BOFScale: A CDN-Fronted Tailnet from a BOF-PE

Describes how attackers can submit phishing domains to web content filter categorization services so corporate filters whitelist the sites, improving success rates in phishing engagements.

Provides an automated installer and configuration guide for Throwback, a beaconing backdoor with a PHP/MySQL C2 server, covering ThrowbackLP setup and agent deployment for red team use.

Traces the evolution of offensive PowerShell invocation from powershell.exe command lines to in-memory .NET loading with UnmanagedPowerShell, evading process creation monitoring.

Bishop Fox forked Mythic's Apollo agent and built a custom obfuscator to evade EDR, but Apollo's architecture assumed readable symbol names — obfuscation failed, pushing a from-scratch redesign.

Part 2 of Viettel's Lotus Blossom series explains Domain Fronting, showing how attackers abuse CDN behavior to make C2 traffic resemble legitimate connections by mismatching TLS SNI and Host headers.

English Part 2 of the Lotus Blossom series explains Domain Fronting: how abusing CDN behavior and mismatching TLS SNI with the Host header lets C2 traffic look like legitimate connections.