_Ray
@_RayRT
Followers
431
Following
3K
Media
56
Statuses
689
Senior Adversarial Engineer at Lares, Member of EVILCORP\Domain Fathers. https://t.co/SIwC7MLXmP
Joined June 2018
One-shot ESC1 + unPAC BOF for Havoc and CS. The certificate request includes the target's SID in the SAN to comply with strong mapping requirements (KB5014754). Hope it’s useful https://t.co/vPaDur297s
2
33
161
🔥Introducing a new Red Team tool - SessionHop: https://t.co/hChhDXzhiE SessionHop utilizes the IHxHelpPaneServer COM object to hijack specified user sessions. This session hijacking technique is an alternative to remote process injection or dumping LSASS. Kudos to @tiraniddo
github.com
Windows Session Hijacking via COM. Contribute to 3lp4tr0n/SessionHop development by creating an account on GitHub.
5
135
388
España, el país donde no puedes ver los resultados de tus análisis clínicos los días de partido , @LaLiga @Cloudflare
0
0
1
Vibe coding last week, I wanted to automate some AD techniques in a single tool. Currently supports ESC1/4 (with strong mapping), ShadowCreds, UnPAC, LAPS, Kerberoast (and targeted), RBCD (just set, no S4U2Self/Proxy yet) more features coming https://t.co/oU2CZWkMir
0
26
95
[Crystal Kit] Evasion kit for Cobalt Strike. https://t.co/RYlbXGn1bQ
github.com
Evasion kit for Cobalt Strike. Contribute to rasta-mouse/Crystal-Kit development by creating an account on GitHub.
8
86
331
Technical analysis of APT28’s Phantom Net Voxel operation by @sekoia_io
https://t.co/bd7WBMMvLc
#infosec
0
26
127
I just released Flareprox 🔥 A Cloudflare based Fireprox alternative that allows you to route HTTP traffic through Cloudflare, to gain mostly unique IP Addresses, to avoid detection and blocks.
11
178
1K
🚀H-C0N returns in 2026! Abierto CFP Los próximos 6 y 7 de febrero en Madrid volvemos con una nueva edición de H-C0N. ¿Quieres impartir una charla o taller y convertirte en uno de los ponentes de esta sexta edición? No lo dudes y mándanos tu propuesta a https://t.co/pwLsY8Forx
1
27
35
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog:
dirkjanm.io
While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise...
141
904
3K
Recently, a friend fell victim to an email account compromise so I decided to investigate the attack chain to help. The attack leveraged well-known techniques such as stolen credentials, malicious OAuth apps, and hidden Outlook rules:
rayrt.gitlab.io
Recently, a friend fell victim to an email account compromise so I decided to investigate the attack chain to help. While the exact initial entry vector remains unknown, it was likely either a...
0
1
2
AvePoint has fixed a vulnerability in DocAve, Perimeter and Compliance Guardian discovered by our researchers @m1ntko and @Calvaruga. This vulnerability can be used to achieve Remote Code Execution (RCE) in affected systems. ➡️ Advisory: https://t.co/bD9hLomlG1
0
8
8
Understanding #ScatteredSpider is key to smarter defense. At Lares, we simulate advanced TTPs: social engineering, malware, lateral movement & exfiltration, to expose gaps and improve readiness. ✍️Raúl Redondo (@_RayRT), Senior Adversarial Engineer
1
1
3
I've got ~5000 IP addresses to port scan for an engagement this week. Ax did it for me in minutes using hundreds of AWS EC2s. Ez https://t.co/QclBODKB5K
github.com
The Distributed Scanning Framework for Everybody! Control Your Infrastructure, Scale Your Scanning-On Your Terms. Easily distribute arbitrary binaries and scripts using any of our nine supported cl...
7
28
153
I wrote a short post about how you only need the NtReadVirtualMemory address for dynamic API resolution, plus how you could use a vulnerable binary to leak its address (and you would not have GetProcAddress, GetModuleHandle or LoadLibrary in the IAT) -
github.com
Vulnerable (on purpose) programs to leak NtReadVirtualMemory address for stealthier API resolution (no GetProcAddress, GetModuleHandle or LoadLibrary in the IAT) - ricardojoserf/MemorySnitcher
1
14
36
Modern lateral movement techniques detection (mainly DCOM/DCE/RPC/RDP) with examples. Some assumptions worth mentioning: visibility into source IP/port/hostname, logon activity, remote process metadata. A blog post by @HuntressLabs team. Awesome read, guys!
1
62
247
🚨 New attack disclosed: GitHub Device Code Phishing John, Matt, and Mason reveal how they've been using this technique to compromise F500 orgs with high success rates. 📖 Blog covers methodology, red team case studies & detection strategies https://t.co/xfej8uhOIW
1
63
154
Microsoft just released the patch for CVE-2025-33073, a critical vulnerability allowing a standard user to remotely compromise any machine with SMB signing not enforced! Checkout the details in the blogpost by @yaumn_ and @wil_fri3d. https://t.co/EY5Z53w1ZT
5
263
598
🎉 It is finally time for a new blog post! 🎉 Join us on our deep dive into Windows Authentication Coercion and its current state in 2025, including some brand-new tooling ✨ #itsec #infosec #pentest #redteam
https://t.co/ESePMwDIoc
blog.redteam-pentesting.de
Windows authentication coercion often feels like a magic bullet against the average Active Directory. With any old low-privileged account, it usually allows us to gain full administrative access to...
4
55
106