flux
@0xfluxsec
Followers
1K
Following
2K
Media
138
Statuses
535
Cyber professional (red team), security and systems programming | Rust | https://t.co/QIih2B7vya | https://t.co/VC3xsm0Wvq
Joined November 2023
Here it is: my research on Alternate Syscalls for Windows 11! There are still a few other facets to explore, but this is stable and PatchGuard resistant (from my tests!). #blueteam #redteam #computing #securityresearch #cyber #infosec #cybersec #malware.
4
52
167
Got my hands on some active *alleged* Iranian spyware, gonna maybe write something short up about it :) not too complex as reversing this stuff isn't my forte, more of a side quest.
1
0
4
Also interesting it’s in a /Work folder, I wonder what else is on that drive 👀.
North Korean(🇰🇵) malware developers are working in the Cyber Weapons folder.
0
0
3
First time playing with BN's debugger, not sure why I have never done this before. Loving the Windbg style syntax. I find it hard to replace x64dbg's interface tho :(. Gonna force myself to use this for a while, see if it clicks
0
1
8
PANIC OVER, it opens the file via NtCreateFile. I started questioning reality for a moment.
0
0
3
Hunting something cool, interestingly, scanning a file in defender doesn't go through NtOpenFile. (ignore the SCAN DETECTED, my println's are deceitful). The hunt continues.
2
1
13
That feeling when you reduce a complex function by half and improve how you reason with it. Then the subsequent feeling thinking: y r u so dumb
0
0
1
Okay @Microsoft @msftsecurity @MSFTResearch #RIFT is pretty damn cool. But can it be ported to ghidra for us poor nerds who can’t afford IDA Pro 🤓.
www.microsoft.com
As threat actors are adopting Rust for malware development, RIFT, an open-source tool, helps reverse engineers analyze Rust malware, solving challenges in the security industry.
0
0
3
RT @d1rkmtr: Thinking about releasing initial access (bypass MotW & SmartScreen) framework just for bros, not that commercial free version….
0
11
0
RT @vxunderground: Dear Red Team nerds,. If you're curious what a successful and serious malware campaign looks like (if you want to make a….
www.zscaler.com
TransferLoader is a new malware family with sophisticated anti-analysis techniques that deploys embedded payloads that include a downloader, backdoor, and ransomware.
0
292
0
RT @TheHackersNews: 🔍 UPDATE: The Havoc backdoor used by Iranian hackers is far more advanced than we thought. Injected via conhost.dll, i….
thehackernews.com
Iranian threat actor Lemon Sandstorm accessed Middle East CNI from 2023–2025 using VPN flaws, web shells, and 8 custom tools.
0
129
0
RT @5mukx: Doppelganger: An Advanced LSASS Dumper with Process Cloning.
labs.yarix.com
Github Repo: https://github.com/vari-sh/RedTeamGrimoire/tree/main/Doppelganger What is LSASS? The Local Security Authority Subsystem Service (LSASS) is a core component of the Windows operating...
0
68
0
The more I use Axum, the more I like it. About half way through v1.0 of my project that I'll open source. I have updates planned for v1.1, as well as through 2.0, 3.0 and 4.0. Keen to get a mvp out. but, I also want enough for it to be useful. Cant wait to share!!.
0
0
3
I was looking forward to using my gorgeous new (Spanish designed) garlic grater, but how the hell are you supposed to get the garlic out of the grooves it just smushes 😭😭😭
1
0
6
Yoooo nice work!.
Wrote a Windows kernel driver in Rust to read and write memory on request from a userland program, was pretty fun. I can recommend the Rust kernel Series from @0xfluxsec .
0
0
7
Been re-cookin' an old project from about 3 years ago recently. Originally written in Go and C - rewriting in Rust. Got a roadmap for various releases - thinking of open sourcing it when the first major milestone is met. Or maybe I wait for a more complete product. Idk 🤷♂️.
0
0
6
RT @xacone_: If you're exploiting a driver offering R/W access to physical memory on Win11 24H2, you can leverage this simple trick to circ….
0
54
0