DreamWalkers Reflective shellcode loader inspired by MemoryModule and Donut, with advanced call stack spoofing and .NET support. Unlike traditional call stack spoofing, which often fails within reflectively loaded modules due to missing unwind metadata, DreamWalkers…

Process injection is an advanced penetration testing technique used by skilled security professionals to stealthily insert malicious code…

And why you should learn them

Elegir entre gomulti_loader y CGOblin depende del caso de uso, ya que ambos son shellcode loaders desarrollados por LazyOwn RedTeam con…

> By: grisun0, White Hat Blogger & Chief Overthinker of Suspiciously Suspended Threads
5 min read · Probably posted at 3 AM because sleep…

Process injection is an advanced penetration testing technique used by skilled security professionals to stealthily insert malicious code…

A walkthrough of Donut — the open-source tool that converts .NET assemblies and Windows binaries into position-independent shellcode…

NCSC exposes RayInitiator, a bootkit for Cisco ASA 5500-X devices without Secure Boot, which deploys the LINE VIPER shellcode loader for persistent and stealthy attacks.

SHELLSILO is a cutting-edge tool that translates C syntax into syscall assembly and its corresponding shellcode. It streamlines the process of constructing and utilizing structures, assigning vari…

Founding is a tool that processes shellcode in .bin, .exe, or .dll formats, applying advanced obfuscation or encryption techniques to generate stealthy binaries with sophisticated execution method…

DbgNexum is a 2026 PoC that uses Hardware Breakpoints and File Mapping to inject shellcode without standard APIs, making it invisible to most EDRs.

Security vanguards at SonicWall have unmasked a nascent campaign disseminating the VioletRAT malware. This offensive orchestrates a multi-tiered delivery sequence and a sophisticated Python-based …

In this write up, we explore a slightly different approach of obfuscation aside from the tried-and-true — XOR.