persistence 7
- RMM Abuse, Four Times Over: How One Fake Webex Download Chained Rocky RMM, ScreenConnect, and Level.io
- They Didn't Hack In, They Logged In: A Six-Shell IIS Backdoor Story
- No File, No Fixed C2: Inside NetCon, a WMI Backdoor That Reads Its Command Server Off the Blockchain
- Thirty days of finger commands: three ClickFix families, one TCP/79 delivery vector
- Telegram Handles, Binary-Encoded PHP, and a Relay Shell: Inside a WordPress Webshell Compromise
- Fake captcha, five layers of RC4, and a Rust stealer with LSA session enumeration and AD recon
- Bring Your Own Node: a PowerShell stager, a blockchain dead-drop, and a RAT that runs on the real Node.js