Hyperion Gray (@HyperionGray) header
Hyperion Gray (@HyperionGray) profile picture

Hyperion Gray

@HyperionGray

Software & Security Research, Penetration Testing, Ethical Hacker Education

 Concord, NC
hyperiongray.com
Joined January 2013
  • Tweets295
  • Following4.1K
  • Followers4.6K
15Media
Photo by Hyperion Gray (@HyperionGray)Photo by Hyperion Gray (@HyperionGray)Photo by Hyperion Gray (@HyperionGray)Photo by Hyperion Gray (@HyperionGray)Photo by Hyperion Gray (@HyperionGray)Photo by Hyperion Gray (@HyperionGray)Photo by Hyperion Gray (@HyperionGray)Photo by Hyperion Gray (@HyperionGray)Photo by Hyperion Gray (@HyperionGray)Photo by Hyperion Gray (@HyperionGray)
Happy Monday to all researchers. We hope you have a very successful week of hunting and programming. Should you want to sell any technologies don't hesitate to contact us.
1
3
Expectation: I'll use GraphViz to plot this callgraph and it will make the structure perfectly clear Reality:
Image from Brendan Dolan-Gavitt (@moyix)
55
212
32
1,590
We are firm believers that researchers should get the money they deserve for the research they conduct. It takes time and effort. Zero Security prides itself on helping people from all over the world. We are currently accepting new clients to represent as we continue to expand
1
1
3
Chainlink is a Russian pump-and-dump fraud. Until when are such fraudulent activities going to happen under @SEC_Enforcement @SEC_News watch? Protect the American people from Russian fraudsters! @coinbase why are you tolerating this scam on your platform? @brian_armstrong $LINK
Image from Zeus Capital (@ZeusCapitalLLP)
297
210
59
985
The Spectre Rootkit is now released alongside my @BlackHatEvents USA talk, Demystifying Modern Windows Rootkits. Go check it out! github.com/d4stiny/spectre
GitHub - D4stiny/spectre: A Windows kernel-mode rootkit that abuses legitimate communication...

GitHub - D4stiny/spectre: A Windows kernel-mode rootkit that abuses legitimate communication...

A Windows kernel-mode rootkit that abuses legitimate communication channels to control a machine. - D4stiny/spectre

github.com
4
242
4
511
Hyperion Gray retweeted
3xp0rt (@3xp0rtblog) profile picture
3xp0rt
@3xp0rtblog6 Aug 2020
Cerberus Bot v2 source can leak to the criminal forum xss[.]is, source code already available for the admin of the forum. The seller looked for a guy who can manage the project but doesn't found. Cerberus Bot selling has been closed because no way to manage a project.
Image from 3xp0rt (@3xp0rtblog)
Image from 3xp0rt (@3xp0rtblog)
4
15
1
37
Hyperion Gray retweeted
Danus (@danusminimus) profile picture
Danus@danusminimus24 Jul 2020
I've been taking a huge interest in APTs recently and Threat Intelligence in general and I found this paper called "A Threat Actor Encyclopedia" by @ThaiCERT and it's fire! 🔥 thaicert.or.th/downloads/fil…
1
11
34
Hyperion Gray retweeted
Axel Souchet (@0vercl0k) profile picture
Axel Souchet@0vercl0k19 Jul 2020
If you need to debug a Linux kernel Hyper-V guest check out github.com/weltling/convey. Allows you to kernel debug the guest from WSL on the host which is neat.
Image from Axel Souchet (@0vercl0k)
2
80
4
265
OPSEC Fail! Iranian #APT35 hackers accidentally exposed 40 GB worth of sensitive data online, containing #hacking training videos that revealed they managed to hack a member of the U.S. Navy, and a Greek naval officer. Read Details — thehackernews.com/2020/07/ir… #cybersecurity
Iranian Hackers Accidentally Exposed Their Training Videos (40 GB) Online

Iranian Hackers Accidentally Exposed Their Training Videos (40 GB) Online

An Iranian state-sponsored hacking group accidentally exposed roughly 40 GB of hacking training videos on the Internet.

thehackernews.com
3
22
2
37
Hyperion Gray retweeted
Forrest Orr (@_ForrestOrr) profile picture
Forrest Orr
@_ForrestOrr16 Jul 2020
My new research and open source memory scanner tool Moneta dives deep into the topic of memory stealth and forensics when designing malware or fine tuning detection for it. Many should find this information valuable forrest-orr.net/post/masking…
Masking Malicious Memory Artifacts – Part II: Blending in with False Positives

Masking Malicious Memory Artifacts – Part II: Blending in with False Positives

IntroductionWith fileless malware becoming a ubiquitous feature of most modern Red Teams, knowledge in the domain of memory stealth and detection is becoming an increasingly valuable skill to add to...

forrest-orr.net
4
91
5
187
OK, we talked to another hacker. Were able to confirm how they got accounts: Twitter employee used internal tool to change email addresses associated with accounts. Twitter seems to have just confirmed this in tweets as well vice.com/en_us/article/jgxd3…
56
923
177
1,471
Hyperion Gray retweeted
j00ru//vx (@j00ru) profile picture
j00ru//vx@j00ru16 Jul 2020
At last, the series begins: MMS Exploit Part 1: Introduction to the Samsung Qmage Codec and Remote Attack Surface. googleprojectzero.blogspot.c… I'm excited to start sharing more about this work, starting with a deep dive into the internals and history of the codec.
MMS Exploit Part 1: Introduction to the Samsung Qmage Codec and Remote Attack Surface

MMS Exploit Part 1: Introduction to the Samsung Qmage Codec and Remote Attack Surface

Posted by Mateusz Jurczyk, Project ZeroThis post is the first of a multi-part series capturing my...

projectzero.google
3
218
6
437
Hyperion Gray retweeted
iFenix (@dlymension) profile picture
iFenix@dlymension16 Jul 2020
tfp0 on iOS 13.6 - by @_simo36
Image from iFenix (@dlymension)
16
53
2
333
From @FireEye : Financially Motivated Actors Are Expanding Access Into OT ~Attackers are getting more and more comfortable in our industrial spaces. fireeye.com/blog/threat-rese…
1
9
2
23
Hyperion Gray retweeted
Aviad Shamriz (@SHA_MRIZ) profile picture
Aviad Shamriz@SHA_MRIZ11 Jul 2020
This is my first part of a series about hooking minifilter/miniport. In this research I focus on Fs Minifilter hooking: link.medium.com/m93AktZk27
2
89
2
177
People usually don't pay attention to thread synchronization techniques (user mode or with kernel objects), but it could be interesting to analyze details, mainly when malware uses these techniques to synchronize malicious threads or two stages of unpacking. #malware #reversing
Image from Alexandre Borges (@ale_sp_brazil)
1
31
103
Hyperion Gray retweeted
Stefan Esser (@i0n1c) profile picture
Stefan Esser@i0n1c6 Jul 2020
Adding ARMv8.5 Memory Tagging Extension #MTE Opcodes to IDA for #iPhone12 support github.com/Antid0teCom/aarch… (Please test and report all bugs. This is a quick hack and only partially tested and likely full of bugs)
Image from Stefan Esser (@i0n1c)
2
24
1
85
Hyperion Gray retweeted
Ace Pace (@ace__pace) profile picture
Ace Pace@ace__pace6 Jul 2020
Somewhere between 19042 and 20161, Windows added a DNS interception capability for...EDR software? It's undocumented. And Microsoft needs to sign off on the binary to be loaded The DnsInterceptionOnQueryEvent export is called DNS resolving ends.
Image from Ace Pace (@ace__pace)
Image from Ace Pace (@ace__pace)
4
103
6
257
I have recompiled netcat for Win to be compatible with Donut. The precompiled version doesn't have the reloc section. It could be useful if you want to load it directly in memory converting it in shellcode :D antoniococo.github.io/tools/…
1
40
1
80
Hyperion Gray retweeted
Ling (@ling_sec) profile picture
Ling@ling_sec4 Jul 2020
Published a new blog post detailing the inner workings of hardware breakpoints and exception handling on Windows. Let me know what you think. ling.re/hardware-breakpoints…

Hardware breakpoints and exceptions on Windows

Hardware breakpoints on Windows and common detection vectors

ling.re
3
71
3
154
Load more