_Ray retweeted
Congrats to @killa who solved stealmybitcoin.com hours ago but I screwed up which key went on the server (the flag was a root wallet WIF instead of the branch WIF).
Check out their awesome writeup here: github.com/KillaBoi/StealMyB…
_Ray retweeted
New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇
ghst.ly/3VSdm7h
1/2
LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.
Patched in October.
Blog: specterops.io/blog/2026/10/2…
PoC: github.com/grayhatkiller/swi…
_Ray retweeted
Microsoft patched PetitPotam in their latest update, EFSRPC now validates shares locally, killing WebDAV coercion
💀
Added a check to NetExec’s enum_cve module to detect if a host already has the fix (CVE-2026-102217), so you can quickly spot what’s still exploitable 🔥
_Ray retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
_Ray retweeted
APT Encyclopedia updated: every claim in the 62 profiles checked against its source, wrong citations fixed or removed, all changes logged. Work continues on the extraction agents so only claims a primary source supports make it in.
cyllex.io/encyclopedia/?v=1
The only additional cost is your own AWS usage, which depends on how heavily you run the lab (spinning it up from the WKL dashboard is straightforward, and costs stay low as long as you shut the machines down when you’re not using them)
I recently completed the ODPC, and I think the material is really good. The exam was a great experience too. Having to face four EDRs, along with additional objectives such as applying different techniques to each one, was genuinely interesting.
_Ray retweeted
I used Opus 5.5 on max and GPT-6 Astra for 5 days straight and I reversed engineered Elastic Security and extracted all the rules. I made them available here:
github.com/elastic/detection…
You’re welcome.
_Ray retweeted
This is a really interesting APT tradecraft write-up.
Cisco Talos uncovered UAT-11587, a China-nexus activity cluster targeting government and policy organizations across Asia with a previously undocumented Rust backdoor called Antino.
The interesting part: its native C2 runs entirely through Microsoft 365.
• Outlook + OneDrive used as dead drops
• Microsoft Graph for C2
• Shell + PowerShell execution
• File upload/download
• In-memory shellcode execution
• Persistence
• 5-stage infection chain
• Cloudflare infrastructure for staging + tracking
• ~350 compromised endpoints across 8 countries observed
Talos also documented tailored spear-phishing, fake Gmail attachment widgets and government/policy-themed decoys.
Excellent research by @CiscoTalos / @ashl3y_shen .
blog.talosintelligence.com/c…
#MalwareAnalysis #ThreatIntel #Infosec
_Ray retweeted
Released cldap_ping.py: AD user enum over real UDP cLDAP, plus anonymous rootDSE recon over TCP.
cLDAP tooling commonly runs the ping over TCP, which Event 5156 catches. Sending it over UDP leaves only netlogon.log (per Part 6). 😈
github.com/4ndr3w6/cldap_pin…
_Ray retweeted
InjectSetConsole - Performs process code injection by leveraging a Windows named pipe. Unlike traditional techniques, it does not use the:
✅ VirtualAllocEx &
✅ WriteProcessMemory APIs
github.com/TwoSevenOneT/Inje…
