persistence 5
- No File, No Fixed C2: Inside NetCon, a WMI Backdoor That Reads Its Command Server Off the Blockchain
- Thirty days of finger commands: three ClickFix families, one TCP/79 delivery vector
- Telegram Handles, Binary-Encoded PHP, and a Relay Shell: Inside a WordPress Webshell Compromise
- Fake captcha, five layers of RC4, and a Rust stealer with LSA session enumeration and AD recon
- Bring Your Own Node: a PowerShell stager, a blockchain dead-drop, and a RAT that runs on the real Node.js