Labs

Medium

Bypass

Execution, Privilege Escalation

EDR, Sysmon, Windows

LegacyHive: Windows ProfSvc enabling cross-user registry Hive Loading

LegacyHive is a Windows local privilege-escalation zero-day that abuses the User Profile Service’s registry hive-loading logic to redirect or expose […]

Learn more

Medium

Campaign, Malware

Defense Evasion

EDR, Sysmon, Windows

ClickFix to StealC: ResiLoader weaponizes pcdhost.sys BYOVD driver to achieve ring-0 code execution

ResiLoader drops the vulnerable pcdhost.sys driver in a BYOVD attack, using its kernel privileges to kill AV/EDR processes before hollowing […]

Learn more

Medium

Campaign

Defense Evasion

EDR, Sysmon, Windows

GentleKiller: Inside The Gentlemen RaaS EDR‑Killer Framework and Its BYOVD Driver Arsenal

The emerging Gentlemen RaaS equips its affiliates with the GentleKiller EDR‑killer framework and third‑party BYOVD tools to systematically disable more […]

Learn more

Medium

Campaign

Command and Control

EDR, Sysmon, Windows

ClickFix’s Second Door: SocGholish-Inspired Proxy-Based Intrusion Chains

ClickFix has evolved into a platform similar to SocGholish, integrating PySoxy to create durable and redundant access chains through automated […]

Learn more

Medium

Campaign

Credential Access

EDR, Sysmon, Windows

PowerShell P/Invoke of CredEnumerate for Credential Manager Extraction

In today’s threat landscape, SEO poisoning campaigns continue to evolve by leveraging technology trends and user trust in widely adopted […]

Learn more

Medium

Bypass, Campaign

Defense Evasion

EDR, Sysmon, Windows

When Forensics Becomes Offensive: Abuse of FTK Imager in the STAC3725 Tradecraft

STAC3725 campaign leveraging FTK Imager abuse to evade defenses, highlighting a stealthy technique repurposing forensic tools for low-noise persistence in […]

Learn more

Medium

Bypass

Privilege Escalation

Sysmon, Windows

RedSun: Turning Microsoft Defender into a Path to SYSTEM-Level Privilege Escalation

Developed by Nightmare-Eclipse, the same researcher of BlueHammer, RedSun is an unpatched local privilege escalation zero-day. It weaponizes Microsoft Defender’s […]

Learn more

Medium

Bypass

Privilege Escalation

EDR, Sysmon, Windows

BlueHammer windows Zero-Day

On April 3rd, 2026 a security researcher operating under the alias "Chaotic Eclipse" dropped a fully functional Windows local privilege […]

Learn more

Medium

Bypass

Defense Evasion

EDR, Sysmon, Windows

Weaponizing Windows Toast Notifications: Abuse of ToastNotify.exe for Phishing and Credential Coercion

In the evolving landscape of Windows credential harvesting, the ToastNotify impersonation attack stands out as a masterclass in abusing native […]

Learn more

Medium

APT, Campaign, Malware

Defense Evasion, Execution

EDR, Sysmon, Windows

SplitDrop: Inside the Iran-linked APT group Dust Specter campaign

SplitDrop exposes how alleged Iran-linked group Dust Specter abused DLL sideloading to advance execution and evade security controls mantaining persistence, […]

Learn more