Ｓｅｃ Ｎｏｔｅ

When adversaries bring their own virtual machine for persistence

#persist

Malware Just Got Its Free Passes Back!

#callstack #edr

APT15 Cyber Espionage: Campaigns and TTPs Analysis

My favorite Group 😁

#ttp #china

LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems (HIPS) through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed modules—completely fooling behavioral analysis engines that rely on call stack inspection and module origin verification.

Evade behavioral analysis by executing malicious code within trusted Microsoft call stacks
Uses hardware breakpoints + VEH to hijack legitimate functions and spoof module origins

│ 1. Target Function Call
│ ↓
│ 2. CPU Debug Register Triggers (DR0-DR3) │
│ ↓
│ 3. EXCEPTION_SINGLE_STEP Raised │
│ ↓
│ 4. VEH Handler Intercepts Exception │
│ ↓
│ 5. Execution Redirected to Hook Function │
│ ↓
│ 6. CallOriginal() Temporarily Disables Breakpoint
│ ↓
│ 7. Original Function Executes │
│ ↓
│ 8. Breakpoint Re-enabled

#callstackspoofing #edr

Stillepost - Or: How to Proxy your C2s HTTP-Traffic through Chromium


#c2

CLR Unhooking Tool

Note: For this to have the effect of a clean CLR, you’d need to manually map the DLL from disk into memory. You cannot use LoadLibraryA/W, because antivirus solutions will detect the DLL load event and may hook it immediately. If you want this behavior, you can look up existing manual mappers on GitHub and integrate one into your codebase. I’m not including one here, as AV vendors generally don’t appreciate that

A native C++ utility that bypasses EDR/AV hooks in the .NET Common Language Runtime by restoring the original nLoadImage function implementation.

Matthew Graeber (@mattifestation) - Reverse engineering InternalCall methods and CLR internals


#clr #bypass #rev

Trainsec - MAoS – Malware Analysis on Steroids Bundle

🔗 Download

Info : https://trainsec.net/courses/maos-malware-analysis-on-steroids-bundle/

@offenciveSec

Post-Exploitation Tools 2025: C2, PrivEsc, Lateral Movement, and Exfiltration in Practice

#post_exp

APT34 (OilRig): Iran’s Adaptive Cyber Espionage Arm from 2014–2025

#IRAN #APT

How Poor Asset Management Turns Enterprise Attack Surfaces Exploitable

#redteam #tip

Red Team OPSEC Failures: Lessons from Real Operations and Case Studies

#redteam #opsec

K7 Antivirus: Named pipe abuse, registry manipulation and privilege escalation

https://blog.quarkslab.com/k7-antivirus-named-pipe-abuse-registry-manipulation-and-privilege-escalation.html

#CVE-2024-36424

[ Living Off the Land: Windows Post-Exploitation Without Tools ]

Blog about post-exploitation using only built-in, signed Microsoft tools (PowerShell, WMI, certutil, bitsadmin, and more), without uploading any custom binaries or dropping suspicious artifacts.

https://xbz0n.sh/blog/living-off-the-land-windows

(note from admin: don't forget that PS/WMIC and other things that are described in this article will also be detected)

Read teaming
field-notes-on-malware

rise-of-read-teaming