Karkas

🔥 Introducing lacuna-rs — Ghost-frame call-stack spoofing + runtime indirect syscalls for Windows x64, ported to Rust. A reusable crate you can drop into any Rust offensive-security project 🔗github.com/Karkas66/lacun… #Rust #OffensiveSecurity #Windows #RedTeam #MalwareDev

@ShitSecure Ah ok... probably due to legal stuff with closed software. Too bad

@CDC_FI Nope that won’t improve RustPack 🤔have my own implementation for everything in that repo

🔥 Introducing lacuna-rs — Ghost-frame call-stack spoofing + runtime indirect syscalls for Windows x64, ported to Rust. A reusable crate you can drop into any Rust offensive-security project 🔗github.com/Karkas66/lacun… #Rust #OffensiveSecurity #Windows #RedTeam #MalwareDev

@0xMaz Feel free to copy all the facts to your own documentation. I needed to write that down to understand all the fundamentials. Even the core concept was an absolute highlevel abstract to me... 3 days ago :D

@CDC_FI Your explanation is better than mine. You have solid knowledge. I think you can find more tricks. Thank you for your kind words

@0xMaz Credits go to you exclusively. Impressive research you did there

@CDC_FI Gj, thank you

Ported from [LACUNA Chain](github.com/MazX0p/LACUNA-…) by Mohamed Alzhrani (@0xMaz ).

@5mukx glad to have you back

I also shared some of my private work identifications like linkedin profile to prove that I'm a vetted professional. Within an hour of submitting, I got my account back. I thank X and their support team for understanding and taking the necessary actions. 3/3🧵

Thank you for everyone who supports me during the incident ! A special thanks @IntCyberDigest, @cr3ghost and many more people for tagging and supporting me, it means a lot to me. Many awesome things are on the way.... Thank you Everyone ❤️ How i got my acc back ? nxt 🧵 1/3🧵

@TwoSevenOneT Double checked Trellix Agent, too. Works, no updates, no Alert Transmission. Client looks dead in Server Console

@CDC_FI Yep 💪

New #redteam tool for blocking EDRs: EDRChoker Instead of fully blocking the EDR agents' connections to their server, we can throttle their bandwidth so they consistently time out when sending data, which is effectively the same as blocking but avoids triggering "block" or "drop" packet events #pentest #cybersecurity Github: TwoSevenOneT/EDRChoker

@TwoSevenOneT OK, double checked with another client. It worked against tanium. Maybe more than 20 QoS Policys at the same time are too much. If i only use the few Tanium processes your PoC works against it

@CDC_FI 🤔

@TwoSevenOneT But to be honest, I´m as surprised as you are since Tanium 7.6 does not have a client side temper protection. I will retest with another client as soon as I have the time

@TwoSevenOneT Sure, but what do you want to hear. Tanium only consists of two binaries. I added them, rebootet and Client was still able to speak with the Server, Accept incomming request and send Alerts ¯\_(ツ)_/¯

@FalconFeedsio Chipsoft != cipsoft

@HaifeiLi a lot ppl might not know that you can disable certain API Calls with registry Keys/GPOs: #blacklist-configuration" target="_blank" rel="nofollow noopener">adobe.com/devnet-docs/ac… HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cJavaScriptPerms tBlackList=RSS.addFeed|Util.readFileIntoStream ...and you are safe :)

Fun fact about the Adobe Reader 0day: actually, it's the "AdobeCollabSync.exe" ("C:\Program Files\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe") process who communicates to the attacker-controller server, not the "Acrobat.exe". Therefore, if you're hunting the threat with your e.g EDR telemetry, you may want to look at that "AdobeCollabSync.exe" process too. #threatintel

@dcuthbert met him countless times even in the smallest Cons where he held top notch talks and always stopped for questions... true legend. Will never be forgotten

Everyone today is a hacker in a sense but there are very few OG hackers on which shoulders we stand Oh dude, Felix “FX” Lindner you were so much a hackers hacker and you will be missed RIP my friend and thank you

@rebane2001 will it run doom?

i built an entire x86 CPU emulator in CSS (no javascript) you can write programs in C, compile them to x86 machine code with GCC, and run them inside CSS

@5mukx Dood it´s 2026... who cares about userland hooks?

Malware development intermediate: EDR Evasion - A New Technique Using Hardware Breakpoints cymulate.com/blog/blindside…

@eversinc33 @cyb3rops Looks like the boys (colleagues) and I are soldiers now

@cyb3rops nmap bundesbank.de CYBERWAR🔥

The firewall blocks it; headline calls it cyber war Call it: blocked requests, scans, probes, bot traffic

@yarden_shafir Once you reach the level "I´ve forgottn more stuff than the average Junior level Analyst knows" you enter the realm of the true masters

Spent all morning debugging an issue. Eventually found the answer in a blog post. That I wrote. 5 years ago.

@VirtualAllocEx perfectly fine dood!