MalDev

MalDev 안녕하세요! 제 레포에 오신 것을 환영합니다 : 저는 Captain Magma입니다. 사이버보안, 악성코드 개발 및 분석에 열정을 가진 사람입니다. 이 레포지토리는 제가 학습하면서 노트와 코드로 업데이트하는 MalDev 로드맵을 관리하기 위해 설계되었습니다. 저는 이 기법들의 저자가 아니며, 이는 단지 제가 구현한 것일 뿐입니다. !Important 저는 전문가가 전혀 아니며, 기껏해야 초보자 수준임을 분명히 하고 싶습니다. 그렇기 때문에 이 레포에서 멋진 APT 수준의 악성코드를 기대하지 말아 주세요. 또한 이...

LiquidSnake

Liquid Snake Liquid Snake은 디스크에 접촉하지 않고 Windows 시스템에 대한 수평 이동을 수행하기 위한 프로그램입니다. 이 도구는 WMI 이벤트 구독에 의존하여 메모리에서 .NET 어셈블리를 실행하며, .NET 어셈블리는 명명된 파이프에서 셸코드를 수신한 다음 스레드 하이재킹 셸코드 인젝션의 변형을 사용하여 실행합니다. 아래 다이어그램은 데이터 흐름을 설명합니다바라건대: Credits MDSec - WMI Event Subscription - 이 도구는 이 블로그 게시물에 설명된 개념의 구현에 불과하며,...

threadfire

threadfire 프로그램은 스레드 하이재킹Thread Hijacking을 사용하여 표준 Win32 애플리케이션에 네이티브 셸코드를 주입합니다. 이 코드를 만들 당시 저는 15살이었습니다 - 저급한 코드를 양해해 주세요. 소개 저는 이 작은 프로젝트를 다양한 코드 인젝션 방법에 대한 경험을 계속 쌓고, RedTeam 보안 전문가들이 이 방법을 소프트웨어 침투 테스트를 수행하는 독특한 방식으로 활용할 수 있도록 개발했습니다. 스레드 하이재킹을 사용하면 hijacker.exe 프로그램이 target.exe 프로그램 내의 스레드를...

CVE-2026-2449

Improper neutralization of argument delimiters in a command 'argument injection' vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Hijacking a Privileged Thread of Execution.This issue affects upKeeper Instant Privilege Access: through 1.5.0...

CVE-2026-2450

.NET misconfiguration: use of impersonation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Hijacking a Privileged Thread of Execution.This issue affects upKeeper Instant Privilege Access: through 1.5.0...

Exploit for CVE-2025-2783

Chromium CVE-2025-2783: Sandbox Escape & Full-Chain RCE Exploi...

Darktrace AI Halts Thread Hijacking Attack Targeting Major Company

Darktrace AI detected and stopped a thread hijacking attack in real-time, preventing email account compromise and data theft.…...

Thread Hijacking: Phishes That Prey on Your Curiosity

Thread hijacking attacks. They happen when someone you know has their email account compromised, and you are suddenly dropped into an existing conversation between the sender and someone else. These missives draw on the recipients natural curiosity about being copied on a private discussion, whic...

Warning: Thread Hijacking Attack Targets IT Networks, Stealing NTLM Hashes

The threat actor known as TA577 has been observed using ZIP archive attachments in phishing emails with an aim to steal NT LAN Manager NTLM hashes. The new attack chain "can be used for sensitive information gathering purposes and to enable follow-on activity," enterprise security firm Proofpoint...

Alert: Water Curupira Hackers Actively Distributing PikaBot Loader Malware

A threat actor called Water Curupira has been observed actively distributing the PikaBot loader malware as part of spam campaigns in 2023. "PikaBot's operators ran phishing campaigns, targeting victims via its two components — a loader and a core module — which enabled unauthorized remote access...

ICYMI: Emotet Reappeared Early This Year, Unfortunately

ICYMI: Emotet Reappeared Early This Year, Unfortunately By Adithya Chandra and Joao Marques · September 1, 2023 This blog was also written by Raghav Kapoor Executive Summary Emotet first appeared in 2014 and continues to be a dangerous and resilient malware, despite attempts by law enforcement...

Evasive QBot Malware Leverages Short-lived Residential IPs for Dynamic Attacks

An analysis of the "evasive and tenacious" malware known as QBot has revealed that 25% of its command-and-control C2 servers are merely active for a single day. What's more, 50% of the servers don't remain active for more than a week, indicating the use of an adaptable and dynamic C2...

Evasive QBot Malware Leverages Short-lived Residential IPs for Dynamic Attacks

An analysis of the "evasive and tenacious" malware known as QBot has revealed that 25% of its command-and-control C2 servers are merely active for a single day. What's more, 50% of the servers don't remain active for more than a week, indicating the use of an adaptable and dynamic C2...

New QBot Banking Trojan Campaign Hijacks Business Emails to Spread Malware

A new QBot malware campaign is leveraging hijacked business correspondence to trick unsuspecting victims into installing the malware, new findings from Kaspersky reveal. The latest activity, which commenced on April 4, 2023, has primarily targeted users in Germany, Argentina, Italy, Algeria, Spai...

After four months of idleness, Emotet reappears and deploys loaders

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary The Emotet banking Trojan was initially found in 2014 as one of the most expensive and damaging malware. The phishing efforts that spread Emotet used the same email thread hijacking approach to deceive...

Notorious Emotet Malware Returns With High-Volume Malspam Campaign

The notorious Emotet malware has returned with renewed vigor as part of a high-volume malspam campaign designed to drop payloads like IcedID and Bumblebee. "Hundreds of thousands of emails per day" have been sent since early November 2022, enterprise security company Proofpoint said last week,...

What Talos Incident Response learned from a recent Qakbot attack hijacking old email threads

By Nate Pors and Terryn Valikodath. Executive summary In a recent malspam campaign delivering the Qakbot banking trojan, Cisco Talos Incident Response CTIR observed the adversary using aggregated, old email threads from multiple organizations that we assess were likely harvested during the 2021...

Cybercriminals Using New Malware Loader 'Bumblebee' in the Wild

Cybercriminal actors previously observed delivering BazaLoader and IcedID as part of their malware campaigns are said to have transitioned to a new loader called Bumblebee that's under active development. "Based on the timing of its appearance in the threat landscape and use by multiple...

Exchange Servers Speared in IcedID Phishing Campaign

The ever-evolving banking trojan IcedID is back again with a phishing campaign that uses previously compromised Microsoft Exchange servers to send emails that appear to come from legitimate accounts. Attackers also are using stealthy new payload-delivery tactics to spread the modular malware...

LittleCorporal - A C# Automated Maldoc Generator

LittleCorporal: A C Automated Maldoc Generator C:\LittleCorporal\bin\ReleaseLittleCorporal.exe C:\beacon.bin explorer.exe . . . . | | ||/ |/ || | \ \ | | | | | \ \ \ | / / \ / / \ \ \ / \ \ \ | | | || || | | | | |\ /\ \ | / | | // | | | ||| || |/\ \ //|| | / /|| // / / / || / / \ / o\ /...