Pinned Tweet
Introducing Cyllex - Advanced APT Emulation Framework.
cyllex.io/
I've been working on this for a while, pouring real effort and love into it. Not a quick release, I'm going step by step, building something solid. Some of the current features include:
▸ APT database with real-world campaign emulation
▸ Cross-platform agents via binary patching
▸ Agent, Agentless (WinRM/SSH), and Cloud execution
▸ Direct shell access for real-time interaction
▸ Interactive MITRE ATT&CK detection coverage tracking
▸ Calendar-based campaign scheduling
▸ Webhook notifications (Slack, Teams...)
▸ Robust TTPs: On-Premise (Windows/Linux), Cloud, and Containers
I'll be sharing updates as the project evolves. Thank you, and happy new year!
_Ray retweeted
I used Opus 5.5 on max and GPT-6 Astra for 5 days straight and I reversed engineered Elastic Security and extracted all the rules. I made them available here:
github.com/elastic/detection…
You’re welcome.
_Ray retweeted
This is a really interesting APT tradecraft write-up.
Cisco Talos uncovered UAT-11587, a China-nexus activity cluster targeting government and policy organizations across Asia with a previously undocumented Rust backdoor called Antino.
The interesting part: its native C2 runs entirely through Microsoft 365.
• Outlook + OneDrive used as dead drops
• Microsoft Graph for C2
• Shell + PowerShell execution
• File upload/download
• In-memory shellcode execution
• Persistence
• 5-stage infection chain
• Cloudflare infrastructure for staging + tracking
• ~350 compromised endpoints across 8 countries observed
Talos also documented tailored spear-phishing, fake Gmail attachment widgets and government/policy-themed decoys.
Excellent research by @CiscoTalos / @ashl3y_shen .
blog.talosintelligence.com/c…
#MalwareAnalysis #ThreatIntel #Infosec
_Ray retweeted
Released cldap_ping.py: AD user enum over real UDP cLDAP, plus anonymous rootDSE recon over TCP.
cLDAP tooling commonly runs the ping over TCP, which Event 5156 catches. Sending it over UDP leaves only netlogon.log (per Part 6). 😈
github.com/4ndr3w6/cldap_pin…
_Ray retweeted
InjectSetConsole - Performs process code injection by leveraging a Windows named pipe. Unlike traditional techniques, it does not use the:
✅ VirtualAllocEx &
✅ WriteProcessMemory APIs
github.com/TwoSevenOneT/Inje…
_Ray retweeted
4 unmitigated/unpatched "App Control for Business" (WDAC) bypasses in the list.
Are we even trying anymore?
github.com/bohops/UltimateWD…
_Ray retweeted
New Release Havoc Professional 0.8: Leviathan 🩸
- Introducing Kaine User-Defined C2
- Expanded Linux post-ex capabilities
- Refactored port forwarding and sleep masking
- Enhanced .NET/PowerSafe execution
- In-Memory PE Execution and BOF-PE support
- HTTP/s Server Name Indication (SNI) Spoofing
- License Updates / Air-gapped licensing
- Havoc client UI overhaul & cross-platform support
Release Link Below🔗
_Ray retweeted
When I started ipurple.team/ two years ago, my goal was to give SOC teams practical detection opportunities across some of the most modern adversarial techniques.
So far, I’ve documented 25 techniques, and every article includes:
✅ SIGMA Rules
✅ Sysmon Configs
✅ Threat Hunting Queries
If you work in Purple Teaming, Detection Engineering, Threat Hunting, or even the Red Team space, and you want your MITRE ATT&CK coverage to look like the example below, dive into the articles, start emulating, and begin hunting.
If you know that someone else in your network will benefit, feel free to repost.
_Ray retweeted
New writeup: Patch-Gap Zero-Days: BlueMoon.
Five China-nexus clusters chained two V8 patch-gap bugs (CVE-2026-85046, CVE-2026-87491) to one Windows ALPC LPE zero-day (CVE-2026-85880) against Chrome on Windows.
cyllex.io/blog/posts/bluemoo…
_Ray retweeted
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈
Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses.
🌐 Browser-based cracking
⌨️ Cross-platform CLI with GPU/CPU support
💾 Searchable tables that fit on a 4 TB disk
Read the blog: outflank.nl/blog/2026/09/08/…
_Ray retweeted
Weekend project: I added IAKerb support to Rubeus. My god, this is going to open the floodgates.
Phase 2 of Microsoft's NTLM deprecation is targeted for H2 2026. IAKerb ships for Server 2025 / Win11 24H2 and is already on by default in the June Canary preview. It proxies Kerberos auth through exposed services via SSPI when a client can't directly reach a KDC.
Which means anonymous user enum via AP-REQs with no preauth (zero telemetry), kerberoasting over the open internet, Entra lateral movement through AZUREADSSO tickets and more. All against public facing services.
Blog post soon with potential abuse vectors.
_Ray retweeted
Introducing SpecterOps Skills: a public repository built to turn practitioner knowledge into reusable, reviewable workflows for AI-assisted security work.
@zinic shares what we're building, why we're building it, and how you can contribute ➡️ ghst.ly/4ybT6ew
_Ray retweeted
New on the blog: how Lazarus went from a fake job offer to ring 0 with a Windows kernel 0-day (CVE-2026-68820) and the FudModule 3.1 rootkit.
cyllex.io/blog/posts/lazarus…
_Ray retweeted
FalconFlank : Crowdstrike Falcon 0day LPE is now public
github.com/MSNightmare/Falco…
_Ray retweeted
CrystalPotato is a Crystal port of GodPotato with indirect syscalls, dynamic API resolution and compile-time string obfuscation github.com/ricardojoserf/Cry…
_Ray retweeted
You don't need a USB. You need to look like one.
Emulate the device, Windows fetches a signed package off Windows Update and runs vendor code as SYSTEM. Arbitrary code execution, LPE, standard user or empty logon screen.
DEF CON 34 talk w/ @Qm9yamFN.
Link at the first comment.
_Ray retweeted
I just wrote a post for @AdeptsOf0xCC! Yes, we are live again! 🦉
In this post I RE a sound protocol (yes soundwaves!) used by Eufy and also we recover and decrypt wifi credentials from its flash memory.
From your doorbell to your home network => adepts.of0x.cc/eufy-doorbell…