New GoSerpent malware targets Southeast Asian government and diplomatic entities, deploying SOCKS5 proxies, credential ...

Attackers were found using a Lua-based malware loader posing as a TrueType font tile, with layered obfuscation and fileless ...

A large-scale phishing operation has been observed disguising a malicious script as a TrueType font file (.tff). Using the ...

A financially motivated Russian threat actor tracked as UAT-11795 is using trojanized software to steal credentials and ...

A Chinese threat actor tracked as UAT-7810 is actively refining its bespoke malware to expand its Operational Relay Box (ORB) ...

Sickle is a tool I originally developed to help me be more effective, in both developing and understanding shellcode. However, throughout the course of its development and usage It has evolved into a ...

The SharpEventPersist tool takes 4 case-sensitive parameters: -file "C:\path\to\shellcode.bin"-instanceid 1337-source Persistence-eventlog "Key Management Service". The shellcode is converted to hex ...

Abstract: Developing a remote exploit is not easy. It requires a comprehensive understanding of a vulnerability and delicate techniques to bypass defense mechanisms. As a result, attackers may prefer ...