github.com/MatheuZSecurity/U… Hey guys, I posted a really cool zine in pure TXT about Unhooking Linux EDR, attacking the cleanup_module function, to be able to remove any hook from an EDR for example. Feel free to read.

Obrigada, Felca, por mostrar que a maioria dos brasileiros tá com o cérebro podre de politicagem, vão se fuder na moralzinha

WE DID IT

Esse título também é seu. 💚

Mission accomplished. I'll post my full talk on Linux malware tactics and evolution when I return (no video allowed at the conference). Thanks to all that attended and the conference organizers for having me!

Casa hora fica pior, não sei como vocês votam num cara desses!!!!!

Hello Unfortunately, @GitHub has banned us. They have orbital nuked the entire malware source code collection.

❌ 🇧🇷 Manoel Gomes, o "Caneta Azul", fica de fora e NÃO É ELEITO deputado federal por São Paulo.

Singularity LKM rootkit evading LiME and Volatility 3 My rootkit hooks walk_system_ram_res so LiME never copies its physical pages and vol3 found nothing CheckFtrace crashes on a poisoned page and pstree, psscan, pslist all come back empty for hidden proc. hidden_modules too.

New issues of @phrack have arrived just in time for the conference!!

Fileless ELF execution via the Linux kernel keyring Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere. matheuzsecurity.github.io/ha… #fileless #malware #linux #keyring

Another cool addition to fileless hiding on Linux. This one using an interesting kernel keyring vector. @SandflySecurity still sees the deleted process, but standard memfd traces are missing. Give @MatheuzSecurity a follow.

Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19. matheuzsecurity.github.io/ha… #linux #redteam #edr #fileless #kernel

This is a very cool way to do fileless loading on Linux bypassing traditional memfd. I hope he doesn't mind, but we detect this out of the box already. Here is a fileless backdoor loaded with his tool. @MatheuzSecurity always does great work and you should follow him. Black boxes below are special surprises we have coming in Sandfly 6.0. Stay tuned.

Microsoft has failed to properly patch ShieldBreak CVE-2026-69414 - msrc.microsoft.com/update-gu… ShieldCrash demonstrates a full bypass of the patch - github.com/MSNightmare/Shiel… Works with latest September 2026 patch

Sneak peek 👀 👀 👀 👀 Coming soon from your friends at Phrack!

New, stealthy (no memfd_create-based) way for Linux Fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). Great stuff from @MatheuzSecurity as always! To keep the hamster wheel spinning :> (#Linux #redteam vs #blueteam), I tried to detect/block this behaviour via hooking into execveat() using the Tetragon Runtime Security Engine. The detection trigger/primitive is, in this case, 4096/0x1000/AT_EMPTY_PATH. Another policy added to my SHIELD Tetra collection, which already contains almost 130 validated policies. In the screenshot, in combination with darkcloak, for which I have a separate set of tracing policies. Links to the projects: - Dntry - Fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH): github.com/MatheuZSecurity/D… - DARKCLOAK - Linux process identity cloaking: github.com/0x574R/Darkcloak