AI-assisted cloud intrusion achieves admin access in 8 minutes
Researchers demonstrated how an attacker could gain full AWS administrative access in just 8 minutes using AI-assisted automation. The attack began with credentials accidentally exposed in a public S3 bucket. An LLM was then used to rapidly analyze the environment, generate attack noscripts, and plan next steps in real time.
#cloud_hacking
#ai_powered
#cyber_threat_intelligence
#cti
Researchers demonstrated how an attacker could gain full AWS administrative access in just 8 minutes using AI-assisted automation. The attack began with credentials accidentally exposed in a public S3 bucket. An LLM was then used to rapidly analyze the environment, generate attack noscripts, and plan next steps in real time.
#cloud_hacking
#ai_powered
#cyber_threat_intelligence
#cti
🆔 @ZwLowLevel
Sysdig
AI-assisted cloud intrusion achieves admin access in 8 minutes | Sysdig
Sysdig TRT details a lightning-fast AWS attack where an AI-assisted threat actor gained admin access in under 10 minutes, abusing Lambda, IAM, Bedrock, and GPU instances.
APT28’s Stealthy Multi-Stage Campaign Leveraging CVE‑2026‑21509 and Cloud C2 Infrastructure
#malware_analysis
#binary_analysis
#cyber_threat_intelligence
#cti
#malware_analysis
#binary_analysis
#cyber_threat_intelligence
#cti
🆔 @ZwLowLevel
Trellix
APT28’s Stealthy Multi-Stage Campaign Leveraging CVE‑2026‑21509 and Cloud C2 Infrastructure
Russian state-sponsored threat group APT28 (aka Fancy Bear or UAC-0001) has launched a sophisticated espionage campaign targeting European military and government entities, specifically targeting maritime and transport organizations across Poland, Slovenia…
Understanding and Experimenting with Apple's PAC on iOS
#binary_exploitation
#reverse_engineering
#reversing
#mac_internals
#ios_internals
#binary_exploitation
#reverse_engineering
#reversing
#mac_internals
#ios_internals
🆔 @ZwLowLevel
blog.reversesociety.co
Understanding and Experimenting with Apple's PAC on iOS | Reverse Society
A hands-on exploration of Pointer Authentication Codes (PAC) on iOS. We'll understand how PAC works at a deep level, explore how PAC signing can be triggered programmatically.
Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework
#malware_analysis
#binary_analysis
#cyber_threat_intelligence
#cti
#malware_analysis
#binary_analysis
#cyber_threat_intelligence
#cti
🆔 @ZwLowLevel
Cisco Talos
Knife Cutting the Edge: Disclosing a China-nexus gateway-monitoring AitM framework
Cisco Talos uncovered “DKnife,” a fully featured gateway-monitoring and adversary-in-the-middle (AitM) framework comprising seven Linux-based implants.
Bypassing KPP on Windows 11 25H2
KPP bypass with alternative syscall pipeline
#windows_internals
#windows_kernel
#kernel_patch_protection
KPP bypass with alternative syscall pipeline
#windows_internals
#windows_kernel
#kernel_patch_protection
🆔 @ZwLowLevel
GitHub
GitHub - HexilionLabs/AltSys: KPP bypass with alternative syscall pipeline
KPP bypass with alternative syscall pipeline. Contribute to HexilionLabs/AltSys development by creating an account on GitHub.
Bypassing Kernel Code Execution: A Data-Only SSDT Hijack Under VBS/HVCI, but how?
#windows_internals
#windows_kernel
#windows_exploitation
#windows_internals
#windows_kernel
#windows_exploitation
🆔 @ZwLowLevel
Exploit Pack
Bypassing Kernel Code Execution: A Data-Only SSDT Hijack Under VBS/HVC
By Juan Sacco (Linkedin) founder of https://exploitpack.com I have always been interested in Windows Kernel Exploitation, but this one was indeed a challenge! VBS/HVCI protections, are without doubts an awesome piece of technology by itself. First, let's…
We hid backdoors in binaries — Opus 4.6 found 49% of them
#reverse_engineering
#reversing
#binary_analysis
#reverse_engineering
#reversing
#binary_analysis
🆔 @ZwLowLevel
Quesma
We hid backdoors in binaries — Opus 4.6 found 49% of them - Quesma Blog
BinaryAudit benchmarks AI agents using Ghidra to find backdoors in compiled binaries of real open-source servers, proxies, and network infrastructure.
PANIX Persistence against *NIX
Customizable Linux Persistence Tool for Security Research and Detection Engineering.
#malwaredev
#malware_development
#linux_malware
Customizable Linux Persistence Tool for Security Research and Detection Engineering.
#malwaredev
#malware_development
#linux_malware
🆔 @ZwLowLevel
🥶 ColdWer
Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass
#edr_bypass
#edr_evasion
Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass
#edr_bypass
#edr_evasion
🆔 @ZwLowLevel
GitHub
GitHub - 0xsh3llf1r3/ColdWer: Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass
Cobalt Strike BOF to freeze EDR/AV processes and dump LSASS using WerFaultSecure.exe PPL bypass - 0xsh3llf1r3/ColdWer
Forwarded from Proxy Bar
Inside Gunra RaaS: From Affiliate Recruitment on the Dark Web to Full Technical Dissection of their Locker
#malware_analysis
#binary_analysis
#cyber_threat_intelligence
#cti
#malware_analysis
#binary_analysis
#cyber_threat_intelligence
#cti
🆔 @ZwLowLevel
Cloudsek
Inside Gunra RaaS: From Affiliate Recruitment on the Dark Web to Full Technical Dissection of their Locker | CloudSEK
CloudSEK researchers infiltrated Gunra’s newly launched RaaS affiliate program, gaining access to its live panel and ransomware locker. Our analysis reveals a highly optimized ChaCha20 + RSA-4096 hybrid encryption engine, multi-threaded execution, surgical…
Intego X9: When your macOS antivirus becomes your enemy
#macos_internals
#os_internals
#cyber_threat_intelligence
#macos_internals
#os_internals
#cyber_threat_intelligence
🆔 @ZwLowLevel
Quarkslab
Intego X9: When your macOS antivirus becomes your enemy - Quarkslab's blog
This blog post dives into the most common classes of macOS Local Privilege Escalation vulnerabilities, from time-of-check to time-of-use (TOCTOU) Race Conditions and insecure XPC communications to a range of implementation and configuration oversights. We…