystem centered on Low-Rank Adaptation LoRA plugins, which allow users to customize and share model capabilities with ease. This democratization, however, comes with a hidden but severe security risk. Malicious...

POISE: Position-Aware Undetectable Skill Injection on LLM Agents

Agent skills provide a lightweight mechanism for extending general-purpose agents, but their open format exposes them to skill-poisoning attacks. A practically dangerous injection must stay invisible: if executing the payload derails the user's legitimate task, the resulting failure signal invite...

Undermining the trust boundary: Investigating a stealthy intrusion through third-party compromise

In this article 1. Abuse of trusted relationships as an attack delivery mechanism 2. Methods, tools, and access strategies 3. Campaign conclusion 4. Microsoft Defender detection and hunting guidance In recent years, many sophisticated intrusions have increasingly avoided using noisy exploits,...

Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities

TrendAI™ Research breaks down Quasar Linux QLNX, a previously undocumented sophisticated Linux RAT with low detection rates. In this blog, we examine a full-featured Linux threat incorporating a rootkit, a PAM backdoor, credential harvesting, and more, revealing how this malware enables stealthy...

Active HanGhost Loader Campaign Targets Enterprise Payment and Logistics Workflows

Active HanGhost Loader campaign targets enterprise payment and logistics workflows with fileless attacks, multi-stage execution, and stealthy malware delivery...

Hiding in the Tunnels: Unmasking the New Stealthy BPFDoor Variants

This is Rapid7's whitepaper discussing BPFDoor variants. Advanced persistent threats APTs are locked in a continuous arms race with network defenders. As static indicators of compromise IoCs for the notorious BPFDoor malware became widely deployed by security vendors, the threat actors went back ...

Cookie-controlled PHP webshells: A stealthy tradecraft in Linux hosting environments

In this article 1. Cookie-controlled execution behavior 2. Observed variants of cookie-controlled PHP web shells 3. Mitigation and protection guidance 4. Microsoft Defender XDR detections 5. Microsoft Security Copilot prompts 6. Microsoft Defender XDR threat analytics 7. MITRE ATT&CK™ Techniques...

Trojan'S Whisper: Stealthy Manipulation of OpenClaw through Injected Bootstrapped Guidance

Trojan's Whisper: Stealthy Manipulation Of OpenClaw Through Injected Bootstrapped Guidance...

ReasoningBomb: A Stealthy Denial-Of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Models

Large reasoning models LRMs extend large language models with explicit multi-step reasoning traces, but this capability introduces a new class of prompt-induced inference-time denial-of-service PI-DoS attacks that exploit the high computational cost of reasoning. We first formalize inference cost...

Stealthy Poisoning Attacks Bypass Defenses in Regression Settings

Regression models are widely used in industrial processes, engineering and in natural and physical sciences, yet their robustness to poisoning has received less attention. When it has, studies often assume unrealistic threat models and are thus less useful in practice. In this paper, we propose a...