Scheiße auf der Tastatur retweeted
Beyond PEB Walking: Alternative Ways to Find DLL Base Addresses and Resolve Functions at Runtime blog.jaytiwari.me/posts/Beyo…
Scheiße auf der Tastatur retweeted
Chinese Backdoor for Telecom Systems
A while ago we showed the backdoor that the Chinese have been using to maintain persistence across telecom systems.
The backdoor attaches itself to a raw network socket and inspects incoming traffic. It sees packets before firewall rules have a chance to process them. So even if your firewall is configured correctly, the backdoor can still see traffic that should have been blocked.
To access the system hackers send a magic byte to get a reverse shell. Our demonstration shows the primitive mechanism of how it worked.
We also showed how you can detect it!
hackers-arise.com/compromisi…
@three_cube @_aircorridor
Scheiße auf der Tastatur retweeted
My TikTok FYP daily: pew pew map 💥 "Malaysia kena hack!!". But what can you actually do with it? Nothing 🙃
Sophisticated Threat Actors? Leave it to the gov & authorities. We do our part become cyber kebal, 5 mins a day 🐾 Free, no sign-up, BM + English
cyberkebal.rectifyq.com
Scheiße auf der Tastatur retweeted
Inside ARTEX: AI Hacking Tools, Exposed Servers and South Korean Bank Breaches securityaffairs.com/202607/a…
1. Reverse-Engineering and Malware Analysis
2. Malware Analysis – Dridex & Process Hollowing
(The goal is to extract the payload that is used during the process hollowing technique.)
3. Malware Analysis – Dridex Loader – Part I, Part 2
countuponsecurity.com/2015/1…
🚨 BREAKING:
HACKERS ARE TURNING WHATSAPP INTO A MALWARE DISTRIBUTION NETWORK ACROSS MULTIPLE COUNTRIES.
A dangerous cyberattack campaign is targeting WhatsApp users, disguising malware as legitimate financial documents, invoices, bank statements, and business files.
And there’s a disturbing twist: the messages can come from people you already know.
Here’s what we know:
🇲🇾 MALAYSIA
• October 29: MyCERT confirmed an active malware campaign distributing malicious ZIP attachments through WhatsApp.
• Files impersonate invoices, account statements, e-statements, and payment documents.
• Messages come from potentially compromised contacts or fake business identities.
• The malware can install remote-access backdoors on Windows computers.
🇸🇬 SINGAPORE
• October 28: SingCERT issued an official advisory after receiving multiple reports of malware campaigns spreading through compromised WhatsApp accounts.
• November 2: Singapore Police issued another warning about malicious attachments disguised as business documents.
• Hackers can steal credentials, record keystrokes, capture screenshots, and compromise WhatsApp accounts.
🌍 OTHER COUNTRIES IDENTIFIED
Kaspersky’s June 22 research identified victims across multiple countries and territories, including:
🇲🇾 Malaysia
🇧🇷 Brazil
🇸🇬 Singapore
🇹🇼 Taiwan
🇻🇳 Vietnam
Malaysia had the highest number of observed victims in that particular campaign.
HOW THE ATTACK WORKS:
Hackers compromise a WhatsApp account.
They send malicious ZIP, ISO, or disguised document files to existing contacts.
Victims are instructed to open or extract the files on a Windows computer.
Running the malicious program installs malware or a remote-access backdoor.
Hackers can steal sensitive information and use compromised accounts to spread the malware further.
⚠️ PROTECT YOURSELF:
• Never open unexpected ZIP, RAR, ISO, or EXE attachments.
• Verify suspicious files directly with the sender through a phone call.
• Enable WhatsApp Two-Step Verification.
• Check your Linked Devices regularly.
• Never share your WhatsApp verification code or PIN.
IMPORTANT: These are documented campaigns from different reporting periods, not proof that all five countries are experiencing the exact same attack simultaneously.
Your WhatsApp contact list could become the next distribution channel.
DON’T TRUST AN ATTACHMENT JUST BECAUSE IT COMES FROM SOMEONE YOU KNOW.
Stay alert. Stay protected.
Scheiße auf der Tastatur retweeted
How to Detect Which User Installed or Removed a Program on Windows using Event Viewer and PowerShell
woshub.com/who-installed-rem…
Scheiße auf der Tastatur retweeted
Backdooring Installers with DFMI
DFMI can embed malicious payloads into Windows software installers while keeping them fully functional.
hackers-arise.com/offensive-…
@three_cube @_aircorridor
SilverFox is super heavily active in Malaysia (they use email and WhatsApp for distribution) and is now using an undocumented RAT called TankRAT as the final payload. Further pivoting using the title "TankRat 登录" in Censys, FOFA, and Validin revealed another 33 hosts.
Scheiße auf der Tastatur retweeted
Using the Windows Hypervisor Platform API to execute shellcode in an isolated vCPU, bypassing process memory scanning
WHvCreatePartition → WHvSetupPartition → WHvMapGpaRange → WHvCreateVirtualProcessor → WHvSetVirtualProcessorRegisters → WHvRunVirtualProcessor
Scheiße auf der Tastatur retweeted
Pass-ta-key Golden Attack: Extracting the Security Domain Secret from Chrome process memory
Blog:
0rcruxe.github.io/posts/pass…
POC:
github.com/0rcruxe/pass-ta-k…
Part 2:
0rcruxe.github.io/posts/pass…
Decrypting GPM Passkeys & Forging WebAuthn Assertions for Account Takeover
✍️: 0rcruxe
Introduction to Windows shellcode development securitycafe series:-
Part 1:- securitycafe.ro/2015/10/30/i…
Part 2:- securitycafe.ro/2015/12/14/i…
Part 3:- securitycafe.ro/2016/02/15/i…
Scheiße auf der Tastatur retweeted
📢 Ransomware Alert 🇲🇾
Digital Triumph Sdn Bhd, a Malaysia-based Network & Telecommunications company, has reportedly fallen victim to n0n ransomware.
NB: The group intends to publish the data within 3-4 days.
🔍 Key Details:
🛡️ Threat Actor: n0n
📅 Reported on: 31/10/2026































