In this blog, I’m gonna show you how you can execute your shellcode in linux. Before writing the code, I used a few different syscall that…

Rapid7 uncovered an ongoing malware campaign using trojanized NSIS installers disguised as popular apps to deploy the Winos v4.0 malware…

I have always come across circumstances where I have seen AVs or EDR Solutions have flagged a file as malware, if it just contains raw…

There are a lot of ways to executing shellcode but most of blog shows only a few ones. Of course, I’m not gonna explain every method. My…

This technique is often used by malware authors and it allows you to store your payload in a section. Before doing every step, I’ll explain…

ZigStrike, a new shellcode loader in Zig, offers advanced injection techniques and anti-sandbox features to bypass EDR, providing stealthy execution via local/remote thread and memory mapping.

What is a Shellcode Loader?

DreamWalkers Reflective shellcode loader inspired by MemoryModule and Donut, with advanced call stack spoofing and .NET support. Unlike traditional call stack spoofing, which often fails within reflectively loaded modules due to missing unwind metadata, DreamWalkers…

Process injection is an advanced penetration testing technique used by skilled security professionals to stealthily insert malicious code…

And why you should learn them

Elegir entre gomulti_loader y CGOblin depende del caso de uso, ya que ambos son shellcode loaders desarrollados por LazyOwn RedTeam con…

> By: grisun0, White Hat Blogger & Chief Overthinker of Suspiciously Suspended Threads
5 min read · Probably posted at 3 AM because sleep…

Process injection is an advanced penetration testing technique used by skilled security professionals to stealthily insert malicious code…

A walkthrough of Donut — the open-source tool that converts .NET assemblies and Windows binaries into position-independent shellcode…

NCSC exposes RayInitiator, a bootkit for Cisco ASA 5500-X devices without Secure Boot, which deploys the LINE VIPER shellcode loader for persistent and stealthy attacks.

SHELLSILO is a cutting-edge tool that translates C syntax into syscall assembly and its corresponding shellcode. It streamlines the process of constructing and utilizing structures, assigning vari…

Founding is a tool that processes shellcode in .bin, .exe, or .dll formats, applying advanced obfuscation or encryption techniques to generate stealthy binaries with sophisticated execution method…

DbgNexum is a 2026 PoC that uses Hardware Breakpoints and File Mapping to inject shellcode without standard APIs, making it invisible to most EDRs.

Security vanguards at SonicWall have unmasked a nascent campaign disseminating the VioletRAT malware. This offensive orchestrates a multi-tiered delivery sequence and a sophisticated Python-based …

In this write up, we explore a slightly different approach of obfuscation aside from the tried-and-true — XOR.