Cyber Guardians

Public

Can't Join? @IRCyberGuardians

18.1k Members

Updated: July 20, 2026 at 1:56 AM

Cyber Guardians

RedTeaming TTPs Bug Hunting Web PenTest Web Security Binary Analysis Exploit DEV Malware DEV Malware Analysis BlueTeaming Threat Hunting SOC CSIRT FORENSICS Open-Source Intelligence(OSINT) Cybersec Tools

Join @IRCyberGuardians for exclusive analysis and malware content and discussions in 21

Ranking

Global Ranking

#456

Language Ranking

#45

Category Ranking

#23

-1

Participant Growth (Last 11 Days)

Total: 18.1K

24h growth: +724 4%

Latest Posts

Cyber Guardians

24. Mai 2026, 16:54

New Android interception tool for component communication (IPC) mapping called #noxen for pentesters and bug bounty hunters
Test: https://youtube.com/shorts/JitFuNRCOJ8
Download: https://github.com/frankheat/noxen

842

Cyber Guardians

24. Mai 2026, 16:54

Qilin EDR killer infection chain

https://blog.talosintelligence.com/qilin-edr-killer/

668

Cyber Guardians

24. Mai 2026, 16:54

EntryPoint Hijacking
https://ipurple.team/2026/05/13/entrypoint-hijacking/

669

Cyber Guardians

24. Mai 2026, 16:54

Go fuzzing was missing half the toolkit. We forked the toolchain to fix it.

https://blog.trailofbits.com/2026/05/12/go-fuzzing-was-missing-half-the-toolkit.-we-forked-the-toolchain-to-fix-it./

733

Cyber Guardians

24. Mai 2026, 16:54

YellowKey Bitlocker Bypass Vulnerability

https://github.com/Nightmare-Eclipse/YellowKey

825

Cyber Guardians

24. Mai 2026, 16:54

Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels.

https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn/tree/main

984

Cyber Guardians

24. Mai 2026, 16:54

AI-Powered Reverse Engineering Plugin for IDA Pro

https://github.com/symgraph/IDAssist

790

Cyber Guardians

24. Mai 2026, 16:54

https://github.com/Nightmare-Eclipse/GreenPlasma

Windows CTFMON Arbitrary Section Creation Elevation of Privileges Vulnerability

659

Cyber Guardians

24. Mai 2026, 16:54

https://github.com/v12-security/pocs/tree/main/fragnesia

Universal Linux local privilege escalation exploit. Fragnesia is a member of the Dirty Frag vulnerability class. This is a separate bug in the ESP/XFRM from dirtyfrag which has received its own patch. However, it is in the same surface and the mitigation is the same as for dirtyfrag.

It abuses a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve arbitrary byte writes into the kernel page cache of read-only files, without requiring any race condition.

662

Cyber Guardians

24. Mai 2026, 16:54

https://github.com/DepthFirstDisclosures/Nginx-Rift

CVE-2026-42945, a critical heap buffer overflow in NGINX's ngx_http_rewrite_module introduced in 2008. The bug enables unauthenticated remote code execution against servers using rewrite and set directives.

693

Cyber Guardians

10. Mai 2026, 07:07

Zen and the Art of Microcode Hacking https://bughunters.google.com/blog/zen-and-the-art-of-microcode-hacking

741

Cyber Guardians

10. Mai 2026, 07:07

Digital Forensics: Basic Linux Analysis After Data Exfiltration https://hackers-arise.com/digital-forensics-basic-linux-analysis-after-data-exfiltration/

746

Cyber Guardians

10. Mai 2026, 07:07

https://github.com/L1v1ng0ffTh3L4N/EdgeSavedPasswordsDumper

This tool was created to show that whenever a user stores credentials in Edge (using the Microsoft Password Manager feature, e.g. Autofill), ALL credentials are stored in plaintext in the parent Edge process memory. This is obviously problematic in a shared environment (e.g. on a terminal servers) as an attacker can access all Edge processes for all logged on and disconnected users, and dump their saved credentials. Microsoft has said that this is "by design" and thus won't fix this.

Powershell version: https://gist.github.com/gitgotgitgotit/e28e02a02a358aef189c9c1ee426adf8
Rust version: https://github.com/Whitecat18/Rust-for-Malware-Development/tree/main/BrowserCredsDumper/EdgeSavedPasswordsDumper

539

Cyber Guardians

10. Mai 2026, 07:07

https://github.com/0xMohammedHassan/morphkatz

Rewrites x86-64 machine code inside PE executables and raw shellcode into semantically identical but byte-different equivalents. Same arithmetic, same observable EFLAGS effects, same control-flow — different bytes. That breaks byte-pattern detection (YARA rules, Defender signatures, Elastic rules, Sigma detection content) without changing what the code actually does.

581

Cyber Guardians

10. Mai 2026, 07:07

https://github.com/MWR-CyberSec/VeeamDumper-BOF

A credential extraction BOF for Veeam Backup and Replication and Veeam One

710

Cyber Guardians

10. Mai 2026, 07:07

Redis Cluster Bus Full Takeover — Lab & PoC

https://github.com/dinosn/cluster-bus-takeover/

662

Cyber Guardians

10. Mai 2026, 07:07

AVID is a database of failure modes in general-purpose AI (GPAI) systems, including LLMs, API-only AI systems, developer tooling, and end-to-end applications and agents.

https://avidml.org/database/

714

Cyber Guardians

10. Mai 2026, 07:07

PoC for GHSA-xq3m-2v4x-88gg: Critical RCE in protobuf.js via code injection (CVSS 9.4)

https://github.com/dinosn/CVE-protobufjs-GHSA-xq3m-2v4x-88gg

724

Cyber Guardians

10. Mai 2026, 07:07

Registry Writes Without Registry Callbacks

https://deceptiq.com/blog/ntuser-man-registry-persistence

617

Cyber Guardians

10. Mai 2026, 07:07

Tutorial: Adaptix C2 with ShellcodePack and MacroPack

Original post by Emeric

The article explains how to integrate the Adaptix C2 framework with BallisKit tools ShellcodePack and MacroPack to create stealthy payloads for red-team operations. Adaptix is an open-source command-and-control platform used for post-exploitation and adversarial emulation. The tutorial walks through setting up an Adaptix server on Linux and compiling the GUI client…

https://core-jmp.org/2026/04/tutorial-adaptix-c2-with-shellcodepack-and-macropack/

609

Cyber Guardians

27. Apr. 2026, 21:01

The article introduces COMouflage, a stealthy Windows process-injection technique that abuses the legitimate COM DLL Surrogate mechanism to execute malicious code inside trusted system processes. Instead of directly injecting into a target process, the attacker registers a fake COM object in the Windows registry under HKEY_CURRENT_USER, which does…

https://core-jmp.org/2026/04/comouflage-stealthy-dll-surrogate-injection-for-process-tree-evasion/

553

Cyber Guardians

27. Apr. 2026, 21:01

The article describes a vulnerability discovered in macOS Recovery Mode Safari that allows an attacker with physical access to gain unrestricted write access to system partitions and achieve persistent root-level execution. While exploring Safari inside the macOS Recovery environment, the researcher discovered that downloaded files could be saved to arbitrary…

https://core-jmp.org/2026/04/recovery-mode-breakdown-turning-macos-recovery-safari-into-root-persistence/

658

Cyber Guardians

27. Apr. 2026, 21:01

CustomLoadImage allows for the stealthy reflective loading of . NET assemblies.
This is done by calling AssemblyNative::LoadFromBuffer directly, ensuring that hooks placed on RuntimeAssembly.nLoadImage are not executed.

https://github.com/backdoorskid/CustomLoadImage/tree/main

793

Cyber Guardians

27. Apr. 2026, 21:01

CVE-2026-33017: Unauthenticated RCE in Langflow <= 1.8.2

https://github.com/z4yd3/PoC-CVE-2026-33017

835

Cyber Guardians

27. Apr. 2026, 21:01

A recently disclosed vulnerability CVE-2026-0828 in the Windows kernel driver ProcessMonitorDriver.sys exposes a dangerous capability: any user-mode application that obtains a handle to the device can terminate arbitrary processes, including protected system processes, without proper access-control checks. This flaw effectively bypasses the normal Windows security model that protects critical system services and security components.…

https://core-jmp.org/2026/04/breaking-process-protection-exploiting-cve-2026-0828-in-processmonitordriver-sys/

572

Cyber Guardians

27. Apr. 2026, 21:01

The article provides a technical analysis of a malware component used in Qilin ransomware attacks that is specifically designed to disable endpoint security products. Researchers describe a multi-stage infection chain centered around a malicious msimg32.dll library that ultimately deploys an EDR-killer payload. The loader executes several stages of…

https://core-jmp.org/2026/04/blinding-the-defenders-inside-qilins-edr-killer-malware/

734

Cyber Guardians

27. Apr. 2026, 21:01

The article presents a technical walkthrough of developing a VMware guest-to-host escape exploit, demonstrating how vulnerabilities in virtualization software can break the isolation between a virtual machine and its host system. The research focuses on flaws affecting VMware Workstation, where bugs in virtual device handling and host-side processing logic allow a…

https://core-jmp.org/2026/04/escaping-the-vm-from-guest-code-to-host-compromise-in-vmware-workstation/

898

Cyber Guardians

27. Apr. 2026, 21:01

The article presents a reverse-engineering analysis of a kernel driver used in a BYOVD (Bring Your Own Vulnerable Driver) attack to disable security software, including CrowdStrike Falcon EDR. The researcher discovered multiple variants of a Microsoft-signed driver that expose a dangerous IOCTL interface capable of terminating arbitrary processes. Because the…

https://core-jmp.org/2026/04/signed-to-kill-reverse-engineering-a-0-day-used-to-disable-crowdstrike-edr/

810

Cyber Guardians

27. Apr. 2026, 21:01

The article “Hypervisor-Based Defense” discusses how hypervisors can be used as a powerful defensive layer to protect Windows systems from kernel-level attacks. The author explains that modern attackers frequently target the kernel using techniques such as Bring Your Own Vulnerable Driver (BYOVD) or malicious kernel modules that bypass traditional security…

https://core-jmp.org/2026/04/hypervisor-based-defense-windows-kernel-protection/

595

Cyber Guardians

27. Apr. 2026, 21:01

The article explains how attackers extract authentication secrets from the Local Security Authority Subsystem Service (LSASS) process in Windows. LSASS is responsible for enforcing system security policies, handling logins, and storing authentication data such as NTLM password hashes, Kerberos tickets, and cached credentials in memory.

Because these credentials must remain in…

https://core-jmp.org/2026/04/credential-dumping-from-lsass-windows-authentication-secrets/

521

Showing 30 of 60 posts

Rating

User Reviews (0)

No reviews yet. Be the first to share your experience!

Related Telegram Channels

Loading recommended channels...

Cyber Guardians

Cyber Guardians

Ranking

Participant Growth (Last 11 Days)

Latest Posts

Rating

User Reviews (0)

Related Telegram Channels

memories 𝐂𝐘𝐁ē𝐑𝐋ā𝐖

AXION resist

IHMA Navoiy viloyati

𝓳𝓳'𝓼 𝓬𝓵𝓸𝓼𝓮𝓽 🪽

IT📱💻 WIR KLÄREN AUF ‼️💚

iCSA

cRyPtHoN™ INFOSEC (DE)

Cyberpunk Edgerunners

Related Telegram Channels

memories 𝐂𝐘𝐁ē𝐑𝐋ā𝐖

AXION resist

IHMA Navoiy viloyati

𝓳𝓳'𝓼 𝓬𝓵𝓸𝓼𝓮𝓽 🪽

IT📱💻 WIR KLÄREN AUF ‼️💚

iCSA

cRyPtHoN™ INFOSEC (DE)

Cyberpunk Edgerunners

Latest Posts

User Reviews (0)