_Ray @_RayRT

Senior Adversarial Engineer Member of EVILCORP\Domain Fathers https://t.co/SIwC7MLXmP https://t.co/WeF9QBYGcQ Joined June 2018

Tweets

752
Followers

623
Following

908
Likes

3K

5pider @C5pider

5 days ago

New Release Havoc Professional 0.8: Leviathan 🩸 - Introducing Kaine User-Defined C2 - Expanded Linux post-ex capabilities - Refactored port forwarding and sleep masking - Enhanced .NET/PowerSafe execution - In-Memory PE Execution and BOF-PE support - HTTP/s Server Name Indication (SNI) Spoofing - License Updates / Air-gapped licensing - Havoc client UI overhaul & cross-platform support Release Link Below🔗

14 41 266 12K 90

View Details

Panos Gkatziroulis 🦄 @ipurple

6 days ago

When I started ipurple.team two years ago, my goal was to give SOC teams practical detection opportunities across some of the most modern adversarial techniques. So far, I’ve documented 25 techniques, and every article includes: ✅ SIGMA Rules ✅ Sysmon Configs ✅ Threat Hunting Queries If you work in Purple Teaming, Detection Engineering, Threat Hunting, or even the Red Team space, and you want your MITRE ATT&CK coverage to look like the example below, dive into the articles, start emulating, and begin hunting. If you know that someone else in your network will benefit, feel free to repost.

4 67 308 16K 298

View Details

Cyllex @CyllexFramework

5 days ago

New writeup: Patch-Gap Zero-Days: BlueMoon. Five China-nexus clusters chained two V8 patch-gap bugs (CVE-2026-85046, CVE-2026-87491) to one Windows ALPC LPE zero-day (CVE-2026-85880) against Chrome on Windows. cyllex.io/blog/posts/blu…

0 4 3 608 1

View Details

Outflank @OutflankNL

2 weeks ago

NetNTLMv1 is dead. Long live NetNTLMv1. 🌈 Today we're releasing NTLMRain: recovering NT hashes from NetNTLMv1 responses. 🌐 Browser-based cracking ⌨️ Cross-platform CLI with GPU/CPU support 💾 Searchable tables that fit on a 4 TB disk Read the blog: outflank.nl/blog/2026/09/0…

7 160 450 34K 277

View Details

CCob🏴󠁧󠁢󠁷󠁬󠁳󠁿 @_EthicalChaos_

2 weeks ago

Weekend project: I added IAKerb support to Rubeus. My god, this is going to open the floodgates. Phase 2 of Microsoft's NTLM deprecation is targeted for H2 2026. IAKerb ships for Server 2025 / Win11 24H2 and is already on by default in the June Canary preview. It proxies Kerberos auth through exposed services via SSPI when a client can't directly reach a KDC. Which means anonymous user enum via AP-REQs with no preauth (zero telemetry), kerberoasting over the open internet, Entra lateral movement through AZUREADSSO tickets and more. All against public facing services. Blog post soon with potential abuse vectors.

6 93 379 20K 195

View Details

SpecterOps @SpecterOps

3 weeks ago

Introducing SpecterOps Skills: a public repository built to turn practitioner knowledge into reusable, reviewable workflows for AI-assisted security work. @zinic shares what we're building, why we're building it, and how you can contribute ➡️ ghst.ly/4ybT6ew

0 43 177 15K 126

View Details

Cyllex @CyllexFramework

3 weeks ago

New on the blog: how Lazarus went from a fake job offer to ring 0 with a Windows kernel 0-day (CVE-2026-68820) and the FudModule 3.1 rootkit. cyllex.io/blog/posts/laz…

0 19 52 8K 33

View Details

Ricardo Ruiz @RicardoJoseRF

4 weeks ago

CrystalPotato is a Crystal port of GodPotato with indirect syscalls, dynamic API resolution and compile-time string obfuscation github.com/ricardojoserf/…

2 27 104 5K 67

View Details

LuemmelSec @theluemmel

a month ago

plugandpwn.com 👀👀👀

2 18 150 28K 222

View Details

0xedh @0xedh

2 months ago

You don't need a USB. You need to look like one. Emulate the device, Windows fetches a signed package off Windows Update and runs vendor code as SYSTEM. Arbitrary code execution, LPE, standard user or empty logon screen. DEF CON 34 talk w/ @Qm9yamFN. Link at the first comment.

18 268 1K 144K 821

View Details

X-C3LL @TheXC3LL

2 months ago

I just wrote a post for @AdeptsOf0xCC! Yes, we are live again! 🦉 In this post I RE a sound protocol (yes soundwaves!) used by Eufy and also we recover and decrypt wifi credentials from its flash memory. From your doorbell to your home network => adepts.of0x.cc/eufy-doorbell-…

0 10 13 1K 3

View Details

International Cyber Digest @IntCyberDigest

2 months ago

‼️ Hugging Face built an interactive replay of the OpenAI agent that breached them. It includes 17,613 logged attacker actions across the 4.5-day campaign, with the live command stream and more. …r-lab-model-intrusion.static.hf.space/index.html

51 445 3K 211K 2K

View Details

nix @aniqfakhrul

2 months ago

Happy to share a technical analysis by @h0j3n on our recent CVE-2026-54121 a.k.a Certighost. glhf🔥 Technical analysis: gist.github.com/H0j3n/a5ef2609… POC: github.com/aniqfakhrul/CV…

11 255 715 101K 356

View Details

_Ray @_RayRT

2 months ago

@TheXC3LL 4/4 Me ha parecido muy interesante y, sobre todo, muy motivador. En definitiva, un libro muy recomendable, tanto por su contenido técnico como por el lado humano que transmite.

0 0 0 108 0

View Details

_Ray @_RayRT

2 months ago

@TheXC3LL 3/4 Leer las distintas operaciones (mi favorita ha sido Operación Cinta Roja) y ver cómo Juanma convertía momentos de frustración en ideas locas que terminaban sacando los objetivos adelante ha sido genial.

1 0 0 120 0

View Details

_Ray @_RayRT

2 months ago

1/4 He acabado "Crónicas del Red Team", de @TheXC3LL y lo he disfrutado muchísimo. Desde que comencé en seguridad ofensiva, allá por 2017, siempre he tenido la suerte de coincidir con grandes profesionales de los que he aprendido muchísimo.

1 0 4 2K 2

View Details

Rick de Jager @rdjgr

2 months ago

Here’s the Age of Empires RCE from yesterday’s Patch Tuesday: CVE-2026-50663. Join an attacker’s lobby, (auto-)accept UCG, and you get remote code execution.

44 254 2K 450K 595

View Details

Kostas @Kostastsale

3 months ago

This is one of the more practical AI security research projects I’ve seen. So many benchmarks out there are based on artificial data. Too clean to represent the real. @cotoolai looked at how AI models perform on real security investigations, using real intrusion data. With real noise from users and admins. That’s the right framing for me. AI should not be treated as a replacement for experience or judgment, but it can be useful when it helps us work more efficiently. We can then focus on harder problems. cotool.ai/research/windo… Disclaimer: Threat Hunting Labs partners with Cotool and provides real intrusion data for this research.