From Fork to Framework: What Modifying Apollo Taught Us About Agent Invasion

BOFScale runs a patched Tailscale daemon as a BOF-PE inside the implant, relaying C2 over standard WebSockets so DERP and control-plane traffic blends in behind CDNs like CloudFront and Fastly.

Describes how attackers can submit phishing domains to web content filter categorization services so corporate filters whitelist the sites, improving success rates in phishing engagements.

Provides an automated installer and configuration guide for Throwback, a beaconing backdoor with a PHP/MySQL C2 server, covering ThrowbackLP setup and agent deployment for red team use.

Traces the evolution of offensive PowerShell invocation from powershell.exe command lines to in-memory .NET loading with UnmanagedPowerShell, evading process creation monitoring.

Veil-Evasion generates obfuscated payloads in C, C#, PowerShell, and Python that slip past signature-based antivirus, with Python payloads bundling Meterpreter reverse HTTPS for encrypted shells.

Bishop Fox compares Rust and C/C++ for malware: larger, harder-to-analyze binaries complicate reverse engineering and can slip past signature detection — demonstrated with a simple shellcode dropper.