A technical walkthrough of deobfuscating JavaScript, dumping EVM bytecode, and resolving blockchain command and control infrastructure.

At a Glance Malware family API-driven XSS supply chain implant (Biggopti banner abuse) Threat actor Suspected; linked to the ARVE and OptinMonster campaigns Targets WordPress sites running seven B…

At a Glance Attribute Detail Malware family FDMTP implant (.NET, TouchSocket-based) Threat actor Suspected Twill Typhoon (not confirmed) Target / victims Windows users of QuickFox, mainly Chinese …

At a Glance Attribute Detail Malware family Interlock ransomware (double extortion) Threat actor Interlock, tracked by Sophos as GOLD EMBRACE (confirmed) Target / victims Critical infrastructure, …

Hey, My name is Omri Baso I am a 28 years old Security Researcher from Israel — I like researching about Windows, Active Directory, Malware…

At a glance Malware family MaaS infostealer delivered via SmartLoader (NodeJS strain among final payloads) Threat actor Operators behind TroyDen’s “lure factory” (suspected, not …

At a Glance Attribute Detail Malware family DOUBLECUP (Loader-as-a-Service); payloads CountLoader 4.5p and DeviceManager RAT Threat actor Rognar, a Russian operator (confirmed by SOCRadar) Target …

A digital forensics case study — how a fake “purchase order” almost bypassed Windows’ last line of defense

“” is published by Aditya Singh (Elite Hacker 1337).

Welcome to this new Medium post. In this one we will see how to walk the Windows VAD tree from a kernel R/W primitive, and how to abuse…