@MatheuzSecurity

Red Team Operator, Cyber Threat Intelligence, Malware Researcher

 Brazil
github.com/MatheuZSecurity
Joined September 2020
  • Tweets761
  • Following374
  • Followers2.8K
70Media
github.com/MatheuZSecurity/U… Hey guys, I posted a really cool zine in pure TXT about Unhooking Linux EDR, attacking the cleanup_module function, to be able to remove any hook from an EDR for example. Feel free to read.
5
47
180
16,089
MatheuZ retweeted
LOUD 🇧🇷
@LOUDggOct 18
WE DID IT
207
6,658
564
31,942
532,751
MatheuZ retweeted
LOUD 🇧🇷
@LOUDggOct 18
Esse título também é seu. 💚
3,456
18,886
1,312
156,274
4,556,049
Mission accomplished. I'll post my full talk on Linux malware tactics and evolution when I return (no video allowed at the conference). Thanks to all that attended and the conference organizers for having me!
2
1
32
1,018
Casa hora fica pior, não sei como vocês votam num cara desses!!!!!
4
4
1
156
3,615
Hello Unfortunately, @GitHub has banned us. They have orbital nuked the entire malware source code collection.
376
611
86
15,923
791,270
❌ 🇧🇷 Manoel Gomes, o "Caneta Azul", fica de fora e NÃO É ELEITO deputado federal por São Paulo.
609
706
666
15,057
390,715
Singularity LKM rootkit evading LiME and Volatility 3 My rootkit hooks walk_system_ram_res so LiME never copies its physical pages and vol3 found nothing CheckFtrace crashes on a poisoned page and pstree, psscan, pslist all come back empty for hidden proc. hidden_modules too.
1
10
57
2,129
Singularity LKM rootkit evading LiME and Volatility 3 My rootkit hooks walk_system_ram_res so LiME never copies its physical pages and vol3 found nothing CheckFtrace crashes on a poisoned page and pstree, psscan, pslist all come back empty for hidden proc. hidden_modules too.
1
10
57
2,129
github.com/MatheuZSecurity/S…

GitHub - MatheuZSecurity/Singularity: Stealthy Linux Kernel Rootkit

Stealthy Linux Kernel Rootkit. Contribute to MatheuZSecurity/Singularity development by creating an account on GitHub.

github.com
1
4
242
New issues of @phrack have arrived just in time for the conference!!
14
130
5,743
Fileless ELF execution via the Linux kernel keyring Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere. matheuzsecurity.github.io/ha… #fileless #malware #linux #keyring

Fileless ELF Execution via Kernel Keyring · 0xMatheuZ

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

matheuzsecurity.github.io
4
45
3
167
13,809
Another cool addition to fileless hiding on Linux. This one using an interesting kernel keyring vector. @SandflySecurity still sees the deleted process, but standard memfd traces are missing. Give @MatheuzSecurity a follow.
MatheuZ@MatheuzSecuritySep 9
Fileless ELF execution via the Linux kernel keyring Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere. matheuzsecurity.github.io/ha… #fileless #malware #linux #keyring

Fileless ELF Execution via Kernel Keyring · 0xMatheuZ

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

matheuzsecurity.github.io
6
52
3,511
Fileless ELF execution via the Linux kernel keyring Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere. matheuzsecurity.github.io/ha… #fileless #malware #linux #keyring

Fileless ELF Execution via Kernel Keyring · 0xMatheuZ

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

matheuzsecurity.github.io
4
45
3
167
13,809
Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19. matheuzsecurity.github.io/ha… #linux #redteam #edr #fileless #kernel

Fileless ELF Execution via O_TMPFILE · 0xMatheuZ

O_TMPFILE creates anonymous inodes on real filesystems with no directory entry. Combine it with execveat(AT_EMPTY_PATH) and you get fileless ELF execution that looks nothing like memfd_create in …

matheuzsecurity.github.io
2
44
1
142
10,066
This is a very cool way to do fileless loading on Linux bypassing traditional memfd. I hope he doesn't mind, but we detect this out of the box already. Here is a fileless backdoor loaded with his tool. @MatheuzSecurity always does great work and you should follow him. Black boxes below are special surprises we have coming in Sandfly 6.0. Stay tuned.
MatheuZ@MatheuzSecuritySep 7
Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19. matheuzsecurity.github.io/ha… #linux #redteam #edr #fileless #kernel

Fileless ELF Execution via O_TMPFILE · 0xMatheuZ

O_TMPFILE creates anonymous inodes on real filesystems with no directory entry. Combine it with execveat(AT_EMPTY_PATH) and you get fileless ELF execution that looks nothing like memfd_create in …

matheuzsecurity.github.io
5
30
2,666
Microsoft has failed to properly patch ShieldBreak CVE-2026-69414 - msrc.microsoft.com/update-gu… ShieldCrash demonstrates a full bypass of the patch - github.com/MSNightmare/Shiel… Works with latest September 2026 patch
Abdelhamid Naceri@MSNightmare2000Aug 11
Microsoft has failed to properly patch RoguePlanet (CVE-2026-50656), ShieldBreak, a PoC that demonstrates a full bypass to the previous patch is now public. github.com/MSNightmare/Shiel… The PoC works with the latest August 2026 patch
21
186
11
1,095
68,761
MatheuZ retweeted
Phrack Zine@phrackSep 7
Sneak peek 👀 👀 👀 👀 Coming soon from your friends at Phrack!
4
42
2
213
7,732
New, stealthy (no memfd_create-based) way for Linux Fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). Great stuff from @MatheuzSecurity as always! To keep the hamster wheel spinning :> (#Linux #redteam vs #blueteam), I tried to detect/block this behaviour via hooking into execveat() using the Tetragon Runtime Security Engine. The detection trigger/primitive is, in this case, 4096/0x1000/AT_EMPTY_PATH. Another policy added to my SHIELD Tetra collection, which already contains almost 130 validated policies. In the screenshot, in combination with darkcloak, for which I have a separate set of tracing policies. Links to the projects: - Dntry - Fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH): github.com/MatheuZSecurity/D… - DARKCLOAK - Linux process identity cloaking: github.com/0x574R/Darkcloak
3
17
1
122
5,915
Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19. matheuzsecurity.github.io/ha… #linux #redteam #edr #fileless #kernel

Fileless ELF Execution via O_TMPFILE · 0xMatheuZ

O_TMPFILE creates anonymous inodes on real filesystems with no directory entry. Combine it with execveat(AT_EMPTY_PATH) and you get fileless ELF execution that looks nothing like memfd_create in …

matheuzsecurity.github.io
2
44
1
142
10,066
3
1
51
2,979
Load more