Yaniv

Limacharlie Claude MCP Workbench

TL;DR: A technical workbench connecting claude to limacharlie via mcp for interactive edr queries and scripted investigation workflows.

GODRAT: GH0ST RAT–BASED CAMPAIGN TARGETING FINANCIAL INSTITUTIONS

OVERVIEW GReAT research documents GodRAT, a remote access trojan family derived from Gh0st RAT, observed in operations against financial…

INVESTIGATING THE WINDOWS SRUM DATABASE: WHAT FORENSIC TEAMS NEED TO KNOW

New Data Exfiltration Technique Using Brave Sync

TL;DR: A proof-of-concept demonstrates how brave sync can be abused to exfiltrate files by encoding them as base64, embedding chunks into…

Astaroth: Banking Trojan Abuses Github For Resilience

TL;DR: Mcafee labs describes an astaroth campaign that uses phishing to deploy autoit-based payloads, exfiltrates via ngrok, and pulls…

SALTY 2FA: A NEW PHAAS TARGETING MICROSOFT 365 AND BYPASSING 2FA

Overview A recently identified phishing‑as‑a‑service (PhaaS) framework dubbed Salty 2FA has been observed targeting Microsoft 365…

Esxi Exploitation In The Wild

TL;DR: Huntress documented a december 2025 intrusion where attackers deployed an esxi vm-escape toolkit after likely initial access via a…

Malicious Mcp Servers Used In Supply-chain Attacks

TL;DR: Research from securelist shows attacker-controlled model context protocol (mcp) servers can be used in supply-chain scenarios to…

Screenconnect super-admin credential harvesting uses evilginx

TL;DR: Aitm phishing using evilginx targets screenconnect super-admins via amazon ses in low-volume campaigns to harvest credentials and…

Uncloaking Voidproxy: A Novel And Evasive Phaas Framework

TL;DR: Voidproxy is a phaas using aitm to intercept authentication flows and capture credentials, mfa codes, and session tokens.

LatentCSI: High‑resolution Image Generation From Wifi CSI

TL;DR: Latentcsi maps wifi csi amplitudes into the latent space of a pretrained latent diffusion model to synthesize high‑resolution rgb…

Unmasking The Evolving Iranian Prince Of Persia

TL;DR: Safebreach documents sustained prince of persia apt activity through december 2025, identifying multiple foudre and tonnerre…

Lynx Ransomware Incident: Rdp-based Intrusion And Backup Targeting

TL;DR: A march 2025 intrusion used pre-compromised rdp credentials to reach a domain controller, create impersonation admin accounts…

Detecting exposed llm servers: shodan case study on ollama

TL;DR: Llm monitoring; shodan scans found over 1,100 exposed ollama instances and roughly 20% actively serving models without adequate…

Abusing Chrome Remote Desktop On Red Team Operations: Practical Guidance

TL;DR: Chrome remote desktop can be repurposed as a covert remote-access channel requiring local admin to install an msi and using…

Breaking down mustang panda’s windows endpoint campaign

TL;DR: Apt mustang panda uses spearphishing lnk shortcuts to execute binaries without macros, requiring behavioral endpoint detection and…

From Lnk To Rat: How A Discord‑delivered Shortcut Loads A Dll Rat

TL;DR: Attackers distribute malicious .lnk files via discord that launch hidden powershell to extract a zip with a dll and execute it…

Forensic Insights Into An Edr Freeze Attack

TL;DR: Edr-freeze is a proof-of-concept that leverages werfaultsecure.exe and minidumpwritedump to suspend edr processes (observed…

Lan Orangutan — Self-hosted Network Discovery For Homelabs

TL;DR: Lan orangutan is a single-binary, cross-platform tool that uses nmap to auto-discover devices, provides a web dashboard and cli…

N8n-powered Ai Calorie Tracker Inside Telegram

TL;DR: A user-shared n8n workflow implements an ai agent in telegram that recognizes meals from photos, estimates calories and macros, and…

The Kids Aren’t Alright — Policy Implications Of Algorithmic Exposure

TL;DR: A lawfare analysis argues that children’s online harms are amplified by algorithmic recommendation and that existing legal…

Tamperedchef Compromise Via Trojanized Allmanualsreader

TL;DR: In august 2025 a malvertising redirect led to a trojanized allmanualsreader installer that deployed tamperedchef using a bundled…

Agent Skills: Structuring Threat Hunt Planning For Ai Agents

TL;DR: The threat hunter playbook is being expressed as agent skills — packaged planning workflows, templates, and references — so ai…

TL;DR: Loki-rs is a beta rewrite of the loki scanner in rust that unifies yara rule matching and…

Context:

Edr‑freeze: Freezing Edr And Antivirus Processes Via Windows Error Reporting

TL;DR: Edr‑freeze abuses minidumpwritedump and werfaultsecure to suspend ppl‑protected edr/av processes from user mode, creating extended…