Cyllex

Introducing Cyllex - Advanced APT Emulation Framework. cyllex.io ▸ APT database with real-world campaign emulation ▸ Cross-platform agents via binary patching ▸ Agent, Agentless (WinRM/SSH), and Cloud execution ▸ Direct shell access for real-time interaction ▸ Interactive MITRE ATT&CK detection coverage tracking ▸ Calendar-based campaign scheduling ▸ Webhook notifications (Slack, Teams...) ▸ Robust TTPs: On-Premise (Windows/Linux), Cloud, and Containers and more... I'll be sharing updates as the project evolves. Thank you, and happy new year!

Threat Intel updated · Oct 29, 2026 PHP2Shell leaked before the patch, Volt Typhoon's Silent Train, Node2Shell, Plex2Shell and the latest CISA KEV additions. Every item linked to its primary source. cyllex.io/blog/threat-intel.…

APT Encyclopedia updated: every claim in the 62 profiles checked against its source, wrong citations fixed or removed, all changes logged. Work continues on the extraction agents so only claims a primary source supports make it in. cyllex.io/encyclopedia/?v=1

New writeup: Patch-Gap Zero-Days: BlueMoon. Five China-nexus clusters chained two V8 patch-gap bugs (CVE-2026-85046, CVE-2026-87491) to one Windows ALPC LPE zero-day (CVE-2026-85880) against Chrome on Windows. cyllex.io/blog/posts/bluemoo…

New on the blog: how Lazarus went from a fake job offer to ring 0 with a Windows kernel 0-day (CVE-2026-68820) and the FudModule 3.1 rootkit. cyllex.io/blog/posts/lazarus…

Cyllex v0.4.0: 604 TTPs across 7 platforms. Full Azure & GCP cloud coverage, Kubernetes & Docker container testing, 4 SIEM integrations, and 21 APT group profiles in the new APT Codex. Beta is targeting late March / early April. I track progress publicly, you can see exactly where things stand at any point. One last thing: thank you. Building this solo takes time, and knowing people are actually following along makes it worth it. Every subscription, every piece of feedback, every message asking about the beta reminds me why I started this in the first place. Genuinely appreciate the support. #purpleteam #cyllexframework #aptemulation #mitre #attacksimulation

Big update!, • Events ID added to all the TTPs • SIEM correlation actually works end-to-end now. Splunk, Sentinel, and AWS SecurityHub integrated • Verify detections directly from the Campaigns panel • Run queries from within the framework itself, no need to jump between tools More news coming soon

Spent the weekend working on Cyllex and added a Splunk integration for log correlation. Also added detection events for each TTP. There's still a lot of work ahead, but it's starting to look great! I'll keep working on more integrations. Thanks to everyone who's been showing interest and supporting the project! :) @cyllexframework

New post: Judgment Panda - When China Spies on its "Ally" Russia Deep dive into APT31's 3-year campaign against Russian IT contractors: → VtChatter: Using VirusTotal comments as C2 → CloudyLoader: DLL sideloading + API hashing → IOCs, YARA rules & detection scripts cyllex.io/blog/posts/apt31-j…