Low Level CO 🎄 – Telegram
Low Level CO 🎄
@ZwLowLevel
110 subscribers
149 photos
7 videos
7 files
465 links
Canal enfocado en la investigación de técnicas de seguridad ofensivas avanzadas.

✅ Windows internals
✅ Malware Development
✅ Exploits
✅ Reversing
✅ Low level programming
✅ kernel-mode and user-mode
✅ Syscall
✅ Ring 0, 3, hypervisors (ring -1)
✅ Firmware
Download Telegram
About
Blog
Apps
Platform
Join
Low Level CO 🎄
110 subscribers
Low Level CO 🎄
How I Reverse Engineered a Rust Botnet and Built a C2 Honeypot to Monitor Its Targets

#malware_analysis
@ZwLowLevel
Medium
How I Reverse Engineered a Rust Botnet and Built a C2 Honeypot to Monitor Its Targets
During routine threat hunting on my Beelzebub honeypot, I captured something unusual: a Rust-based DDoS bot with zero detections across all…
28 viewsGolden Byte, 
Low Level CO 🎄
Privacy-Preserving Vaccination Checks: A Proof of Concept MPC Deployment with the Frankfurt Health Department

#security
#cryptography

@ZwLowLevel
https://sine.foundation/library/mpc-vaccination-check
28 viewsGolden Byte, 
Low Level CO 🎄
Function Identification in ESP32 Firmware Using Ghidra FIDB

#reverse_engineering
#reversing
#firmware_analysis

@ZwLowLevel
https://www.tarlogic.com/blog/esp32-firmware-using-ghidra-fidb/
Tarlogic Security
Function Identification in ESP32 Firmware Using Ghidra FIDB
Learn how to reverse engineer ESP32 firmware faster using Ghidra FIDB and ESP-IDF to automate function identification
27 viewsGolden Byte, 
Low Level CO 🎄
cubebox os Series' Articles

#os_internals
#ring0
#ring_0

@ZwLowLevel
https://dev.to/vhajsman/series/32390
DEV Community
cubebox os Series' Articles
View cubebox os Series' Articles on DEV Community
27 viewsGolden Byte, 
Low Level CO 🎄
Dissecting a Multi-Stage macOS Infostealer

#malware_analysis
#malware
#macos
@ZwLowLevel
Rhys Downing
Dissecting a Multi-Stage macOS Infostealer
Deep dive into MacSync Stealer (UserSyncWorker variant), a MaaS infostealer featuring Gatekeeper bypass via notarized Swift dropper, code signature validation, and multi-layer payload obfuscation
27 viewsGolden Byte, 
Low Level CO 🎄
The Linux kernel is just a program

#linux_kernel
#linux_internals
#ring_0

@ZwLowLevel
https://serversfor.dev/linux-inside-out/the-linux-kernel-is-just-a-program/
26 viewsGolden Byte, 
Low Level CO 🎄
Cobalt Strike, a Defender's Guide

#soc
#soc_analyst
#vulnerability_manager
@ZwLowLevel
Kostas T. Security Research
Cobalt Strike, a Defender's Guide
A comprehensive guide to understanding and defending against Cobalt Strike, one of the most commonly observed tools used by threat actors. This deep dive covers the TTPs and detection strategies.
25 viewsGolden Byte, 
Low Level CO 🎄
🔥1
23 viewsGolden Byte, 
Low Level CO 🎄
🔥1
25 viewsGolden Byte, 
Low Level CO 🎄
Silver Fox Targeting India Using Tax Themed Phishing Lures

#malware_analysis
#malware_spreading
#malware_campaing
@ZwLowLevel
Cloudsek
Silver Fox Targeting India Using Tax Themed Phishing Lures | CloudSEK
CloudSEK's TRIAD reveals a critical campaign by the Chinese "Silver Fox" APT targeting Indian entities with authentic-looking Income Tax phishing lures. While previously misattributed to SideWinder, this sophisticated attack leverages a complex kill chain…
29 viewsGolden Byte, 
Low Level CO 🎄
The COM: Anatomy of an English-Speaking Cybercriminal Ecosystem And The Origins of Scattered Lapsus$ Hunters

#cyber_threat_intelligence
#cti
#threat_hunting
@ZwLowLevel
Cloudsek
The COM: Anatomy of an English-Speaking Cybercriminal Ecosystem And The Origins of Scattered Lapsus$ Hunters | CloudSEK
Over the past decade, the English-speaking cybercriminal ecosystem commonly referred to as “The COM” has undergone a profound transformation. What began as a niche subculture centered on the trading of what is called “OG Usernames (original gangster)”
29 viewsGolden Byte, 
Low Level CO 🎄
DumpChromeSecrets

Extract data from modern Chrome versions, including refresh tokens, cookies, saved credentials, autofill data, browsing history, and bookmarks.

#offensive_tool
#red_team
@ZwLowLevel
28 viewsGolden Byte, 
Low Level CO 🎄
Fake Leonardo DiCaprio Movie Torrent Drops Agent Tesla Through Layered PowerShell Chain

#malware_spreading
#malware_campaing
#malware_analysis

@ZwLowLevel
https://www.bitdefender.com/en-us/blog/labs/fake-leonardo-dicaprio-movie-torrent-agent-tesla-powershell
Bitdefender Labs
Fake Leonardo DiCaprio Movie Torrent Drops Agent Tesla Through Layered PowerShell Chain
Bitdefender researchers investigate a complex infection chain embedded in a fake movie torrent for One Battle After Another.
23 viewsGolden Byte, 
Low Level CO 🎄
Reverse Engineering a TP-Link Router: Getting Root Access via UART Protocol

#firmware_analysis
#firmware_hacking
#reverse_engineering
@ZwLowLevel
Medium
Reverse Engineering a TP-Link Router: Getting Root Access via UART Protocol
UART, this is the main topic for today. UART protocol stands for Universal Asynchronous Receiver/Transmitter (UART). This is the protocol…
25 viewsGolden Byte, 
Low Level CO 🎄
Battling The Eye: Exploring the Anti-Cheat Techniques of BattlEye

#windows_internals
#kernel_callbacks
#reverse_engineering
#anti_cheat

@ZwLowLevel
https://dl.acm.org/doi/epdf/10.1145/3733817.3762701
27 viewsGolden Byte, 
Low Level CO 🎄
22 viewsGolden Byte, 
Low Level CO 🎄
Indirect Syscall + Google Gemini AI = Bypass Microsoft Defender.

#edr_bypass
#edr_evasion
#malware_development
#maldev

@ZwLowLevel
https://youtu.be/Qhk2JEuWj2k?si=sZcJu6MLIInWVRTc
YouTube
Indirect Syscall + Google Gemini AI = Windows Defender Bypass (Merry Christmas)
Be better than yesterday -

Revisiting an old video published approximately 8 months ago and it was being picked up by Windows Defender. This video demonstrates a quick and straight-forward XOR encryption/decryption routine to supplement the shellcode loader…
19 viewsGolden Byte,