_Ray @_RayRT

Senior Adversarial Engineer at Lares, Member of EVILCORP\Domain Fathers. https://t.co/SIwC7MLXmP Joined June 2018

Tweets

679
Followers

353
Following

837
Likes

3K

BlackArrow @BlackArrowSec

2 days ago

AvePoint has fixed a vulnerability in DocAve, Perimeter and Compliance Guardian discovered by our researchers @m1ntko and @Calvaruga. This vulnerability can be used to achieve Remote Code Execution (RCE) in affected systems. ➡️ Advisory: avepoint.com/company/docave…

0 8 9 839 0

Download Image

Lares @Lares_

a week ago

Understanding #ScatteredSpider is key to smarter defense. At Lares, we simulate advanced TTPs: social engineering, malware, lateral movement & exfiltration, to expose gaps and improve readiness. ✍️Raúl Redondo (@_RayRT), Senior Adversarial Engineer buff.ly/l5GvTbw

1 1 3 211 0

Luke Turvey @TurvSec

2 months ago

I've got ~5000 IP addresses to port scan for an engagement this week. Ax did it for me in minutes using hundreds of AWS EC2s. Ez github.com/attacksurge/ax

7 28 154 9K 129

Luke Turvey @TurvSec

2 months ago

CVE-2025-50061, is a stored XSS @s0lfer and I found when testing an Oracle product a couple months ago. CVE details and fix will be released in a couple days 🙏

3 1 6 738 1

Ricardo Ruiz @RicardoJoseRF

2 months ago

I wrote a short post about how you only need the NtReadVirtualMemory address for dynamic API resolution, plus how you could use a vulnerable binary to leak its address (and you would not have GetProcAddress, GetModuleHandle or LoadLibrary in the IAT) - github.com/ricardojoserf/…

1 14 33 2K 16

SEKTOR7 Institute @SEKTOR7net

2 months ago

Modern lateral movement techniques detection (mainly DCOM/DCE/RPC/RDP) with examples. Some assumptions worth mentioning: visibility into source IP/port/hostname, logon activity, remote process metadata. A blog post by @HuntressLabs team. Awesome read, guys!…

1 62 248 10K 123

Download Image

Praetorian @praetorianlabs

3 months ago

🚨 New attack disclosed: GitHub Device Code Phishing John, Matt, and Mason reveal how they've been using this technique to compromise F500 orgs with high success rates. 📖 Blog covers methodology, red team case studies & detection strategies praetorian.com/blog/introduci…

1 63 155 68K 93

Synacktiv @Synacktiv

3 months ago

Microsoft just released the patch for CVE-2025-33073, a critical vulnerability allowing a standard user to remotely compromise any machine with SMB signing not enforced! Checkout the details in the blogpost by @yaumn_ and @wil_fri3d. synacktiv.com/publications/n…

5 261 596 195K 343

RedTeam Pentesting @RedTeamPT

3 months ago

🎉 It is finally time for a new blog post! 🎉 Join us on our deep dive into Windows Authentication Coercion and its current state in 2025, including some brand-new tooling ✨ #itsec #infosec #pentest #redteam blog.redteam-pentesting.de/2025/windows-c…

4 55 106 9K 65

Arun @dazzyddos

4 months ago

The original BadSuccessor research by @YuG0rd was too good to ignore, I couldn't wait to replicate it in my lab. I wrote a short post on operationalizing the technique with real-world, stealthy abuse paths. medium.com/p/429cefc36187

1 57 182 22K 104

Yuval Gordon @YuG0rd

4 months ago

🚀 We just released my research on BadSuccessor - a new unpatched Active Directory privilege escalation vulnerability It allows compromising any user in AD, it works with the default config, and.. Microsoft currently won't fix it 🤷‍♂️ Read Here - akamai.com/blog/security-…

22 374 868 158K 453

Download Image

Oliver Lyak @ly4k_

4 months ago

👇 github.com/ly4k/Certipy/d…

16 126 298 36K 60

🕳 @sekurlsa_pw

5 months ago

Certipy-merged has these PRs merged compared to the orginal Certipy from @ly4k_ . And now also Kerberos ADCS web enrollment support. So you probably want the merged version 🙃.

ret2src @ret2src

5 months ago

Certipy-merged has these PRs merged compared to the orginal Certipy from @ly4k_ . And now also Kerberos ADCS web enrollment support. So you probably want the merged version 🙃. https://t.co/ZA0aDtdv4W

1 23 86 14K 28

0 35 123 29K 52

Download Image

krp @_kripteria

4 months ago

Im happy to announce Neo4LDAP — a query and visualization tool focused on Active Directory environments. It combines LDAP syntax with graph-based data analysis in Neo4j, offering an alternative approach to tools like BloodHound. youtube.com/watch?v=5V22K3… 🧵: 1/4

3 28 56 8K 39

Jonathan Peters @cod3nym

4 months ago

Stumbled over this new AMSI bypass. It works by manipulating the COM RPC communication used by AMSI to talk to AV engines. By hooking NdrClientCall3 which handles the RPC calls we can intercept AMSI scan requests before they reach the AV engine. I wrote a simplified version that…

0 61 145 20K 72

Andrea P @decoder_it

4 months ago

I just published a blog post where I try to explain and demystify Kerberos relay attacks. I hope it’s a good and comprehensive starting point for anyone looking to learn more about this topic. ➡️decoder.cloud/2025/04/24/fro…

2 149 352 19K 226

Binni Shah @binitamshah

4 months ago

NativeTokenImpersonate - a tool to impersonate users by stealing their tokens using only NTAPI functions : ricardojoserf.github.io/nativetokenimp… Impersonate Tokens using only NTAPI functions : github.com/ricardojoserf/… credits @RicardoJoseRF

0 30 89 6K 46

Charlie Bromberg « Shutdown » @_nwodtuhs

5 months ago

Kerberos relay on The Hacker Recipes, brought to you by @BlWasp_ 💪 thehacker.recipes/ad/movement/ke…

4 58 183 8K 62

Orange Cyberdefense's SensePost Team @sensepost

5 months ago

The S is for Security. How to use WinRMS as a solid NTLM relay target, and why it’s less secure than WinRM over HTTP. By @Defte_ Writeup: sensepost.com/blog/2025/is-t… PR to impacket: github.com/fortra/impacke… Demo: youtu.be/3mG2Ouu3Umk

1 44 120 10K 61

FalconForce Official @falconforceteam

5 months ago

We are proud to introduce #dAWShund to the world: a framework for putting a leash on naughty AWS permissions. dAWShund helps blue and red teams find resources in #AWS, evaluate their access levels and visualize the relationships between them. falconforce.nl/dawshund-frame…