Blogs
BlogsUAT-7810 / LapDogs ORB Network Dissected: LONGLEASH Malware, Internet-Facing Device Compromise, and the Architecture of China’s Operational Relay Box EcosystemUAT-7810's LapDogs ORB network weaponizes unpatched Ruckus access points using LONGLEASH, a purpose-built intermediate C2 relay implant. This deep dive covers binary…Read →BlogsJADEPUFFER Dissected: Inside the World’s First Confirmed Fully-Agentic Ransomware Attack – Langflow RCE, LLM-Driven Lateral Movement, and What It Means for DefendersJADEPUFFER is the first confirmed fully-agentic ransomware attack - an LLM ran recon, credential theft, lateral movement, and encryption with no human…Read →BlogsCVE-2026-43499 “GhostLock” + IonStack Full-Chain Teardown: Futex Requeue-PI Stack Use-After-Free to Root and Container EscapeCVE-2026-43499 'GhostLock' turns a one-word logic error in Linux's PI futex code into a stack use-after-free, root escalation, and full container escape…Read →BlogsCVE-2026-43456: Dissecting the 19-Year Linux Kernel Bonding Driver Type Confusion That Achieves Root in Under One SecondA 2007 pointer copy in the Linux bonding driver enables a type confusion exploit that chains 329 GRE interfaces to achieve deterministic…Read →BlogsChocoPoC RAT: How Attackers Are Weaponizing the Researcher ToolchainChocoPoC RAT precision-targets vulnerability researchers through trojanized GitHub PoC repos, hiding payloads in transitive PyPI dependencies and using Mapbox datasets as a…Read →BlogsAvalon Malware Framework Internals: ISO-Lnk Delivery, MSBuild Abuse, ETW Tampering, and the CrownX Ransomware EndgameA deep technical teardown of the Avalon malware framework: how it chains ISO-LNK delivery, MSBuild LOLBin abuse, and usermode ETW patching to…Read →BlogsCVE-2026-46242 “Bad Epoll” Anatomy: Linux Kernel Use-After-Free from Unprivileged User to Root, and Why Anthropic’s Mythos AI Missed the Bug It NeighborsBad Epoll (CVE-2026-46242) exploits a race between ep_remove_file() and __fput() to achieve a use-after-free write in kmalloc-192, escalating any unprivileged user to…Read →BlogsToddyCat’s Umbrij Dissected: Shadow Token via Remote Debug, OAuth Code Theft, and the DLL Side-Loading Chain Emptying Corporate Gmail InboxesToddyCat's Umbrij malware skips credential theft entirely - it hijacks the OAuth consent flow from inside your browser using headless Chrome and…Read →BlogsAnubis RaaS Deep Dive: Citrix Bleed 2, /WIPEMODE Irreversible Destruction, and the Supply Chain Credential Pipeline Feeding Its AffiliatesAnubis RaaS (formerly Sphinx) chains Citrix Bleed 2 session hijacking with a /WIPEMODE wiper and a 300 GB supply-chain credential pipeline to…Read →BlogsShadowGuard Exposed: Inside the eBPF Rootkit That Made 70 Organizations Blind to Their Own KernelShadowGuard is the eBPF rootkit behind TGR-STA-1030's compromise of 70 organizations across 37 countries. Learn exactly how it rewrites d_reclen to hide…Read →BlogsCVE-2026-50656 (RoguePlanet): Dissecting the Defender Race Condition That Hands You a SYSTEM ShellRoguePlanet (CVE-2026-50656) exploits a TOCTOU race in Microsoft Defender's remediation pipeline, using NTFS opportunistic locks and VSS timing to deterministically land a…Read →BlogsAI-Assisted Ransomware Engineering in 2026: A Red-Teamer’s Technical Dissection of the Sophos-Documented Toolkit That Used Cursor and Claude to Automate AD Discovery and EDR EvasionSophos X-Ops documented a real agentic ransomware toolkit using Claude Opus 4.5 and Cursor to automate Active Directory enumeration and iterate EDR…Read →