Ｓｅｃ Ｎｏｔｅ

без подписи

без подписи

Red Team Engineering 2026 Info : https://nostarch.com/red-team-engineering #redteam

گروهی تخصصی برای متخصصین آفنسیو و ردتیم با زبان فارسی اینجا قراره ریپورت‌هایی که منتشر میشه رو بررسی کنیم، تکنیک‌های جدید رو استخراج کنیم و درباره‌ی مشکلات فنی و چالش‌هایی که سر راه اجراست بحث کنیم. https://t.me/+drFBtbbrVDo5NjA0

SpotifyC2 — Cloud-Based Command Channel Research Execute commands through a Spotify playlist and receive command output through Telegram. #c2

Accelerating EDR Evasion with LLM-Driven Analysis #EDR #LLM

Accelerating EDR Evasion with LLM-Driven Analysis #EDR #LLM

без подписи

без подписи

без подписи

tl;dr really effective malware multi-staged, multiple programming languages, use as many dependencies as possible. AI making this easier to do. AVs struggling Historically, in regards to malware development, the end goal was minimalism. It was in your best interest to strip as many dependencies, shred the file size down, and make it position independent. I think, as of ... now ... we need to take a different approach. I think instead of stripping binaries, we (Red Team, Threat Emulation, malware developers) should intentionally introduce dependencies. I have witnesses two unique things in the malware landscape since the AI boom. 1. Increase in malware slop. I continue to see stagers which contain notes in them. This is not intentional and this does not "trick" the analyst. This is a colossal mistake on the malware developers part. However, despite it being slop, AI has made malware more diverse. I am seeing more and more malware in Lua, Node JS (including SEA and nexe), Java, and Python. I am seeing more and more malware doing inter-process communication across multiple programming languages. Of course all of these have existed prior to AI, but I am seeing an explosion in these languages. This also has resulted in malware researchers creating new tools to combat this malware diversity. 2. Anti-malware services struggling. When I encounter a binary that is a Node JS SEA blob (Electron JS .exe, self-contained using SEA), which extracts a .JS payload, which uses obfuscated Java or heavily obfuscated Lua, all of these languages require a VM (PVM, LVM, JVM, whatever) for interpretation. Thus, with heavy obfuscation and multistaging, static analysis fails and the heavy abstraction makes it difficult for traditional hooking or minifilters to be effective, in essence there is too much noise. Many of these payloads with heavy dependencies easily avoid static analysis and even some emulation systems because they fail to account for the necessary dependencies which are required to emulate it correctly. pic maybe related idk

🔓 Dumping NTLM Hashes from Windows Memory via forensics tools What can an attacker recover from a Windows memory image after gaining access to an endpoint? In my new blog, I explored: WinPmem → Volatility 3 → SYSTEM/SAM → NTLM #RedTeam #OffensiveSecurity

AMSI/ETW Evasion for PowerShell, without patching amsi.dll, by manipulating the CLR/JIT and using a Tail Jump patch for ETW 🔥 #etw #amsi

Archive gems, don't bookmark. #EDR

Passive Active Directory security enumeration via native ADSI/COM interfaces. No .NET. No PowerShell. No managed runtime. #ad

без подписи

We’re building a small community around binary security research, focused on things like: - Reverse Engineering - Binary Obfuscation / Deobfuscation - Exploit Development - Compiler / interpreters... - Malware Analysis - Binary Hardening research we also work on open source tools and experiments here: GitHub → BinaryHardening GitHub Discord → BinaryHardening Discord If low level stuff and weird binaries are ur thing, come join us Always happy to meet more RE people

SpotifyC2 — Cloud-Based Command Channel Research Execute commands through a Spotify playlist and receive command output through Telegram. #c2

Persistence via Fake AMSI Provider | Playbook & Detection Strategies #persistence #amsi

The EU just sanctioned the operators behind Lumma Stealer. “Daugn0” and “Lummaseller” have been officially designated for their roles in developing, distributing, and selling the LummaC2 infostealer. Also added: • BPH MediaLand LLC and its owner • Two members of Cyber Army of Russia Reborn • Bentley/Stern (CONTI ransomware) • Two members of GRU Unit 29155 The inclusion of the Lumma operators is particularly notable. Looks like the “lummakrysy” drama wasn’t entirely off the mark after all. cc g0njxa, Gi7w0rm https://eur-lex.europa.eu/eli/reg_impl/2026/1714/oj/eng Telegram ✉️ @club1337 X (Twitter) 🕊 @club31337