Latest
Tag: loader
A signed “RMM agent” that hides the lure you just clicked: inside BlackCrypt
Two EV-signed files, a downloader and a "BlackCrypt RMM Agent", look like obscure IT software. Run with a real enrollment code, the operator's server immediately sent scripts to…
A signed “video editor” that fakes its own failure and leaves two back doors behind
A signed fake video-editor installer shows a robot check and a fake driver error while installing two separate back doors: a SYSTEM service and a Node.js program that…
A signed loader, a Cobalt Strike Beacon, and C2 traffic dressed up as CrowdStrike
A three-day Microsoft Trusted Signing certificate, a ChaCha20 shellcode loader with side-door syscalls, and a Cobalt Strike Beacon whose traffic impersonates CrowdStrike Falcon.
About
Rogue Authority LLC — cybersecurity consulting and open-source tooling for the security community.
View Projects