Cisco139 Cisco Talos is tracking in-the-wild abuse of CVE-2026-20079 (FMC auth bypass, CVSS 10.0) and CVE-2026-20316 (static low-priv credentials, SIR High) on Cisco…
kernel296 Lazarus spent a Windows kernel zero-day in afd.sys on a fake recruiter PDF. CVE-2026-68820 is a local UAF that skips BYOVD controls;…
Malware552 SLEEPWALKER is a passive Windows backdoor that never beacons, opens no listening port and carries no payload. It side-loads into ESET Management…
Malware1.8k A reverse-engineering walkthrough of SakDriver, a Windows kernel-mode rootkit first mistaken for a Cobalt Strike Beacon. It patches ETW, hides processes via…
![[QuickNote] SolidPDFCreator – Mustang Panda Stage-1 Backdoor (Target India)](https://core-jmp.org/wp-content/uploads/2026/07/image-7-1024x919.png)
Malware514 Comprehensive analysis of SolidPDFCreator.dll, a Mustang Panda stage-1 backdoor targeting India. This DLL-based loader drops malicious payloads to C:ProgramDataIDMlogs, registers persistent scheduled…
Malware493 A complete walkthrough of loading, disassembling, and decompiling raw Cobalt Strike shellcode in Ghidra, resolving ROR13 API hashes via Google lookup and…
Malware300 In June 2026, D3Lab documented an Italian-language phishing campaign that delivered a compound browser threat: a malicious Google Chrome extension paired with…
Debug274 This post tackles CFG and CET/Shadow Stack bypasses for sleep obfuscation. It registers ROP gadgets via NtSetInformationVirtualMemory, swaps TIB stack bounds instead…
Malware275 This post details the journey of hardening Adaptix C2's default agent DLL using Crystal Palace's Reflective DLL loader. It implements IAT hooking,…
Deep dive into Windows PE file format—headers, sections, and loader mechanics. Explains how security products (AV/EDR) detect malware via static analysis: entropy,…
Linux305 Scales is a Linux supply-chain malware that pairs an embedded eBPF rootkit with a built-in Tor client and aggressive credential theft. This…
Exploit Development220 Eleven months after RarLab shipped WinRAR 7.13 to fix CVE-2025-8088, two Russia-aligned APT clusters (Earth Dahu / Gamaredon and SHADOW-EARTH-066 / UAC-0226)…
