Die MALFEX-Kampagne nutzt ein Windows-Addon und dllhost.exe; Umfang und Zahl möglicher Downloads sind bislang ungeklärt.

The MALFEX-linked npm package imgdecode uses a Windows DLL to fetch and decrypt a GitHub payload before injecting it into ...

Hackers use malicious WhatsApp attachments to deploy VulcanRAT, gaining SYSTEM-level access to steal data and control Windows PCs.

Cisco Talos details UAT-11587, a China-linked group using the Antino backdoor and Microsoft 365 as cover to spy on Asian governments.

Citrix NetScaler CVE-2026-88772 is exploited in the wild and can enable remote code execution through a DTLS buffer overflow.

A single piece of attack code, quietly built to chain three unpatched flaws in Chrome and Windows, has ended up in the hands of at least four separate hacking crews within days of each other.

原创 最新推荐文章于 2026-07-22 15:45:51 发布 364 阅读 AI 写同款· GEO 优化 › 第一次接触CTF-PWN的选手看到shellcode这个词可能会觉得高大上，其实它就是一段能直接让CPU执行的机器码。想象你拿到一 ...

In December 2025, researchers uncovered a new cyber-espionage campaign attributed to APT37, also known as ScarCruft, Ruby Sleet, and Velvet Chollima. The operation, tracked as “Ruby Jumper,” ...

The report describes a multi-stage Windows intrusion chain that combines a concealed batch script, a PowerShell-based loader, and Donut-generated shellcode to stand up a persistent, memory-resident ...

A new offensive security tool developed in Rust is demonstrating a novel method for bypassing modern Endpoint Detection and Response (EDR) systems by exploiting an overlooked behavior in the Windows ...

Файл не сохраняется на диск, что значительно затрудняет анализ после факта заражения. Признаки принадлежности к APT37 включают временные метки файлов, например, 21 апреля 2025 года в 00:39:59 UTC, и ...

基于XOR加密的Shellcode加载器项目，通过内存解密执行实现基础免杀，包含C++加载器和Python加密脚本，可绕过常规静态检测。 本项目仅用于测试目的，禁止用于非法用途。 About 基于XOR加密的 ...