Emotet botnet was taken down in 2021 after running for about 12 years. It used stolen SMTP credentials to send backdoored Office documents and was disrupted by a coalition of eight countries that pushed a self-remove update.
Key points
Duration: botnet ran for about 12 years before takedown in 2021.
Coalition action: eight countries hacked the command-and-control infrastructure and used the malware’s self-update command to push code that removed the malware.
Sources
Cairn – solved 54/54 problems, placed 3rd at Tencent Cloud Hackathon
Cairn is a general-purpose problem-solving engine that won 3rd place at the Tencent Cloud Hackathon AI Penetration Testing Challenge by solving all 54 problems. The system uses a blackboard architecture with Fact, Intent and Hint primitives and runs worker agents on Claude Code, Codex or Pi backends.
Key points
54 / 54 problems solved, only team to achieve AK at the competition.
Final ranking: 3rd place.
Sources
- Original post
- Cairn - Linked page
- github.com - Linked in the post
- github.com - Linked in the post
- github.com - Linked in the post
- github.com - Linked in the post
- github.com - Linked in the post
- github.com - Linked in the post
- github.com - Linked in the post
- github.com - Linked in the post
- github.com - Linked in the post
- github.com - Linked in the post
- github.com - Linked in the post
- github.com - Linked in the post
- github.com - Linked in the post
- github.com - Linked in the post
- github.com - Linked in the post
- github.com - Linked in the post
Mythic v4 adds direct RDP and VNC via Guacamole
Mythic v4 adds direct RDP and VNC functionality via Guacamole using a new interactive streaming mode. It may be a tough watch from a mobile device, so a larger screen is recommended.
Key points
Direct RDP and VNC functionality via Guacamole.
New interactive streaming mode from the mythic agent; No rportfwd involved.
Sources
SonicWall SonicOS SSL VPN CVE-2026-19868 added to KEV
SonicWall SonicOS SSL VPN vulnerability CVE-2026-19868 is now listed in the KEV Catalog. The entry highlights a single-factor authentication issue. Apply mitigations to protect your organization.
Key points
CVE-2026-19868 vulnerability in SonicWall SonicOS SSL VPN uses single-factor authentication
Added to the KEV Catalog for tracking and mitigation guidance
Sources
Windows-DNS-Policy-Manager adds browser GUI, 8 wizards
Windows-DNS-Policy-Manager provides a browser-based GUI for Windows Server DNS and includes eight scenario wizards. It supports policies, zones, records, DNSSEC, DNS over HTTPS and blocklists. The interface uses a Next.js frontend with a PowerShell bridge and an MCP server for AI agents.
Key points
Features: policies, zones, records, DNSSEC, DNS over HTTPS, blocklists
Stack: Next.js frontend, PowerShell bridge, MCP server for AI agents
Sources
- Original post
- ktp.sh - Linked in the post
HyperLoader hypervisor isolated shellcode executor
HyperLoader is a hypervisor isolated shellcode execution environment that maps host process memory into a guest vCPU. It intercepts DLL execute faults, proxies API calls to the host, and is Stardust PIC shellcode compatible.
Key points
Maps host process memory into a guest vCPU
Intercepts DLL execute faults and proxies API calls to the host
Sources
- Original post
- ktp.sh - Linked in the post
