Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS). By default, Diskshadow uses an…

Understanding state sponsored attacks and LOLBINS. A Case Study.

walkthrough Splunk Investigation Challenge on TryHackMe, titled Benign.

Imagine an attacker breaking into your internal system without using or developing their own [malicious] tool with out worrying about if…

When you think of cyberattacks, you might imagine shadowy hackers using advanced malware or zero-day exploits. But in reality, many…

Executive Summary

Living-Off-the-Land Binaries (LOLBins) like PowerShell, Certutil, or Rundll32 are legitimate Windows tools that attackers misuse to blend…

Cybercriminals no longer rely only on malware to break into systems. Instead, they exploit legitimate tools like PowerShell, Certutil, and…

Once an attacker gains initial access to a system whether through phishing, vulnerability exploitation, or stolen credentials the next step…

How Windows gets stabbed by it's own program!

Lab Link: https://cyberdefenders.org/blueteam-ctf-challenges/rhysida/

19 malicious VS Code extensions bypassed detection by hiding a Rust trojan in tampered node_modules and a fake banner.png using steganography. The attack uses cmstp.exe (LOLBIN) for execution.

Storm-0249 IAB abuses the SentinelOne EDR process via DLL sideloading to evade detection. The group uses LoLBin tools for fileless execution and sells access to ransomware groups like LockBit.

Overview

Security analysts have observed a sharp rise in “ClickFix”-style campaigns since late 2024, with activity peaking in 2026, wherein phishing…

Hello everyone,

Despite Internet Explorer’s retirement, hackers are abusing the legacy MSHTA utility in stealthy fileless malware attacks targeting Windows users.