mlwr_blogs

KO | EN

gitlite — search

#javascript #python #typescript #android #machine-learning #rust #deep-learning #docker #macos #nodejs #java #windows #awesome #awesome-list

(★ 80)

collection of blogs about malware development and analysis

mlwr_blogs Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

```text
- █▀▄▀█ █░░ █░█░█ █▀█ █▄▄ █░░ █▀█ █▀▀ █▀
- █░▀░█ █▄▄ ▀▄▀▄▀ █▀▄ █▄█ █▄▄ █▄█ █▄█ ▄█
```

A collection of blogs about **Malware Development** and **Analysis** from talented researchers.

The goal is to inspire your imagination, improve your skills in malware development, and help you learn new techniques.

**Contribute:** If you know of a cool blog about malware, please contribute to this repository!

**Disclaimer:** I am not the author of these blogs. This repository is simply a collection of them. All credit goes to the original authors.

---

## [ MALWARE DEV ]
*(Offensive Tradecraft, Evasion, Internals, Injection)*

- Getting Started With Malware Development - crow.rip - [Click Here](https://www.crow.rip/nest/mal/dev/getting-started)
- Hacking the World with HTML - osandamalith.com - [Click Here](https://osandamalith.com/2020/07/19/hacking-the-world-with-html/)
- Modern implant design: position independent malware development - 5pider.net - [Click Here](https://5pider.net/blog/2024/01/27/modern-shellcode-implant-design/)
- OPSEC: Read the Code Before It Burns Your Op - blacksnufkin.github.io - [Click Here](https://blacksnufkin.github.io/posts/opsec-offensive-code-review/)
- A universal EDR bypass built in Windows 10 - riskinsight-wavestone.com - [Click Here](https://www.riskinsight-wavestone.com/en/2023/10/a-universal-edr-bypass-built-in-windows-10/)
- The Emulator's Gambit: Executing Code from Non-Executable Memory - redops.at - [Click Here](https://redops.at/en/blog/the-emulators-gambit-executing-code-from-non-executable-memory)
- Indirect syscalls and dynamic SSN retrieval via PEB/EAT - redops.at - [Click Here](https://redops.at/blog/indirect-syscalls-and-dynamic-ssn-retrieval-via-peb-eat)
- Syscall Workshop: Bonus Material Part I (APIs) - redops.at - [Click Here](https://redops.at/blog/indirect-syscalls-and-dynamic-ssn-retrieval-via-apis)
- Syscall Workshop: Bonus Material Part III (Hooked SSNs) - redops.at - [Click Here](https://redops.at/blog/indirect-syscalls-and-hooked-ssns)
- Evading the Machine (AI) - steve-s.gitbook.io - [Click Here](https://steve-s.gitbook.io/0xtriboulet/artificial-intelligence/evading-the-machine)
- Using Reflective Loaders to Replace LoadLibrary - racoten.gitbook.io - [Click Here](https://racoten.gitbook.io/red-team-developments-and-operations)
- Unleashing the Unseen: Cobalt Strike Profiles for EDR Evasion - whiteknightlabs.com - [Click Here](https://whiteknightlabs.com/2023/05/23/unleashing-the-unseen-harnessing-the-power-of-cobalt-strike-profiles-for-edr-evasion/)
- Breaking Patterns: Rethinking Assumptions in Code Execution - ioactive.com - [Click Here](https://www.ioactive.com/breaking-patterns-rethinking-assumptions-in-code-execution-and-injection/)
- New AMSI Bypss Technique Modifying CLR.DLL - practicalsecurityanalytics.com - [Click Here](https://practicalsecurityanalytics.com/new-amsi-bypss-technique-modifying-clr-dll-in-memory/)
- Bypass AMSI in 2025 - r-tec.net - [Click Here](https://www.r-tec.net/r-tec-blog-bypass-amsi-in-2025.html)
- Bypass userland hooking using suspended processes - waawaa.github.io - [Click Here](https://waawaa.github.io/en/bypass-userland-hooking-using-suspended-processes/)
- How to Obfuscate C Code - digital.ai - [Click Here](https://digital.ai/catalyst-blog/how-to-obfuscate-c-code/)
- PIC DLL Loaders - tradecraftgarden.org - [Click Here](https://tradecraftgarden.org/tradecraft.html)
- Perfect DLL Hijacking - elliotonsecurity.com - [Click Here](https://elliotonsecurity.com/perfect-dll-hijacking/)
- Hiding in Plain Sight: Unlinking Malicious DLLs from the PEB - blog.christophetd.fr - [Click Here](https://blog.christophetd.fr/dll-unlinking/)
- ThreadlessStompingKann - caueb.com - [Click Here](https://caueb.com/attackdefense/threadlessstompingkann/)
- Module Stomping - dtsec.us - [Click Here](https://dtsec.us/2023-11-04-ModuleStompin/)
- Early Bird APC Injection - chrollo-dll.gitbook.io - [Click Here](https://chrollo-dll.gitbook.io/chrollo/security-blogs/malware-development-and-ttps/early-bird-apc-injection-t1055.004)
- Code & Process Injection - ired.team - [Click Here](https://www.ired.team/offensive-security/code-injection-process-injection/)
- Mockingjay revisited (Process Stomping / sRDI) - naksyn.com - [Click Here](https://www.naksyn.com/edr%20evasion/2023/11/18/mockingjay-revisited-process-stomping-srdi-beacon.html)
- Process Injection Techniques (PDF) - i.blackhat.com - [Click Here](https://i.blackhat.com/USA-19/Thursday/us-19-Kotler-Process-Injection-Techniques-Gotta-Catch-Them-All-wp.pdf)
- File Folding (Origami) - thecontractor.io - [Click Here](https://thecontractor.io/origami/)
- SWAPPALA: Why Change When You Can Hide? - oldboy21.github.io - [Click Here](https://oldboy21.github.io/posts/2024/05/swappala-why-change-when-you-can-hide/)
- Shellcodes are dead, long live Fileless Shellcodes - kleiton0x00.github.io - [Click Here](https://kleiton0x00.github.io/posts/Shellcodes-are-dead-long-live-fileless-shellcodes/)
- COFFLoader: Building your own in memory loader - trustedsec.com - [Click Here](https://www.trustedsec.com/blog/coffloader-building-your-own-in-memory-loader-or-how-to-run-bofs)
- Finding and utilising leaked code signing certificates - tij.me - [Click Here](https://tij.me/blog/finding-and-utilising-leaked-code-signing-certificates/)
- Hack-cessibility: When DLL Hijacks Meet Windows Helpers - trustedsec.com - [Click Here](https://trustedsec.com/blog/hack-cessibility-when-dll-hijacks-meet-windows-helpers)
- WSUS Is SUS: NTLM Relay Attacks in Plain Sight - trustedsec.com - [Click Here](https://trustedsec.com/blog/wsus-is-sus-ntlm-relay-attacks-in-plain-sight)
- ByteViper - ghost-pepper.gitbook.io - [Click Here](https://ghost-pepper.gitbook.io/byte-viper)
- Executing CSharp Assemblies from C code - lsecqt.github.io - [Click Here](https://lsecqt.github.io/Red-Teaming-Army/malware-development/executing-csharp-assemblies-from-c-code/)
- When is it generally safe to CreateRemoteThread? - m417z.com - [Click Here](https://m417z.com/When-is-it-generally-safe-to-CreateRemoteThread/)
- fork() bombing windows - mostwanted002.page - [Click Here](https://mostwanted002.page/post/fork-bomb-windows/)
- Reflective DLL got Indirect Syscall skills - oldboy21.github.io - [Click Here](https://oldboy21.github.io/posts/2024/02/reflective-dll-got-indirect-syscall-skills/)
- The Art of Linux Kernel Rootkits - inferi.club - [Click Here](https://inferi.club/post/the-art-of-linux-kernel-rootkits)
- Mic-E-Mouse (Drivers/Hypervisors) - sites.google.com - [Click Here](https://sites.google.com/view/mic-e-mouse)
- Diving Into Glupteba's UEFI Bootkit - unit42.paloaltonetworks.com - [Click Here](https://unit42.paloaltonetworks.com/glupteba-malware-uefi-bootkit/)
- Read Teaming: How Modern Attackers Bypass EDR - deceptiq.com - [Click Here](https://deceptiq.com/blog/rise-of-read-teaming)

---

## [ MALWARE ANALYSIS & REVERSE ]
*(Dissection, Threat Hunting, Intel, Detection)*

- malware-traffic-analysis.net - malware-traffic-analysis.net - [Click Here](https://www.malware-traffic-analysis.net/)
- Malware analysis (Elastic Security Labs) - elastic.co - [Click Here](https://www.elastic.co/security-labs/topics/malware-analysis)
- Malwarebytes Labs - The Security Blog From Malwarebytes - malwarebytes.com - [Click Here](https://www.malwarebytes.com/blog/category/threat-intel)
- How is my Browser blocking RWX execution? - rwxstoned.github.io - [Click Here](https://rwxstoned.github.io/2025-01-04-Reviewing-browser-hooks/)
- EDR Analysis: Leveraging Fake DLLs, Guard Pages, and VEH - redops.at - [Click Here](https://redops.at/en/blog/edr-analysis-leveraging-fake-dlls-guard-pages-and-veh-for-enhanced-detection)
- Using EMBER2024 to evaluate red team implants - mez0.cc - [Click Here](https://mez0.cc/posts/evaluating-implants-with-ember/)
- Naively bypassing new memory scanning POCs - sillywa.re - [Click Here](https://sillywa.re/posts/flower-da-flowin-shc/)
- Exploit Reversing Blog - exploitreversing.com - [Click Here](https://exploitreversing.com/)
- CS6038/CS5138 Malware Analysis Course - class.malware.re - [Click Here](https://class.malware.re/)
- A Programmer's View On Conti-Locker - swayam-padhy.gitbook.io - [Click Here](https://swayam-padhy.gitbook.io/root/malz/sc/a-programmers-view-on-conti-locker)
- Phantom Persistence - blog.phantomsec.tools - [Click Here](https://blog.phantomsec.tools/phantom-persistence)
- Breaking TadpoleVM - deluks2006.github.io - [Click Here](https://deluks2006.github.io/Reverse-Engineering/Breaking-TadpoleVM)
- Reverse Engineering WeeperVM 2 - x64.ooo - [Click Here](https://x64.ooo/posts/2025-09-14-reverse-engineering-vm-weeper2/)
- Crackmesone CTF - crackmesone.ctfd.io - [Click Here](https://crackmesone.ctfd.io/)
- APT28 campaign targeting Polish government institutions - cert.pl - [Click Here](https://cert.pl/en/posts/2024/05/apt28-campaign/)
- XWorm malware resurfaces with ransomware module - bleepingcomputer.com - [Click Here](https://www.bleepingcomputer.com/news/security/xworm-malware-resurfaces-with-ransomware-module-over-35-plugins/)
- From a Single Click: Lunar Spider Intrusion - thedfirreport.com - [Click Here](https://thedfirreport.com/2025/09/29/from-a-single-click-how-lunar-spider-enabled-a-near-two-month-intrusion/)
- ShadowV2 Botnet Exploits AWS Docker Containers - thehackernews.com - [Click Here](https://thehackernews.com/2025/09/shadowv2-botnet-exploits-misconfigured.html)
- GhostSocks: From Initial Access to Residential Proxy - synthient.com - [Click Here](https://synthient.com/blog/ghostsocks-from-initial-access-to-residential-proxy)
- DHCSpy: Discovering the Iranian APT MuddyWater - shindan.io - [Click Here](https://shindan.io/blog/dhcspy-discovering-the-iranian-apt-muddywater)
- Compliance Threat: RedLine Information Stealer - darktrace.com - [Click Here](https://www.darktrace.com/blog/a-thief-in-red-compliance-and-the-redline-information-stealer)
- PipeMagic in 2025: Tactics changes - securelist.com - [Click Here](https://securelist.com/pipemagic/117270/)
- Geedge & MESA Leak: Great Firewall Document Leak - gfw.report - [Click Here](https://gfw.report/blog/geedge_and_mesa_leak/en/)
- Hunting C2 Panels: Beginner’s Guide - hunt.io - [Click Here](https://hunt.io/blog/hunting-c2-panels-beginners-guide)
- An Attacker’s Blunder Gave Us a Look Into Their Operations - huntress.com - [Click Here](https://www.huntress.com/blog/rare-look-inside-attacker-operation)
- GPUGate Malware: Malicious GitHub Desktop Implants - arcticwolf.com - [Click Here](https://arcticwolf.com/resources/blog/gpugate-malware-malicious-github-desktop-implants-use-hardware-specific-decryption-abuse-google-ads-target-western-europe/)
- Popular Tinycolor npm Package Compromised - socket.dev - [Click Here](https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages)
- AlmondRAT Analysis: Hazy Tiger Lost its Nuts - deluks2006.github.io - [Click Here](https://deluks2006.github.io/Malware-Analysis/AlmondRAT-Analysis)
- New EDR-Freeze tool uses Windows WER - bleepingcomputer.com - [Click Here](https://www.bleepingcomputer.com/news/security/new-edr-freeze-tool-uses-windows-wer-to-suspend-security-software/)
- Learn about ChillyHell, a modular Mac backdoor - jamf.com - [Click Here](https://www.jamf.com/blog/chillyhell-a-modular-macos-backdoor/?trk=feed_main-feed-card_feed-article-content)
- Lazarus and the FudModule Rootkit (Admin-to-Kernel Zero-Day) - gendigital.com - [Click Here](https://www.gendigital.com/blog/insights/research/lazarus-and-the-fudmodule-rootkit-beyond-byovd-with-an-admin-to-kernel-zero-day)

mlwr_blogs

mlwr_blogs Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

mlwr_blogs

mlwr_blogs Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README