Red Team enthusiast | Malware development enjoyer | Adversary Simulation at @quarkslab

Unknown
Joined April 2020
🥳 ProxyBlob V2 is now available 🎉 As promised, here is the new version of ProxyBlob, boosted with aznet. Az-what 🤔? This version introduces a new Go module called aznet that allows you to use Azure storage services (not just blobs 😏) as a direct replacement for net.Conn! 🏎️github.com/Atsika/aznet 🌐github.com/quarkslab/proxybl… Complete documentation is available in the aznet repo to understand how it works 📚
1
29
1
70
6,288
Atsika retweeted
I’m testing a simulation module for the AMOS stealer (using ESF events and file usage patterns that are nearly identical to the actual stealer), it’s quite something to see that it still works on some hardened systems...
1
23
I wish this existed for linux as well, would help me a lot during engagements 😅
You remember seeing it. You don’t remember where. Screenlogger remembers. 0.2.0 brings a fresh UI, less disk usage, and search powered by local @googlegemma embeddings. An always-on screen recorder for Mac. Describe what you saw. Find it again. All on your Mac.
1
2
273
Atsika retweeted
While everybody is prompting for PHP, recently I ended up having to dump the LSA in a custom way. I have written a short article on the entire LSA decryption stack, with the C implémentation. 💫 Cross posted here blog.advens-c.tf/articles/ls… and here hideandsec.sh/books/windows-…
31
111
4,014
I’ve been using ProxyBlob for a week on a target running CrowdStrike. The tool worked like a charm. Btw, it was made by my colleague @_atsika Definitely worth checking his tool 🚰 github.com/quarkslab/proxybl…
29
2
100
6,073
🚨 EVILGINX EXTENSION IS OUT🚨 I am happy to say the free Evilginx Chrome extension has been approved and is finally available for download. 🥳 You can now safely import your captured session cookies, knowing that the cookie manager you're using came from a reputable source, along with the "trust me bro" quality seal. For a long time, I wanted to make the task of finding the cookies that hold session tokens much easier. With the Evilginx extension, you can now speed up the trial-and-error process when testing multiple cookie configurations to see whether you're still authenticated after a page reload (no more restoring cookie backups from external JSON files). I made this extension for myself, and I use it to kickstart the development of every single phishlet I make. Now you can too! 💪 To properly celebrate the release and help you get the most out of the extension, I released a walkthrough video with a rundown of all the features and a hands-on tutorial on how to use it to kickstart the development of your own phishlet for GitHub. Enjoy and happy phishing! 💗🪝🐟 Disclaimer: AI was used to develop the extension. UX, UI design, and minor code tweaks originated from a human brain. Code was read using human eyes. P.S. GitHub repo will arrive later. 🔗 Links can be found below 👇
10
36
2
180
9,163
Atsika retweeted
We are preparing an optional MCP server for the next version of MacroPack, ShellcodePack, and DarwinOps! This interface will come in addition to the existing CLI and GUI for our customers who want to integrate redteam tooling with agentic AI! 🤖 #redteam
4
19
1,093
New blog is live: blog.safetech.red 🦀 🔥 Red and Purple notes, and first article out: 📝 The origins of RustHound-CE Why I built an AD collector in Rust back in 2021, what the BloodHound Community Edition turn changed, and where the tool stands today. The original post had disappeared with the old company website, so it is back online, rewritten and up to date. EN: blog.safetech.red/rusthound-… FR: blog.safetech.red/fr/rusthou…
2
13
49
3,356
RustPack Release 1.8.0 was shipped to our customers recently. Short Blogpost with the most relevant new features for everyone here 🔥🔥 msecops.de/blog/posts/rustpa… #RedTeam #OST #Pentest #Maldev
14
1
77
11,639
Atsika retweeted
On Nov 9th the Outflank R&D team will host a live demo of their offensive security product OST. What to expect during 60 minutes? ☁️ Initial access techniques for cloud 🥷 Evasion of leading EDR products 📡 Next-gen C2 framework ⚙️ Kernel tradecraft register.gotowebinar.com/reg…
1
15
85
4,805
Atsika retweeted
Need to disable any EDR in post exploitation? Here is a simple tutorial showing how to do that using BallisKit EDR Eclipse! EDR Eclipse is also compatible with ShellcodePack and MacroPack formats as well as all major C2s! blog.balliskit.com/tutorial-… #redteam
26
127
8,274
Oh come on @kaluche_, we can't wait anymore for the next AV 😩
Not an antivirus product this time, but we couldn't pass it up 🙈 @CatoNetworks said: route with split tunneling. @kaluche_ heard: root with split tunneling. Check out CVE-2026-10739, a LPE vulnerability in the Cato VPN Client for Windows ➡️ blog.quarkslab.com/cato-vpn-…
1
198
Atsika retweeted
Not an antivirus product this time, but we couldn't pass it up 🙈 @CatoNetworks said: route with split tunneling. @kaluche_ heard: root with split tunneling. Check out CVE-2026-10739, a LPE vulnerability in the Cato VPN Client for Windows ➡️ blog.quarkslab.com/cato-vpn-…
1
6
2
25
2,316
Atsika retweeted
Need to pivot through a macOS target during a Red Team operation? 🍎 Mirage C2 includes built-in SOCKS proxying, letting operators route traffic through a compromised Mac and reach resources beyond the initial foothold. Start it. Pivot. Keep moving. Part of DarwinOps by BallisKit. #RedTeam #macOS
6
19
1,045
Atsika retweeted
⚠️CVE-2026-18963 (CVSS 9.1)⚠️ Critical Unauthenticated Account Takeover vulnerability in Keycloak’s reset-credentials flow. In affected Keycloak 26.x versions, unauthenticated attackers can bypass email verification during password recovery and continue the reset-credentials flow. This allows an attacker who knows a target username or email address to set new credentials without accessing the victim’s email, resulting in full account takeover. Patched versions include 26.4.15, 26.6.6, and 26.7.2. Users should upgrade to a fixed release. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-… #Keycloak #AccountTakeover #AuthenticationBypass #PasswordReset #CWE640 #CyberSecurity #CVE #PoC #Exploit #CVE_2026_18963
6
48
2
319
28,416
Atsika retweeted
⚠️CVE-2026-85706 (CVSS 10.0)⚠️ Your GitLab will hand a stranger its files. 😱 No login. No account. An attacker just URL-encodes one letter of commits → %63ommits, and GitLab-Workhorse waves the request through — so a single unauthenticated POST to the repository commits API reads files straight off the server filesystem. Config, internal logs, source paths, versions… all without ever signing in. Already in CISA KEV — exploited in the wild. 🚨 If you self-host GitLab, patch to 19.1.8 / 19.2.6 / 19.3.2 now. 🔥PoC + setup: github.com/EQSTLab/CVE-2026-… #GitLab #ArbitraryFileRead #CVE #PoC #Exploit #CyberSecurity #CVE_2026_85706
19
169
9
1,187
172,935
A quick article showing how the Jev OPSEC ranker works, and looking at how Jev can be used for identifying potentially sensitive file paths and content at speed.
2
78
2
459
27,455
🐈 @MistralAI Vibe v2.25.5 is out and fix a Remote Code Execution I reported (CVE-2026-93993). I hope that in the next few days they'll release another update to fix the other RCE I also reported at the same time and which still hasn't been fixed.
1
1
12
864