MatheuZ @MatheuzSecurity

Red Team Operator Cyber Threat Intelligence Malware Researcher github.com/MatheuZSecurity Brazil Joined September 2020

Tweets

583
Followers

1K
Following

359
Likes

1K

Blue Team News @blueteamsec1

a week ago

RingReaper: Linux post-exploitation agent that uses io_uring to stealthily bypass EDR detection by avoiding traditional syscalls. dlvr.it/TMnmYr #cyber #threathunting #infosec

0 4 8 2K 6

Phrack Zine @phrack

3 weeks ago

At long last - Phrack 72 has been released online for your reading pleasure! Check it out: phrack.org

7 328 742 111K 243

Download Image

Adding new papers to the malware library. Please review them. They're cool and badass. 2024-06-06 - A fully functional NtCreateProcess mimicking Windows 2025-04-01 - Unhooking Linux EDRs 2025-07-31 - Notes on RAM_DISK_CONTEXT 2025-07-31 - Red Team Tactics Evading EDR on Linux…

4 13 105 14K 37

MatheuZ @MatheuzSecurity

2 months ago

RingReaper can easily bypass Linux Sophos EDR. src: github.com/MatheuZSecurit… Currently, using this technique is FUD against (what I've tested); - TrendMicro EDR - Cortex XDR - Sophos EDR #ringreaper #io_uring #malware #c2 #poc #edr

1 85 293 16K 146

Download Image

Craig Rowland - Agentless Linux Security @CraigHRowland

2 months ago

We are being used to monitor a remotely driven car fleet from @vay_io. They needed reliable and safe Linux monitoring and we provide that with agentless @SandflySecurity. They have an awesome tech with cars in Vegas. I'll be trying one at Black Hat!

Sandfly Security @SandflySecurity

2 months ago

0 0 2 1K 0

0 1 9 911 0

Eletro Vibez @eletro_vibez

2 months ago

Sexy Bitch #Tomorrowland

44 728 5K 291K 418

Download Video

MatheuZ @MatheuzSecurity

2 months ago

RingReaper can bypass falco and modern linux EDRs. Check: github.com/MatheuZSecurit… Detailed article: matheuzsecurity.github.io/hacking/evadin… #malware #io_uring #edr #rootkit #falcon #linux

3 89 279 17K 184

Download Image

MatheuZ @MatheuzSecurity

2 months ago

I just published a new post on Red Team Tactics: Evading EDR on Linux with io_uring, and also shared the RingReaper project I used for the POC. RingReaper: github.com/MatheuZSecurit… Article: matheuzsecurity.github.io/hacking/evadin… #malware #c2 #io_uring #redteam

1 53 219 11K 136

Download Image

MatheuZ @MatheuzSecurity

3 months ago

Using io_uring to break LD_PRELOAD Rootkit Hooks. Join us: discord.gg/66N5ZQppU7 matheuzsecurity.github.io/hacking/using-… #rootkits #linux #io_uring #malware #ldpreload

2 42 142 9K 67

Download Image

MatheuZ @MatheuzSecurity

4 months ago

Hello everyone! Today I published a really cool post about how to bypass LD_PRELOAD rootkit hooks using a very and simple technique. matheuzsecurity.github.io/hacking/bypass… #rootkit #ldpreload #linux #bypass

5 52 156 9K 75

Download Image

MatheuZ @MatheuzSecurity

5 months ago

Article: matheuzsecurity.github.io/hacking/gcc/ Github: github.com/MatheuZSecurit… ElfDoor-gcc is an LD_PRELOAD that hijacks gcc to inject malicious code into binaries during linking, without touching the source code. #malware #gcc #ldpreload #linux

4 143 520 37K 271

Download Image

MatheuZ @MatheuzSecurity

5 months ago

github.com/MatheuZSecurit… Hey guys, I posted a really cool zine in pure TXT about Unhooking Linux EDR, attacking the cleanup_module function, to be able to remove any hook from an EDR for example. Feel free to read.