Analysis of a malicious LNK file which uses a compromised Uzbekistan website to launch a malicious HTA file, that in turn downloads and runs FormBook malware.

** Find me at **
Twitter/X - https://twitter.com/CyberRaiju
Blog - https://www.jaiminton.com/
Mastodon…

Retr0's Threat Research

A tale about exploiting KernelCTF Mitigation, Debian, and Ubuntu instances with a double-free in nf_tables in the Linux kernel, using novel techniques like Dirty Pagedirectory. All without even having to recompile the exploit for different kernel targets…

A fully-undetectable ransomware that utilizes OneDrive & Google Drive to encrypt target local files - SafeBreach-Labs/DoubleDrive

The 1.0 RISC-V Vector Specification is now Ratified, and the first pieces of silicon using the new spec are starting to hit the shelves. I go over the utility of Vector Instructions, why you would want them, why you should care, and how to use them in raw…

Contribute to apkunpacker/FridaScripts development by creating an account on GitHub.

This was one of the most challenging crackmes I’ve ever attempted to decipher. It took an extensive amount of time and effort, spanning…

Golang is the most used programming language for developing cloud technologies. Tools such as Kubernetes, Docker, Containerd and gVisor are written in Go. Despite the fact that the code of these programs is open source, there is no way to analyze and extend…

Discovering a zero-day authentication bypass and chaining a .NET deserialization to achieve pre-auth RCE on Progress Report Server

An IDA plugin that eases reversing of binaries that have been code-size-optimized with function outlining - cellebrite-labs/FunctionInliner

In Android SELinux internals Part 1 blog, explore how it provides security on Android devices and ways to bypass it. Read more to learn!

Our student-focused conference providing free talks & trainings from some of the world's top Apple security researchers, providing an invaluable learning opportunity for the community.

Delve into windows memory internals! here is the 3rd post of Malware Development, Analysis and DFIR Series.

Another fun exploit! This time with local privilege escalation through Apple’s PackageKit.framework when running ZSH-based PKGs 🎉.

In this video, we use Frida hooking to intercept native Android methods after they have been loaded into the runtime. We write a custom noscript that uses Interceptor.attach to run code when the native method is invoked.

---

Timestamps:
00:00 Intro
00:50…