@MatheuzSecurity

Red Team Operator, Cyber Threat Intelligence, Malware Researcher

 Brazil
github.com/MatheuZSecurity
Joined September 2020
  • Tweets762
  • Following374
  • Followers2.8K
70Media
github.com/MatheuZSecurity/U… Hey guys, I posted a really cool zine in pure TXT about Unhooking Linux EDR, attacking the cleanup_module function, to be able to remove any hook from an EDR for example. Feel free to read.
5
47
180
16,100
MatheuZ retweeted
Drenn@DrennySSOct 20
Obrigada, Felca, por mostrar que a maioria dos brasileiros tá com o cérebro podre de politicagem, vão se fuder na moralzinha
35
1,881
52
11,448
82,079
MatheuZ retweeted
LOUD 🇧🇷
@LOUDggOct 18
WE DID IT
206
6,684
566
32,240
561,883
MatheuZ retweeted
LOUD 🇧🇷
@LOUDggOct 18
Esse título também é seu. 💚
3,476
19,152
1,322
174,483
6,916,182
Mission accomplished. I'll post my full talk on Linux malware tactics and evolution when I return (no video allowed at the conference). Thanks to all that attended and the conference organizers for having me!
2
1
32
1,040
Casa hora fica pior, não sei como vocês votam num cara desses!!!!!
4
4
1
156
3,620
Hello Unfortunately, @GitHub has banned us. They have orbital nuked the entire malware source code collection.
372
611
86
15,899
792,151
❌ 🇧🇷 Manoel Gomes, o "Caneta Azul", fica de fora e NÃO É ELEITO deputado federal por São Paulo.
607
705
666
14,981
391,378
Singularity LKM rootkit evading LiME and Volatility 3 My rootkit hooks walk_system_ram_res so LiME never copies its physical pages and vol3 found nothing CheckFtrace crashes on a poisoned page and pstree, psscan, pslist all come back empty for hidden proc. hidden_modules too.
1
10
57
2,142
Singularity LKM rootkit evading LiME and Volatility 3 My rootkit hooks walk_system_ram_res so LiME never copies its physical pages and vol3 found nothing CheckFtrace crashes on a poisoned page and pstree, psscan, pslist all come back empty for hidden proc. hidden_modules too.
1
10
57
2,142
github.com/MatheuZSecurity/S…

GitHub - MatheuZSecurity/Singularity: Stealthy Linux Kernel Rootkit

Stealthy Linux Kernel Rootkit. Contribute to MatheuZSecurity/Singularity development by creating an account on GitHub.

github.com
1
4
250
New issues of @phrack have arrived just in time for the conference!!
14
130
5,746
Fileless ELF execution via the Linux kernel keyring Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere. matheuzsecurity.github.io/ha… #fileless #malware #linux #keyring

Fileless ELF Execution via Kernel Keyring · 0xMatheuZ

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

matheuzsecurity.github.io
4
45
3
166
13,819
Another cool addition to fileless hiding on Linux. This one using an interesting kernel keyring vector. @SandflySecurity still sees the deleted process, but standard memfd traces are missing. Give @MatheuzSecurity a follow.
MatheuZ@MatheuzSecuritySep 9
Fileless ELF execution via the Linux kernel keyring Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere. matheuzsecurity.github.io/ha… #fileless #malware #linux #keyring

Fileless ELF Execution via Kernel Keyring · 0xMatheuZ

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

matheuzsecurity.github.io
6
52
3,512
Fileless ELF execution via the Linux kernel keyring Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere. matheuzsecurity.github.io/ha… #fileless #malware #linux #keyring

Fileless ELF Execution via Kernel Keyring · 0xMatheuZ

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

matheuzsecurity.github.io
4
45
3
166
13,819
Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19. matheuzsecurity.github.io/ha… #linux #redteam #edr #fileless #kernel

Fileless ELF Execution via O_TMPFILE · 0xMatheuZ

O_TMPFILE creates anonymous inodes on real filesystems with no directory entry. Combine it with execveat(AT_EMPTY_PATH) and you get fileless ELF execution that looks nothing like memfd_create in …

matheuzsecurity.github.io
2
44
1
142
10,074
This is a very cool way to do fileless loading on Linux bypassing traditional memfd. I hope he doesn't mind, but we detect this out of the box already. Here is a fileless backdoor loaded with his tool. @MatheuzSecurity always does great work and you should follow him. Black boxes below are special surprises we have coming in Sandfly 6.0. Stay tuned.
MatheuZ@MatheuzSecuritySep 7
Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19. matheuzsecurity.github.io/ha… #linux #redteam #edr #fileless #kernel

Fileless ELF Execution via O_TMPFILE · 0xMatheuZ

O_TMPFILE creates anonymous inodes on real filesystems with no directory entry. Combine it with execveat(AT_EMPTY_PATH) and you get fileless ELF execution that looks nothing like memfd_create in …

matheuzsecurity.github.io
5
30
2,666
Microsoft has failed to properly patch ShieldBreak CVE-2026-69414 - msrc.microsoft.com/update-gu… ShieldCrash demonstrates a full bypass of the patch - github.com/MSNightmare/Shiel… Works with latest September 2026 patch
Abdelhamid Naceri@MSNightmare2000Aug 11
Microsoft has failed to properly patch RoguePlanet (CVE-2026-50656), ShieldBreak, a PoC that demonstrates a full bypass to the previous patch is now public. github.com/MSNightmare/Shiel… The PoC works with the latest August 2026 patch
20
186
11
1,093
68,836
MatheuZ retweeted
Phrack Zine@phrackSep 7
Sneak peek 👀 👀 👀 👀 Coming soon from your friends at Phrack!
4
42
2
213
7,751
New, stealthy (no memfd_create-based) way for Linux Fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). Great stuff from @MatheuzSecurity as always! To keep the hamster wheel spinning :> (#Linux #redteam vs #blueteam), I tried to detect/block this behaviour via hooking into execveat() using the Tetragon Runtime Security Engine. The detection trigger/primitive is, in this case, 4096/0x1000/AT_EMPTY_PATH. Another policy added to my SHIELD Tetra collection, which already contains almost 130 validated policies. In the screenshot, in combination with darkcloak, for which I have a separate set of tracing policies. Links to the projects: - Dntry - Fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH): github.com/MatheuZSecurity/D… - DARKCLOAK - Linux process identity cloaking: github.com/0x574R/Darkcloak
3
17
1
122
5,920
Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19. matheuzsecurity.github.io/ha… #linux #redteam #edr #fileless #kernel

Fileless ELF Execution via O_TMPFILE · 0xMatheuZ

O_TMPFILE creates anonymous inodes on real filesystems with no directory entry. Combine it with execveat(AT_EMPTY_PATH) and you get fileless ELF execution that looks nothing like memfd_create in …

matheuzsecurity.github.io
2
44
1
142
10,074
Load more