Pinned Tweet
Introducing Cyllex - Advanced APT Emulation Framework.
cyllex.io/
I've been working on this for a while, pouring real effort and love into it. Not a quick release, I'm going step by step, building something solid. Some of the current features include:
▸ APT database with real-world campaign emulation
▸ Cross-platform agents via binary patching
▸ Agent, Agentless (WinRM/SSH), and Cloud execution
▸ Direct shell access for real-time interaction
▸ Interactive MITRE ATT&CK detection coverage tracking
▸ Calendar-based campaign scheduling
▸ Webhook notifications (Slack, Teams...)
▸ Robust TTPs: On-Premise (Windows/Linux), Cloud, and Containers
I'll be sharing updates as the project evolves. Thank you, and happy new year!
_Ray retweeted
New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇
ghst.ly/3VSdm7h
1/2
LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.
Patched in October.
Blog: specterops.io/blog/2026/10/2…
PoC: github.com/grayhatkiller/swi…
_Ray retweeted
I wrote up a way to defeat enforced SMB signing for relay.
It abuses a documented SMB re-authentication behavior.
I'm surely missing nuance and prior art. Corrections welcome.
Writeup:
blackfield.ch/blog/defeating…
PoC:
github.com/aas-n/reauthx
_Ray retweeted
Microsoft patched PetitPotam in their latest update, EFSRPC now validates shares locally, killing WebDAV coercion
💀
Added a check to NetExec’s enum_cve module to detect if a host already has the fix (CVE-2026-102217), so you can quickly spot what’s still exploitable 🔥
_Ray retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
_Ray retweeted
APT Encyclopedia updated: every claim in the 62 profiles checked against its source, wrong citations fixed or removed, all changes logged. Work continues on the extraction agents so only claims a primary source supports make it in.
cyllex.io/encyclopedia/?v=1
_Ray retweeted
I used Opus 5.5 on max and GPT-6 Astra for 5 days straight and I reversed engineered Elastic Security and extracted all the rules. I made them available here:
github.com/elastic/detection…
You’re welcome.
_Ray retweeted
This is a really interesting APT tradecraft write-up.
Cisco Talos uncovered UAT-11587, a China-nexus activity cluster targeting government and policy organizations across Asia with a previously undocumented Rust backdoor called Antino.
The interesting part: its native C2 runs entirely through Microsoft 365.
• Outlook + OneDrive used as dead drops
• Microsoft Graph for C2
• Shell + PowerShell execution
• File upload/download
• In-memory shellcode execution
• Persistence
• 5-stage infection chain
• Cloudflare infrastructure for staging + tracking
• ~350 compromised endpoints across 8 countries observed
Talos also documented tailored spear-phishing, fake Gmail attachment widgets and government/policy-themed decoys.
Excellent research by @CiscoTalos / @ashl3y_shen .
blog.talosintelligence.com/c…
#MalwareAnalysis #ThreatIntel #Infosec
_Ray retweeted
Released cldap_ping.py: AD user enum over real UDP cLDAP, plus anonymous rootDSE recon over TCP.
cLDAP tooling commonly runs the ping over TCP, which Event 5156 catches. Sending it over UDP leaves only netlogon.log (per Part 6). 😈
github.com/4ndr3w6/cldap_pin…
_Ray retweeted
InjectSetConsole - Performs process code injection by leveraging a Windows named pipe. Unlike traditional techniques, it does not use the:
✅ VirtualAllocEx &
✅ WriteProcessMemory APIs
github.com/TwoSevenOneT/Inje…
_Ray retweeted
4 unmitigated/unpatched "App Control for Business" (WDAC) bypasses in the list.
Are we even trying anymore?
github.com/bohops/UltimateWD…
_Ray retweeted
New Release Havoc Professional 0.8: Leviathan 🩸
- Introducing Kaine User-Defined C2
- Expanded Linux post-ex capabilities
- Refactored port forwarding and sleep masking
- Enhanced .NET/PowerSafe execution
- In-Memory PE Execution and BOF-PE support
- HTTP/s Server Name Indication (SNI) Spoofing
- License Updates / Air-gapped licensing
- Havoc client UI overhaul & cross-platform support
Release Link Below🔗
_Ray retweeted
When I started ipurple.team/ two years ago, my goal was to give SOC teams practical detection opportunities across some of the most modern adversarial techniques.
So far, I’ve documented 25 techniques, and every article includes:
✅ SIGMA Rules
✅ Sysmon Configs
✅ Threat Hunting Queries
If you work in Purple Teaming, Detection Engineering, Threat Hunting, or even the Red Team space, and you want your MITRE ATT&CK coverage to look like the example below, dive into the articles, start emulating, and begin hunting.
If you know that someone else in your network will benefit, feel free to repost.
_Ray retweeted
New writeup: Patch-Gap Zero-Days: BlueMoon.
Five China-nexus clusters chained two V8 patch-gap bugs (CVE-2026-85046, CVE-2026-87491) to one Windows ALPC LPE zero-day (CVE-2026-85880) against Chrome on Windows.
cyllex.io/blog/posts/bluemoo…
_Ray retweeted
NetNTLMv1 is dead. Long live NetNTLMv1. 🌈
Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses.
🌐 Browser-based cracking
⌨️ Cross-platform CLI with GPU/CPU support
💾 Searchable tables that fit on a 4 TB disk
Read the blog: outflank.nl/blog/2026/09/08/…
_Ray retweeted
Weekend project: I added IAKerb support to Rubeus. My god, this is going to open the floodgates.
Phase 2 of Microsoft's NTLM deprecation is targeted for H2 2026. IAKerb ships for Server 2025 / Win11 24H2 and is already on by default in the June Canary preview. It proxies Kerberos auth through exposed services via SSPI when a client can't directly reach a KDC.
Which means anonymous user enum via AP-REQs with no preauth (zero telemetry), kerberoasting over the open internet, Entra lateral movement through AZUREADSSO tickets and more. All against public facing services.
Blog post soon with potential abuse vectors.
_Ray retweeted
Introducing SpecterOps Skills: a public repository built to turn practitioner knowledge into reusable, reviewable workflows for AI-assisted security work.
@zinic shares what we're building, why we're building it, and how you can contribute ➡️ ghst.ly/4ybT6ew
