I'm pleased to announce that I will be giving my talk 'Kernel Games: The ballad of offense & defense' in /ˈziːf-kɒn/ this year, I hope to see you all there 🥳

Modern implant design: position independent malware development.

A small blog post on how to design 'modern' malware with features like global variables, raw strings, and compile-time hashing.

5pider.net/blog/2024/01/2…

Repo: github.com/Cracked5pider/…

The documentation of all features is complete and can be viewed in: github.com/Idov31/Nidhogg…
In the documentation there are usage examples, explanations and helpful information for users and for people that want to learn how certain feature is implemented.
#infosec #CyberSecurity

Another feature is completed :)
Port hiding is added to Nidhogg, now you can hide connections by tcp (local or remote) or udp ports, already live in dev.
github.com/Idov31/Nidhogg…

#infosec #CyberSecurity

Due to the changes that happened with Nidhogg in the last months, I created a dedicated wiki that explains how the features work and how to use them.
In the next weeks, I will add the documentation of all features.
Everything will be available here: github.com/Idov31/Nidhogg…

There was no update for a while and the reason being a massive bug fixes, feature checking and a new feature (fun fact: it is the 23th feature!).
Now, you can use Nidhogg to dump credentials from LSASS!
Go check it out: github.com/Idov31/Nidhogg…

#infosec #CyberSecurity

I plan on releasing my stage 0 which started out as a plan to be a fully fledged framework but stopped at stage0, I genuinely had it private/sitting for a while and plan on stabilizing some code before deploying! I have no use case for it anymore.

Calling all Red Teamers 🚨

Today we are introducing Tartarus-TpAllocInject, a new OPSEC-safe loader and technique for bypassing EDR solutions, by trickster0

labs.nettitude.com/blog/creating-…

Weekly Nidhogg update
Driver hiding feature is also finished and live in the dev branch: github.com/Idov31/Nidhogg… :)
On the photos you can see the before and after in DriverView (From Nirsoft's tools)

#infosec #CyberSecurity