@MatheuzSecurity

Red Team Operator, Cyber Threat Intelligence, Malware Researcher

 Brazil
github.com/MatheuZSecurity
Joined September 2020
  • Tweets762
  • Following374
  • Followers2.8K
70Media
MatheuZ retweeted
Drenn@DrennySSOct 20
Obrigada, Felca, por mostrar que a maioria dos brasileiros tá com o cérebro podre de politicagem, vão se fuder na moralzinha
35
1,881
52
11,448
82,090
MatheuZ retweeted
LOUD 🇧🇷
@LOUDggOct 18
WE DID IT
206
6,684
566
32,240
561,952
MatheuZ retweeted
LOUD 🇧🇷
@LOUDggOct 18
Esse título também é seu. 💚
3,476
19,154
1,322
174,486
6,916,975
Mission accomplished. I'll post my full talk on Linux malware tactics and evolution when I return (no video allowed at the conference). Thanks to all that attended and the conference organizers for having me!
2
1
32
1,040
Casa hora fica pior, não sei como vocês votam num cara desses!!!!!
4
4
1
156
3,620
Hello Unfortunately, @GitHub has banned us. They have orbital nuked the entire malware source code collection.
372
611
86
15,899
792,157
❌ 🇧🇷 Manoel Gomes, o "Caneta Azul", fica de fora e NÃO É ELEITO deputado federal por São Paulo.
606
705
666
14,977
391,384
Singularity LKM rootkit evading LiME and Volatility 3 My rootkit hooks walk_system_ram_res so LiME never copies its physical pages and vol3 found nothing CheckFtrace crashes on a poisoned page and pstree, psscan, pslist all come back empty for hidden proc. hidden_modules too.
1
10
57
2,142
New issues of @phrack have arrived just in time for the conference!!
14
130
5,746
Fileless ELF execution via the Linux kernel keyring Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere. matheuzsecurity.github.io/ha… #fileless #malware #linux #keyring

Fileless ELF Execution via Kernel Keyring · 0xMatheuZ

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

matheuzsecurity.github.io
4
45
3
166
13,819
Another cool addition to fileless hiding on Linux. This one using an interesting kernel keyring vector. @SandflySecurity still sees the deleted process, but standard memfd traces are missing. Give @MatheuzSecurity a follow.
MatheuZ@MatheuzSecuritySep 9
Fileless ELF execution via the Linux kernel keyring Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere. matheuzsecurity.github.io/ha… #fileless #malware #linux #keyring

Fileless ELF Execution via Kernel Keyring · 0xMatheuZ

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

matheuzsecurity.github.io
6
52
3,512
Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19. matheuzsecurity.github.io/ha… #linux #redteam #edr #fileless #kernel

Fileless ELF Execution via O_TMPFILE · 0xMatheuZ

O_TMPFILE creates anonymous inodes on real filesystems with no directory entry. Combine it with execveat(AT_EMPTY_PATH) and you get fileless ELF execution that looks nothing like memfd_create in …

matheuzsecurity.github.io
2
44
1
142
10,074
This is a very cool way to do fileless loading on Linux bypassing traditional memfd. I hope he doesn't mind, but we detect this out of the box already. Here is a fileless backdoor loaded with his tool. @MatheuzSecurity always does great work and you should follow him. Black boxes below are special surprises we have coming in Sandfly 6.0. Stay tuned.
MatheuZ@MatheuzSecuritySep 7
Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19. matheuzsecurity.github.io/ha… #linux #redteam #edr #fileless #kernel

Fileless ELF Execution via O_TMPFILE · 0xMatheuZ

O_TMPFILE creates anonymous inodes on real filesystems with no directory entry. Combine it with execveat(AT_EMPTY_PATH) and you get fileless ELF execution that looks nothing like memfd_create in …

matheuzsecurity.github.io
5
30
2,666
Microsoft has failed to properly patch ShieldBreak CVE-2026-69414 - msrc.microsoft.com/update-gu… ShieldCrash demonstrates a full bypass of the patch - github.com/MSNightmare/Shiel… Works with latest September 2026 patch
Abdelhamid Naceri@MSNightmare2000Aug 11
Microsoft has failed to properly patch RoguePlanet (CVE-2026-50656), ShieldBreak, a PoC that demonstrates a full bypass to the previous patch is now public. github.com/MSNightmare/Shiel… The PoC works with the latest August 2026 patch
20
186
11
1,093
68,836
MatheuZ retweeted
Phrack Zine@phrackSep 7
Sneak peek 👀 👀 👀 👀 Coming soon from your friends at Phrack!
4
42
2
213
7,751
New, stealthy (no memfd_create-based) way for Linux Fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). Great stuff from @MatheuzSecurity as always! To keep the hamster wheel spinning :> (#Linux #redteam vs #blueteam), I tried to detect/block this behaviour via hooking into execveat() using the Tetragon Runtime Security Engine. The detection trigger/primitive is, in this case, 4096/0x1000/AT_EMPTY_PATH. Another policy added to my SHIELD Tetra collection, which already contains almost 130 validated policies. In the screenshot, in combination with darkcloak, for which I have a separate set of tracing policies. Links to the projects: - Dntry - Fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH): github.com/MatheuZSecurity/D… - DARKCLOAK - Linux process identity cloaking: github.com/0x574R/Darkcloak
3
17
1
122
5,920
How Singularity rootkit loads clean with 0 alerts, source obfuscation for YARA, trusted_pids map insertion to silence the BPF event, and /var/lib/dkms/ to skip the .ko creation rule. matheuzsecurity.github.io/ha… #Linux #rootkits #edr #eBPF #RedTeam
14
1
51
3,409
Maybe i do a writeup for the new Elastic detection. Bypassing this and presenting the new Singularity rootkit loader #linux #rootkits #malware
3
8
67
2,807
So excited for tmp.0ut 5! There is so much amazing stuff in here. I highly recommend checking out our interview with programming legend Doug McIlroy. It was surreal to get to chat with him. He's 94 now, and was citing papers he was influenced by in the 1940s and 50s...
tmp.0ut@tmpoutAug 23
We are pleased to release tmp.0ut 5 Volume! Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!! tmpout.sh/5/
tmp.0ut 5 Table of Contents - ANSI art featuring a list of 21 papers

ALT tmp.0ut 5 Table of Contents - ANSI art featuring a list of 21 papers

4
47
1
246
19,026
MatheuZ retweeted
tmp.0ut@tmpoutAug 23
We are pleased to release tmp.0ut 5 Volume! Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!! tmpout.sh/5/
tmp.0ut 5 Table of Contents - ANSI art featuring a list of 21 papers

ALT tmp.0ut 5 Table of Contents - ANSI art featuring a list of 21 papers

21
327
23
1,183
85,089
Load more