Labs

Medium

Campaign

Defense Evasion

EDR, Sysmon, Windows

GentleKiller: Inside The Gentlemen RaaS EDR‑Killer Framework and Its BYOVD Driver Arsenal

The emerging Gentlemen RaaS equips its affiliates with the GentleKiller EDR‑killer framework and third‑party BYOVD tools to systematically disable more […]

Learn more

Medium

Campaign

Command and Control

EDR, Sysmon, Windows

ClickFix’s Second Door: SocGholish-Inspired Proxy-Based Intrusion Chains

ClickFix has evolved into a platform similar to SocGholish, integrating PySoxy to create durable and redundant access chains through automated […]

Learn more

Medium

Campaign

Credential Access

EDR, Sysmon, Windows

PowerShell P/Invoke of CredEnumerate for Credential Manager Extraction

In today’s threat landscape, SEO poisoning campaigns continue to evolve by leveraging technology trends and user trust in widely adopted […]

Learn more

Medium

Bypass, Campaign

Defense Evasion

EDR, Sysmon, Windows

When Forensics Becomes Offensive: Abuse of FTK Imager in the STAC3725 Tradecraft

STAC3725 campaign leveraging FTK Imager abuse to evade defenses, highlighting a stealthy technique repurposing forensic tools for low-noise persistence in […]

Learn more

Medium

Bypass

Privilege Escalation

Sysmon, Windows

RedSun: Turning Microsoft Defender into a Path to SYSTEM-Level Privilege Escalation

Developed by Nightmare-Eclipse, the same researcher of BlueHammer, RedSun is an unpatched local privilege escalation zero-day. It weaponizes Microsoft Defender’s […]

Learn more

Medium

Bypass

Privilege Escalation

EDR, Sysmon, Windows

BlueHammer windows Zero-Day

On April 3rd, 2026 a security researcher operating under the alias "Chaotic Eclipse" dropped a fully functional Windows local privilege […]

Learn more

Medium

Bypass

Defense Evasion

EDR, Sysmon, Windows

Weaponizing Windows Toast Notifications: Abuse of ToastNotify.exe for Phishing and Credential Coercion

In the evolving landscape of Windows credential harvesting, the ToastNotify impersonation attack stands out as a masterclass in abusing native […]

Learn more

Medium

APT, Campaign, Malware

Defense Evasion, Execution

EDR, Sysmon, Windows

SplitDrop: Inside the Iran-linked APT group Dust Specter campaign

SplitDrop exposes how alleged Iran-linked group Dust Specter abused DLL sideloading to advance execution and evade security controls mantaining persistence, […]

Learn more

Medium

Campaign, LOLBin

Defense Evasion

EDR, Sysmon, Windows

NTDS.dit Dumping via Print Spooler Abuse

In early 2026, threat actors exploited vulnerabilities in SolarWinds Web Help Desk, including CVE-2025-40551 and CVE-2025-40536, to gain initial access […]

Learn more

Medium

Campaign, CyberCrime, Malware

Persistence

EDR, Sysmon, Windows

Rhysida’s OysterLoader: Multi-Stage Fake Installer Campaign

The Rhysida ransomware group leverages search engine malvertising and code-signed fake installers to distribute OysterLoader, a multi-stage C++ backdoor. It […]

Learn more