Atsika (@_atsika) header
Atsika (@_atsika) profile picture

Red Team enthusiast | Malware development enjoyer | Adversary Simulation at @quarkslab

Unknown
Joined April 2020
Photo by Atsika (@_atsika)Photo by Atsika (@_atsika)Photo by Atsika (@_atsika)Photo by Atsika (@_atsika)Photo by Atsika (@_atsika)Photo by Atsika (@_atsika)Photo by Atsika (@_atsika)Photo by Atsika (@_atsika)Photo by Atsika (@_atsika)
🥳 ProxyBlob V2 is now available 🎉 As promised, here is the new version of ProxyBlob, boosted with aznet. Az-what 🤔? This version introduces a new Go module called aznet that allows you to use Azure storage services (not just blobs 😏) as a direct replacement for net.Conn! 🏎️github.com/Atsika/aznet 🌐github.com/quarkslab/proxybl… Complete documentation is available in the aznet repo to understand how it works 📚
1
29
1
70
6,292
Atsika retweeted
Halloween Update 🎃👻 Added numerous new features related to operational security, introduced WebSockets as a communication channel, added file based P2P capabilities, improved the user interface, and fixed bugs reported by customers found within the malleable C2 profile system. Another exciting addition is independent ingress/egress listener configuration, allowing operators to use separate communication channels for task requests and returning execution results simultaneously! I recorded a small video demonstration of said feature. YouTube Link below🔗
10
11
156
6,987
Atsika retweeted
🇫🇷 Salut tout le monde! Avec ma team ctf la Meowcorp on organise des conférences à l’ESNA Bretagne le 21/11/26 de 10h à 18h Au programme: fun, goodies, des talks de qualités sur des sujets variés ainsi qu’un repas via traiteur On vous attend nombreux! helloasso.com/associations/e…
1
9
13
685
Atsika retweeted
I’m testing a simulation module for the AMOS stealer (using ESF events and file usage patterns that are nearly identical to the actual stealer), it’s quite something to see that it still works on some hardened systems...
1
1
91
I wish this existed for linux as well, would help me a lot during engagements 😅
You remember seeing it. You don’t remember where. Screenlogger remembers. 0.2.0 brings a fresh UI, less disk usage, and search powered by local @googlegemma embeddings. An always-on screen recorder for Mac. Describe what you saw. Find it again. All on your Mac.
1
2
276
Atsika retweeted
While everybody is prompting for PHP, recently I ended up having to dump the LSA in a custom way. I have written a short article on the entire LSA decryption stack, with the C implémentation. 💫 Cross posted here blog.advens-c.tf/articles/ls… and here hideandsec.sh/books/windows-…
31
111
4,040
I’ve been using ProxyBlob for a week on a target running CrowdStrike. The tool worked like a charm. Btw, it was made by my colleague @_atsika Definitely worth checking his tool 🚰 github.com/quarkslab/proxybl…
29
2
100
6,106
🚨 EVILGINX EXTENSION IS OUT🚨 I am happy to say the free Evilginx Chrome extension has been approved and is finally available for download. 🥳 You can now safely import your captured session cookies, knowing that the cookie manager you're using came from a reputable source, along with the "trust me bro" quality seal. For a long time, I wanted to make the task of finding the cookies that hold session tokens much easier. With the Evilginx extension, you can now speed up the trial-and-error process when testing multiple cookie configurations to see whether you're still authenticated after a page reload (no more restoring cookie backups from external JSON files). I made this extension for myself, and I use it to kickstart the development of every single phishlet I make. Now you can too! 💪 To properly celebrate the release and help you get the most out of the extension, I released a walkthrough video with a rundown of all the features and a hands-on tutorial on how to use it to kickstart the development of your own phishlet for GitHub. Enjoy and happy phishing! 💗🪝🐟 Disclaimer: AI was used to develop the extension. UX, UI design, and minor code tweaks originated from a human brain. Code was read using human eyes. P.S. GitHub repo will arrive later. 🔗 Links can be found below 👇
10
37
2
181
9,212
Atsika retweeted
We are preparing an optional MCP server for the next version of MacroPack, ShellcodePack, and DarwinOps! This interface will come in addition to the existing CLI and GUI for our customers who want to integrate redteam tooling with agentic AI! 🤖 #redteam
4
19
1,104
New blog is live: blog.safetech.red 🦀 🔥 Red and Purple notes, and first article out: 📝 The origins of RustHound-CE Why I built an AD collector in Rust back in 2021, what the BloodHound Community Edition turn changed, and where the tool stands today. The original post had disappeared with the old company website, so it is back online, rewritten and up to date. EN: blog.safetech.red/rusthound-… FR: blog.safetech.red/fr/rusthou…
2
13
49
3,360
RustPack Release 1.8.0 was shipped to our customers recently. Short Blogpost with the most relevant new features for everyone here 🔥🔥 msecops.de/blog/posts/rustpa… #RedTeam #OST #Pentest #Maldev
14
1
77
11,695
Atsika retweeted
On Nov 9th the Outflank R&D team will host a live demo of their offensive security product OST. What to expect during 60 minutes? ☁️ Initial access techniques for cloud 🥷 Evasion of leading EDR products 📡 Next-gen C2 framework ⚙️ Kernel tradecraft register.gotowebinar.com/reg…
1
15
85
4,821
Atsika retweeted
Need to disable any EDR in post exploitation? Here is a simple tutorial showing how to do that using BallisKit EDR Eclipse! EDR Eclipse is also compatible with ShellcodePack and MacroPack formats as well as all major C2s! blog.balliskit.com/tutorial-… #redteam
26
127
8,294
Oh come on @kaluche_, we can't wait anymore for the next AV 😩
Not an antivirus product this time, but we couldn't pass it up 🙈 @CatoNetworks said: route with split tunneling. @kaluche_ heard: root with split tunneling. Check out CVE-2026-10739, a LPE vulnerability in the Cato VPN Client for Windows ➡️ blog.quarkslab.com/cato-vpn-…
1
199
Atsika retweeted
Not an antivirus product this time, but we couldn't pass it up 🙈 @CatoNetworks said: route with split tunneling. @kaluche_ heard: root with split tunneling. Check out CVE-2026-10739, a LPE vulnerability in the Cato VPN Client for Windows ➡️ blog.quarkslab.com/cato-vpn-…
1
6
2
25
2,328
Atsika retweeted
Need to pivot through a macOS target during a Red Team operation? 🍎 Mirage C2 includes built-in SOCKS proxying, letting operators route traffic through a compromised Mac and reach resources beyond the initial foothold. Start it. Pivot. Keep moving. Part of DarwinOps by BallisKit. #RedTeam #macOS
6
19
1,051
Atsika retweeted
⚠️CVE-2026-18963 (CVSS 9.1)⚠️ Critical Unauthenticated Account Takeover vulnerability in Keycloak’s reset-credentials flow. In affected Keycloak 26.x versions, unauthenticated attackers can bypass email verification during password recovery and continue the reset-credentials flow. This allows an attacker who knows a target username or email address to set new credentials without accessing the victim’s email, resulting in full account takeover. Patched versions include 26.4.15, 26.6.6, and 26.7.2. Users should upgrade to a fixed release. 🔥PoC + Vulnerable environment: github.com/EQSTLab/CVE-2026-… #Keycloak #AccountTakeover #AuthenticationBypass #PasswordReset #CWE640 #CyberSecurity #CVE #PoC #Exploit #CVE_2026_18963
6
48
2
319
28,495