Cybereason exposed The Gentlemen, a new, technically advanced Go-based RaaS using XChaCha20/Curve25519 crypto. The group claimed 48 victims in 3 months, leveraging WMI and PowerShell for propagation.

"BitlockMove" PoC demonstrates a novel lateral movement technique abusing BitLocker DCOM/COM hijacking to execute code in a logged-in user's session without credential theft.

"LdrShuffle" is a stealthy code execution technique that abuses the Windows Loader by overwriting a DLL's EntryPoint, enabling injection without creating new threads.

DCOMRunAs is a covert technique that exploits DCOM and DLL hijacking to execute payloads in the context of a remote, logged-on user's session without new process creation.

FusterCluck PoC exploits the Windows Cluster API over RPC to migrate cluster groups and achieve lateral movement across all nodes of a failover cluster.

Hello, fellow nerds!

SpeechRuntimeMove abuses DCOM and COM hijacking to execute code in an active user's session, bypassing the need for a full system takeover.

TL;DR

Arctic Wolf warns of CVE-2026-1731, a critical BeyondTrust flaw exploited in the wild. Attackers use it to deploy backdoors. Patch self-hosted instances now.

Privilege Escalation: How a Single Misconfigured Permission Can Bring Down an Entire Domain