Malware
-
Centurion: Bring Your Own Execution Environment
How we built a custom virtualized loader with its own ISA, PE loader, TLS stack, and software crypto coprocessor in about a week using LLM-assisted development — and what the BYOEE model means for offensive tooling.
read more → -
Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 2 of 2)
Part two of the Ghost Calls series details how we tunnel real-time C2 traffic through Zoom and Microsoft Teams TURN infrastructure using WebRTC — covering the approaches we evaluated, the WebRTC protocol suite, our SCTP-based implementation, and a walkthrough of the TURNt utility.
read more → -
Ghost Calls: Abusing Web Conferencing for Covert Command & Control (Part 1 of 2)
Part one of the Ghost Calls series takes apart how web conferencing platforms work under the hood, using Zoom as the primary example — the Multi-Media Router and Zone Controller architecture, RTP media handling, the fallback chain Zoom uses to stay connected through restrictive networks, and the TURN infrastructure that makes it all work.
read more → -
Extending LLVM for Code Obfuscation (2 of 2)
Part two of the LLVM code obfuscation series. This installment covers developing a more complex pass that automatically encrypts string literals during the compilation process by manipulating the LLVM IR.
read more → -
Extending LLVM for Code Obfuscation (1 of 2)
An introduction to binary obfuscation techniques through LLVM compiler customization. Part one covers LLVM fundamentals, development environment setup, and developing an LLVM pass for junk code insertion.
read more →