Luci

1.0 has landed @NullMode_ 👀

CET compatible, User Defined Synthetic Frames 😍

Spot the DroidHawk reference! 😍

It’s been a long time coming, but we’re incredibly excited to announce the release of Nighthawk 1.0 - Apex. This release comes packed with new features, OpSec and quality of life improvements nighthawkc2.io/apex/

Some unreal features coming in our next release - we finally made it to 1.0, well done @peterwintrsmith @s4ntiago_p @modexpblog @GigelV41464 @saab_sec 🙌🔥

Nighthawk 1.0 is now released to customers, blog post to follow. Here's a sneak peak of our new CET compatible, per API, custom configurable stack masking 😎... just one of many new features 🔥

To confirm, we added cet masking support (the first to do so?) back in September '25 - x.com/GigelV41464/st… - though this release adds 2 more new, completely different techniques

I've been pretty quiet recently, mainly because we've been cooking up a few things at @MDSecLabs - some of which will be revealed over the next month or so. One of the most exciting things is a HUGE new @nighthawk_c2 release. It's packed with "stacks" of new OpSec - incl. 3 new CET compat masking. But most exciting of all, we have a super sexy new cross platform UI 🔥

@C5pider has faced similar removals on recent posts. These are known-legitimate researchers that have been contributing the the cybersecurity space for years. @nikitabier is this a deliberate change in policy?

This week we launched our Offensive Security Accelerator - a fast track training programme for those looking to start their cyber security careers... if you're in the UK and a graduate or looking to pivot in to offensive security, here's how... pwn.careers

A feature I snuck in the new loader introduced in the September 2025 release of Nighthawk is CET-compliant stack spoofing. Here is a video showing a CET-enabled Notepad being injected with the payload. A bp is placed on NtAllocateVirtualMemory to show that the call is spoofed:

One of the most exciting parts about our upcoming EDR Internals & Development course is that it walks the students through the development of a research EDR agent called MaldevEdr. @GigelV41464 analyzed various EDR products to understand their inner workings and incorporated these techniques directly into the training. The agent developed throughout the course includes all the primary components of a real EDR such as a PPL service, user-mode DLL, ELAM driver and other kernel-mode components. The diagram illustrates the components of the MaldevEdr. More information: maldevacademy.com/edr-course

I was pretty surprised to see how little validation was done to get an extension in the marketplace - probably a nice IA vector for supply chain simulations 😍

Revisiting our past work on Code extensions, we took at look at the big brother; Visual Studio mdsec.co.uk/2026/05/visual…

If you’re not up to speed with the risks of malicious vscode extensions, just a reminder, we blogged about this 3 years ago - mdsec.co.uk/2023/08/levera… @MDSecLabs

We’re happy to announce that our EDR Internals & Development training is now in its final stages of development. Over the past several months, an enormous amount of work has gone into building this highly technical & detailed training. The course covers the internals of modern EDR from both user-mode and kernel-mode perspectives, including techniques like syscall hooking, filesystem minifilters, ETW telemetry, memory scanning, kernel callbacks, process instrumentation callbacks, call stack tracing, and anti-tampering mechanisms. The course concludes with building a limited yet functional custom EDR agent and we test it against several malware techniques to gain practical experience with detection engineering and EDR internals. This huge undertaking would not have been possible without @GigelV41464 who dedicated countless hours to analyzing different EDR products, building custom implementations, analyzing internal mechanisms, and documenting the techniques with excellent depth and clarity. The official launch date is scheduled for June 15, 2026 but starting today, we're opening access to an early bird discount of 20% for a limited time. EDR Internals & Development: maldevacademy.com/edr-course

We’re excited to introduce a new feature for Nighthawk Professional users - Labs. A new home for supporting tools, source code and samples for Nighthawk nighthawkc2.io/introducing-ni…

Last week we published three independent phishing research projects CDP, Passkey Phishing, and ConsentFix, alongside the internal @MalDevAcademy @mrd0x tools for each. It’s been great getting messages like this and seeing Red Team operators actually putting them to use. If you're testing them out, feel free to reach out always happy to take feedback, fix bugs, and push improvements.(I still have a lot to learn).

New post on the MDSec blog and another Windows EoP.... RIP RegPwn - mdsec.co.uk/2026/03/rip-re… Saying goodbye to a much loved EoP, by @filip_dragovic

Our latest post on the blog details a Windows EoP courtesy of @filip_dragovic... "Total Recall – Retracing Your Steps Back to NT AUTHORITY\SYSTEM" - mdsec.co.uk/2026/02/total-…