Atsika
@atsika.bsky.social
π€ 30
π₯ 60
π 2
Red Team enthusiast | Malware development enjoyer | Adversary Simulation at
@quarkslab.bsky.social
I've heard that my fellow Red Teamers like to use SOCKS proxies for stealth operations, so here's one that (ab)uses Azure Blob Storage π
add a skeleton here at some point
9 months ago
0
0
0
reposted by
Atsika
Quarkslab
9 months ago
Look at those cute little blobs in your internal network. They look harmless, but how about the one carrying SOCKS? It's ProxyBlob, a reverse proxy over Azure. Check out Alexandre Nesic's article on how it came to exist after an assumed breach mission β€΅οΈ π
blog.quarkslab.com/proxyblobing...
0
1
2
reposted by
Atsika
BallisKit
10 months ago
For us, EDR bypass is not just a buzzword. MacroPack, ShellcodePack, and DarwinOps all come with bypass presets for major EDRs and Antivirus Those presets are regularly updated and tested! If you want to see a demo or an equivalent screenshot for the major EDRs contact us !
#redteam
0
3
2
reposted by
Atsika
SpecterOps
9 months ago
Think NTLM relay is a solved problem? Think again. Relay attacks are more complicated than many people realize. Check out this deep dive from Elad Shamir on NTLM relay attacks & the new edges we recently added to BloodHound.
ghst.ly/4lv3E31
1
27
22
reposted by
Atsika
Quarkslab
10 months ago
Next week at the Hack The Box 0x4d meetup in Lille, France
@rayanle.cat
will talk about PwnShop, the challenge he prepared for the PwnMe CTF 2025 and how he accidentally discovered a RCE 0day while doing so. Join him next Monday at Campus Cyber Hauts-the-France:
www.meetup.com/hack-the-box...
0
7
2
reposted by
Atsika
BallisKit
10 months ago
Balliskit Evasion Tip π€ To help with static analysis detection by EDR, ShellcodePack implements a method to load a shellcode from a separate file or from an URL This tutorial explains how to use that option!
#redteam
blog.balliskit.com/loading-a-sh...
loading . . .
Loading a shellcode from a file/URL with ShellcodePack
Shellcode in EXE files can sometimes be detected during static analysis, requiring various kinds of obfuscation to bypass EDRs. Thisβ¦
https://blog.balliskit.com/loading-a-shellcode-from-a-file-url-with-shellcodepack-63b5918c3eb1
0
3
2
reposted by
Atsika
XPN
10 months ago
On PTO and bored, so playing around with MCP by exposing Mythic APIs to Claude and seeing what the result. Attempting to have it emulate threat actors while operating Apollo in a lab... would make a good sparring partner :D
www.youtube.com/watch?v=ZooT...
loading . . .
Mythic MCP - Claude Sonnet driving Mythic (Apollo)
YouTube video by Adam Chester
https://www.youtube.com/watch?v=ZooTlwajQT4
1
20
6
reposted by
Atsika
Kuba Gretzky
10 months ago
π¨ Evilginx Pro is finally here! π¨π£π This is it! After over two years of development, countless delays, and hundreds of manual company verifications, Evilginx Pro is finally live! Thank you all for your invaluable support π
breakdev.org/evilginx-pro...
loading . . .
Evilginx Pro is finally here!
After over two years of development, Evilginx Pro reverse proxy phishing framework for red teams is finally live!
https://breakdev.org/evilginx-pro-release/
0
11
6
reposted by
Atsika
Andrea P
10 months ago
KrbRelayEx-RPC tool is out! π Intercepts ISystemActivator requests, extracts Kerberos AP-REQ & dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;)
github.com/decoder-it/K...
loading . . .
GitHub - decoder-it/KrbRelayEx-RPC
Contribute to decoder-it/KrbRelayEx-RPC development by creating an account on GitHub.
https://github.com/decoder-it/KrbRelayEx-RPC
0
9
10
If you thought phishing was now ineffective, you may have missed something π My latest post highlights the advanced tactics used to bypass security controls and deceive even the most savvy users. Check it out ‡οΈ
add a skeleton here at some point
10 months ago
0
1
1
reposted by
Atsika
Quarkslab
10 months ago
From classic HTML pages to advanced MFA bypasses, dive in with
@atsika.bsky.social
in an exploration of phishing techniques π£. Learn some infrastructure tricks and delivery methods to bypass common detection. π
blog.quarkslab.com/technical-di...
(promise this one is legit π)
0
5
6
reposted by
Atsika
10 months ago
#PEbear
(
github.com/hasherezade/...
) is now available via WinGet (
learn.microsoft.com/en-us/window...
)! You can install it easier than ever - just type: `winget install pe-bear` from Powershell.
0
12
8
reposted by
Atsika
10 months ago
[DEMO] Searching for
#AceLdr
in memory, with
#PEsieve/#HollowsHunter
threads scan:
www.youtube.com/watch?v=RQf2...
; read more:
github.com/hasherezade/...
loading . . .
[DEMO] Searching for AceLdr in memory, with PE-sieve/HollowsHunter thread scan
YouTube video by hasherezade
https://www.youtube.com/watch?v=RQf2FTIdhfo
0
4
4
reposted by
Atsika
Cas van Cooten
11 months ago
Recently came across a pretty neat technique to silently load (malicious) VS Code extensions using its bootstrapping and portability features. Thought it was interesting enough to warrant my first blog post in 4 years π Check it out π
casvancooten.com/posts/2025/0...
loading . . .
Abusing VS Code's Bootstrapping Functionality To Quietly Load Malicious Extensions
Wow, been a while since my last blog π . During some research I came across a technique variation which I felt was interesting enough to share in a brief blog post. It relates to how the bootstrapping ...
https://casvancooten.com/posts/2025/02/abusing-vs-codes-bootstrapping-functionality-to-quietly-load-malicious-extensions/
0
7
3
reposted by
Atsika
Quarkslab
11 months ago
A Plan to Pwn: Reviving a 17 year old bug or winning a race against Project Management? We've got both. Mathieu Farrell shows you how in the "Pwn Everything, Bounce Everywhere, all at once" blog post series.
blog.quarkslab.com/pwn-everythi...
0
3
2
reposted by
Atsika
Quarkslab
11 months ago
ICYMI: 5 vulnerabilities in SOPlanning, an open source project management application used by major consulting services providers. In part 2 of "Pwn Everything, Bounce Everywhere, all at once" Mathieu Farrell tells you how to chain them for unautheticated RCE
blog.quarkslab.com/pwn-everythi...
0
1
1
reposted by
Atsika
ClΓ©ment Labro
11 months ago
In this blog post, I explain how I was able to create a PowerShell console in C/C++, and disable all its security features (AMSI, logging, transcription, execution policy, CLM) in doing so. πͺ π
blog.scrt.ch/2025/02/18/r...
2
43
21
you reached the end!!
feeds!
log in