Adversary Simulation @SpecterOps - Opinions are my own
Italy
Joined December 2014
- Tweets1.1K
- Following734
- Followers9.6K
- Likes6.1K
Pinned Tweet
[RELEASE] Better late than never! Part 3 is out! Fantastic unwind information and where to find them. We went digging through .pdata, RTF Lookups, and a few ntdll internals that probably weren't meant to be touched. BYOUD dropping alongside. Enjoy 😉
klezvirus.github.io/posts/By…
klez retweeted
If you're into adversary simulation, identity security or red/blue tradecraft, bookmark this.
The team at @SpecterOps has built one of the best FREE security research archives online.
The rabbit hole covers:
- Active Directory + Kerberos
- Entra ID + Azure
- Okta + identity providers
- BloodHound + attack paths
- SCCM / Configuration Manager
- Red team tradecraft
- Detection engineering
- Lateral movement
- Credential access
- OAuth + token security
- Browser persistence
- AWS + cloud attack paths
- Kubernetes security
- Software supply chain attacks
- Adversary simulation
- Purple teaming
- Threat hunting
- AI-assisted offensive security
There is a ridiculous amount of deep technical material here, including research developed from real offensive and defensive operations.
They also now have FREE on-demand Tradecraft Academy courses covering BloodHound, Kubernetes for Red Teamers and software supply chain security.
Blog:
specterops.io/blog/
Free Tradecraft Academy:
academy.specterops.io/
Huge credit to the @SpecterOps team for publishing so much of this openly.
#RedTeam #ActiveDirectory #Infosec
klez retweeted
I started digging into Win32k callbacks while looking for a PatchGuard bypass. That lead went nowhere, but it raised a better question: how does the Windows kernel choose the callback for session-specific GUI work? idov31.github.io/posts/paint… 1/3
klez retweeted
Back from @MCTTP_Con where I talked about real-world banking fraud:
Citrix escape (like 10 years ago ^^), exposed payment keys, LPE through the SOC’s own tooling and a modified payment that made it through to bank execution 💰💸
I also dug into approval gaps and where VoP could fall short, with #TTPs and detection ideas throughout.
Thanks to everyone who joined the talk and the discussions afterwards + to the organisers for having me and sorting out Saturday at #Oktoberfest 🍻
... and for the kicker table / pool ( yep, I suck at it XD ) cc @KlezVirus @ShitSecure @IndiShell1046
klez retweeted
We escaped OpenAI's Codex sandbox by dumping V8's shared JavaScript heap and scanning it for the privileged UUID-shaped token belonging to the adjacent trusted V8 context.
I sometimes see cybersecurity as a never-ending cycle of building trust boundaries and finding ways to break them. This is the story of one interesting break.
When OpenAI built this default-enabled MCP server, they ran a trusted, privileged JS context alongside an untrusted one, in the same Node.js process.
They assumed V8's VM contexts could serve as a security boundary, because they do create isolated execution environments, each with its own distinct global object and scope.
But they forgot that these contexts share a single memory heap. So our untrusted code snapshotted that heap, pulled the token out of it, and used it to reach the privileged side.
Read the full technical breakdown at:
accomplish.ai/blog/escaping-…
[TALK] Tomorrow, Fabian and I will be presenting some of our latest research on device emulation and exploitation on Windows.
Come say hi if you’re around!
mcttp.de/2026-mosch-und-magn… – at Garching bei München, Deutschland
klez retweeted
For several months now I've been slowly, but surely, working behind the scenes to dramatically enhance vx-underground.
I still don't have a definitive timeline, but I would like to share some stuff coming.
1. All source code will be moved from GitHub to vx-underground. The new vx-underground will have functionality to search through code bases by keywords for research, filter by language type, yada yada yada.
2. Enhanced malware paper searching. It'll be easier to search for stuff now.
3. API access to verified individuals. This is designed for researchers, or organizations, who may want the ability to perform large downloads programmatically.
4. Paid tier. vx-underground will remain free for everyone. However, if you're an organization which makes more than $1,000,000/year you will have to pay for some functionality (malware sample API downloads). I will not charge thousands of dollars, I'm not greedy, but some of you large companies are jerks and need to pay up for scraping the site for AI and samples. API access will be free for individual researchers, small businesses, students, non-profits, and government institutions. Unfortunately, I've learned the hard way large for-profit organizations will not donate.
5. I've heard your complaints for YEARS. We are looking for a HTML-only vx-underground implementation, probably as a subdomain or something. I'm well aware you hardcore nerds hate JavaScript. I will continue investigating this.
6. We're working on our 4th book, Black Mass Volume IV.
I have more to announce, but some details are still up in the air. These changes likely won't appear until ... I don't know, bro. I've got a full time job and a family. I'm thinking probably late 2026, early 2027.
Thank you to our donors and sponsors that make this possible. I'm not as speedy as I used to be with updates, but I'm still cooking.
Cheers
-smelly
klez retweeted
I'm thrilled to make Silverseal public!. It is among the first publicly available UEFI bootkit research frameworks for Linux-based systems to demonstrate an end-to-end path from GRUB to a running Rust kernel-module rootkit: github.com/Idov31/Silverseal 1/3
klez retweeted
Totally agree, that's why I am planning to do this year's #FlareOn without using AI (unless there is a task where it's specifically required). The competitive side of the challenge may be dead, but we still can choose to have fun. Just like existence of a mountain lift doesn't have to kill the pleasure of climbing.
klez retweeted
>sam altman: "we tried this because there were rumor on the internet"
>rumor: math professor close to solving navier-stokes
>the professor: using codex for a year
>openai: has all his logs
>checked every codex session tagged to N-S
>found the most promising one
>spun up 10,000 agents to finish the proof where he couldn't
>they got caught
>told the guy if you say anything you'll destroy your own career
>he ruins his career over this
>openai: "we did not see his work"
>also openai: "we cannot rule out that de-identified data from their usage helped improve our models"
they stole it lmao
klez retweeted
Time to time I see #malware unpacking tutorials using #PEsieve and *incorrectly* stating that it doesn't rebuild import table and you need to use external tools to do so. In fact it is just a matter of a commandline argument: /imp - documented on Wiki: github.com/hasherezade/pe-si…
klez retweeted
Weekend project: I added IAKerb support to Rubeus. My god, this is going to open the floodgates.
Phase 2 of Microsoft's NTLM deprecation is targeted for H2 2026. IAKerb ships for Server 2025 / Win11 24H2 and is already on by default in the June Canary preview. It proxies Kerberos auth through exposed services via SSPI when a client can't directly reach a KDC.
Which means anonymous user enum via AP-REQs with no preauth (zero telemetry), kerberoasting over the open internet, Entra lateral movement through AZUREADSSO tickets and more. All against public facing services.
Blog post soon with potential abuse vectors.
klez retweeted
About a year ago I built GhostDebug, an x64 VEH-based Windows debugger designed to bypass common debugger-detection checks by avoiding the normal Win32 debugging APIs.
Check it out here:
Blogpost: vollragm.github.io/posts/dev…
GitHub: github.com/VollRagm/ghostdeb…
klez retweeted
CVE-2026-34348 exploitation demo from my #BHUSA "Pass-the-Passkey Family of Attacks" talk: WebAuthn assertion from recent YubiKey authentication is extracted from Windows Event Log and replayed against Microsoft Entra ID using Passkey Injector.
Whitepaper: specterops.io/passkeys
klez retweeted
‼️ BREAKING: Journalists hid an Airtag in a rare book shipment and confirmed Amazon to be one of the buyers behind the bulk orders destroying rare-books to feed their AI.
They tracked it to Amazon's LAS8 warehouse in Las Vegas, home to VGT3 (see logo below), a scanning operation feeding Amazon's AI training data, where workers say they cut the bindings off books to scan them faster.
Amazon won't say why the books are destroyed.
klez retweeted
ETW is one of the richest telemetry sources on Windows, and one of the easiest to get lost in. This is why I made a video that follows that path - from ETW internals to a practical workflow with EtwSuite. 1/2
idov31.github.io/posts/insid…
klez retweeted
The slides from my Blackhat USA 2026 presentation "Beam Me Up Luke: A Review of Teleport Attack Scenarios" are now available #BHUSA i.blackhat.com/BH-USA-26/Pre…
klez retweeted
The first major update to my UDRL and Sleepmask Dev course is now live (and free for existing students)! A lot of work and novel research is included in four additional lessons, the details of which can be found in the comments below🙂
Course page: zeropointsecurity.co.uk/cour…
klez retweeted
I'm currently in the crunch phase preparing for Defcon and this time BlackHat to showcase the latest feature of OctoPwn, automation workflows for internal pentest! Here is a little video we put together to show how it works, enjoy!
youtube.com/watch?v=SUp-YJ9s…
[TALK] My latest Black Hat Europe talk is now publicly available. If you can look past the painfully obvious anxiety and a speaker who occasionally sounds like his brain has stopped cooperating, you might find something useful. Who knows?
youtube.com/watch?v=tOVcScKu…