Atsika

I've heard that my fellow Red Teamers like to use SOCKS proxies for stealth operations, so here's one that (ab)uses Azure Blob Storage 🚇

Proxybloby, the read teamer's mascot that will byte your SOCKS if left alone in your internal network

Look at those cute little blobs in your internal network. They look harmless, but how about the one carrying SOCKS?
It's ProxyBlob, a reverse proxy over Azure.

Check out Alexandre Nesic's article on how it came to exist after an assumed breach mission ⤵️
👉 blog.quarkslab.com/proxyblobing...

For us, EDR bypass is not just a buzzword.
MacroPack, ShellcodePack, and DarwinOps all come with bypass presets for major EDRs and Antivirus
Those presets are regularly updated and tested!

If you want to see a demo or an equivalent screenshot for the major EDRs contact us !

#redteam

Think NTLM relay is a solved problem? Think again.

Relay attacks are more complicated than many people realize. Check out this deep dive from Elad Shamir on NTLM relay attacks & the new edges we recently added to BloodHound. ghst.ly/4lv3E31

A CTF challenge in PHP, what could possibly not be a RCE?

Next week at the Hack The Box 0x4d meetup in Lille, France @rayanle.cat will talk about PwnShop, the challenge he prepared for the PwnMe CTF 2025 and how he accidentally discovered a RCE 0day while doing so.

Join him next Monday at Campus Cyber Hauts-the-France:
www.meetup.com/hack-the-box...

Loading a shellcode from a file/URL with ShellcodePack Shellcode in EXE files can sometimes be detected during static analysis, requiring various kinds of obfuscation to bypass EDRs. This…

Balliskit Evasion Tip 🤖
To help with static analysis detection by EDR,
ShellcodePack implements a method to load a shellcode from a separate file or from an URL

This tutorial explains how to use that option!

#redteam

blog.balliskit.com/loading-a-sh...

YouTube video by Adam Chester Mythic MCP - Claude Sonnet driving Mythic (Apollo)

On PTO and bored, so playing around with MCP by exposing Mythic APIs to Claude and seeing what the result. Attempting to have it emulate threat actors while operating Apollo in a lab... would make a good sparring partner :D www.youtube.com/watch?v=ZooT...

Evilginx Pro is finally here! After over two years of development, Evilginx Pro reverse proxy phishing framework for red teams is finally live!

🚨 Evilginx Pro is finally here! 🚨🎣🐟

This is it! After over two years of development, countless delays, and hundreds of manual company verifications, Evilginx Pro is finally live!

Thank you all for your invaluable support 💗

breakdev.org/evilginx-pro...

GitHub - decoder-it/KrbRelayEx-RPC Contribute to decoder-it/KrbRelayEx-RPC development by creating an account on GitHub.

KrbRelayEx-RPC tool is out! 🎉
Intercepts ISystemActivator requests, extracts Kerberos AP-REQ & dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;)
github.com/decoder-it/K...

If you thought phishing was now ineffective, you may have missed something 👀

My latest post highlights the advanced tactics used to bypass security controls and deceive even the most savvy users. Check it out ⤵️

Phishing in the Cloud with Diamonds

From classic HTML pages to advanced MFA bypasses, dive in with @atsika.bsky.social in an exploration of phishing techniques 🎣.

Learn some infrastructure tricks and delivery methods to bypass common detection.
👉 blog.quarkslab.com/technical-di...
(promise this one is legit 👀)

#PEbear (github.com/hasherezade/...) is now available via WinGet (learn.microsoft.com/en-us/window...)! You can install it easier than ever - just type: `winget install pe-bear` from Powershell.

YouTube video by hasherezade [DEMO] Searching for AceLdr in memory, with PE-sieve/HollowsHunter thread scan

[DEMO] Searching for #AceLdr in memory, with #PEsieve/#HollowsHunter threads scan: www.youtube.com/watch?v=RQf2... ; read more: github.com/hasherezade/...

Abusing VS Code's Bootstrapping Functionality To Quietly Load Malicious Extensions Wow, been a while since my last blog 😅. During some research I came across a technique variation which I felt was interesting enough to share in a brief blog post. It relates to how the bootstrapping ...

Recently came across a pretty neat technique to silently load (malicious) VS Code extensions using its bootstrapping and portability features. Thought it was interesting enough to warrant my first blog post in 4 years 🙃

Check it out 👇
casvancooten.com/posts/2025/0...

A Plan to Pwn: Reviving a 17 year old bug or winning a race against Project Management? We've got both.

Mathieu Farrell shows you how in the "Pwn Everything, Bounce Everywhere, all at once" blog post series.
blog.quarkslab.com/pwn-everythi...

An AI generated picture depicting exploitation kungfu against SOplanning. We guess they did not plan for that.

ICYMI: 5 vulnerabilities in SOPlanning, an open source project management application used by major consulting services providers.
In part 2 of "Pwn Everything, Bounce Everywhere, all at once" Mathieu Farrell tells you how to chain them for unautheticated RCE

blog.quarkslab.com/pwn-everythi...

Screenshot showing the execution of the proof-of-concept named PowerChell in comparison to a typical PowerShell prompt. In particular, it shows that PowerChell is able to bypass the Constrained Language Mode (CLM).

In this blog post, I explain how I was able to create a PowerShell console in C/C++, and disable all its security features (AMSI, logging, transcription, execution policy, CLM) in doing so. 💪

👉 blog.scrt.ch/2025/02/18/r...