Simulating tomorrow’s threats
Joined October 2022
- Tweets293
- Following1
- Followers5.4K
- Likes315
Pinned Tweet
Enterprise Live is now available to purchase for all our customers 😍
Introducing XINTRA Enterprise Live!!!!
Real-world threat simulation with live infrastructure.
Our team took nearly 8 months to build it, and it's finally here :)
We designed it for SOC/IR teams, with the power to collect evidence, deploy your own tools, and assign tasks... along with:
🔹 Fully private infrastructure per customer
🔹 RDP into compromised systems
🔹 Sentinel + ADX integration
🔹 Deploy your own EDR/XDR
🔹 Velociraptor for forensic collection
🔹 Assign hosts to analysts
🔹 Insights hub for team performance
Enquires → [email protected]
xintra.org/labs/enterprise
You’re no longer confined to solving challenges inside a locked-down VM 😉.
With full internet access across all hosts, you can download evidence, upload files, and deploy any tool directly into the environment
@XintraOrg
XINTRA retweeted
I started digging into Win32k callbacks while looking for a PatchGuard bypass. That lead went nowhere, but it raised a better question: how does the Windows kernel choose the callback for session-specific GUI work? idov31.github.io/posts/paint… 1/3
XINTRA retweeted
completed virus vipers: reconstructed a full breach from a phishing delivered shellcode loader through registry hive & LSASS credential dumping, VPN/RDP hopping from an MSSP into a client's network (supply chain attack), timestomping, and into data exfiltration. great lab @XintraOrg
#DFIR #IncidentResponse
XINTRA retweeted
completed waifu university. reconstructed a full breach from an Entra ID password spray and MFA fatigue through RMM abuse, a Cobalt Strike beacon, malicious service persistence, anti forensics, and into ransomware staging. great lab @XintraOrg
deep dive on the ransomware: securityscorecard.com/resour…
#DFIR #IncidentResponse
XINTRA retweeted
Every time I think I've had enough of IR&TH, I solve a lab on @XintraOrg just to humble myself.
XINTRA retweeted
@inversecos reached out to me a few months ago to work on this APT28 lab, and I finally had the chance to collaborate with the legendary @ZephrFish to make it great and entertaining. And now it's LIVE! 👀
Really enjoyed analyzing Andy's emulation while building out the IR questions, especially regarding IoT compromise, ADCS, and the classic Outlook CVE.
Come check it out at XINTRA
xintra.org/
#dfir #APT28
NEW LAB: Global Freight UA 🚛
We emulated a CISA report on APT28/Russian GRU targeting Ukrainian logistics .
This lab is packed with IoT compromise, CCTV and surveillance platform access with:
- Outlook / CVE-2023-23397 forced authentication
- HEADLACE-style staging + DLL sideloading
- AD CS abuse + certificate-based privilege escalation
- CCTV, IoT and camera compromise
- Anti-forensics techniques
Contributors
@ZephrFish @r3nzsec
Solve it here 👇
xintra.org
NEW LAB: Global Freight UA 🚛
We emulated a CISA report on APT28/Russian GRU targeting Ukrainian logistics .
This lab is packed with IoT compromise, CCTV and surveillance platform access with:
- Outlook / CVE-2023-23397 forced authentication
- HEADLACE-style staging + DLL sideloading
- AD CS abuse + certificate-based privilege escalation
- CCTV, IoT and camera compromise
- Anti-forensics techniques
Contributors
@ZephrFish @r3nzsec
Solve it here 👇
xintra.org
This lab is modeled on tradecraft associated with APT28, the Russian GRU-linked espionage group commonly tracked as Fancy Bear / Unit 26165.
The closest public analog is CISA’s May 21, 2025 advisory on Russian GRU targeting of Western logistics entities and technology companies supporting Ukraine.
cisa.gov/news-events/cyberse…
XINTRA retweeted
I just realised why they used @MDSecLabs - probably because they saw the MustangPanda simulation lab we did for @XintraOrg @inversecos - a APT with a sense of humour! 😂 @jamieantisocial mashtitle.com/2025/06/27/cou…
XINTRA retweeted
After more than a year in the making it is finally out and available here: xintra.org/courses/11-window… :)
I will always do open source and publish papers but I've been working for a long time to create a course for people that want structured and in-depth content 1/
NEW XINTRA COURSE!!!🥳
Windows Kernel: Offensive, Defensive & Reverse Engineering by @Idov31
xintra.org/courses/11-window…
Build an EDR and rootkits from scratch while mastering the Windows kernel.
Over 70 videos and labs covering:
> Build your own EDR (detection + prevention)
> Rootkits & offensive tradecraft
> Reversing Windows kernel & drivers
> Kernel callbacks, ETW, minifilter and more
There are preview videos too if you wanna see some snippets of the course content ;)
This course is instructed by Ido Veltzman (@Idov31), a senior security researcher specializing in reverse engineering, operating system internals, vulnerability research, and exploit development.
His work spans UEFI, hypervisors, kernel, and user mode, where he has developed advanced evasion, persistence, and injection techniques.
@XintraOrg
XINTRA retweeted
NEW XINTRA COURSE!!!🥳
Windows Kernel: Offensive, Defensive & Reverse Engineering by @Idov31
xintra.org/courses/11-window…
Build an EDR and rootkits from scratch while mastering the Windows kernel.
Over 70 videos and labs covering:
> Build your own EDR (detection + prevention)
> Rootkits & offensive tradecraft
> Reversing Windows kernel & drivers
> Kernel callbacks, ETW, minifilter and more
There are preview videos too if you wanna see some snippets of the course content ;)
This course is instructed by Ido Veltzman (@Idov31), a senior security researcher specializing in reverse engineering, operating system internals, vulnerability research, and exploit development.
His work spans UEFI, hypervisors, kernel, and user mode, where he has developed advanced evasion, persistence, and injection techniques.
@XintraOrg
XINTRA retweeted
Working on the upcoming @XintraOrg lab 🇷🇺 while shipping new features for the Mac timeline analysis tool.
Using these simulated attack scenarios to stress-test the gear before it hits the field. Almost there... 😅
#dfir #Xintra
XINTRA retweeted
NEW LAB: NavalTech Defense Contractor ⚓
We emulated a North Korean (DPRK) cyber espionage campaign targeting a submarine contractor’s vessel-tracking systems.
Based on CISA’s reporting on DPRK operations to advance military and nuclear programs.
Contributors
@django88_ @svch0st @XintraOrg
Solve it here 👇
xintra.org
XINTRA retweeted
What separates Chinese cyber ops from Five Eyes?
Three things that shifted my thinking about this topic:
1. Early cyber training (90s-2000s) happened on live targets.
Not sandboxes, not simulations...actual foreign infrastructure. The "practice" was the operation. Operational errors caught during IR back then weren't failures of tradecraft... they were the cost of learning on production.
2. The private sector operates as APT infrastructure.
Cybersecurity companies founded by former 2000s hackers (Topsec, i-SOON, Integrity Tech) were later publicly linked to state-directed operations. The line between "legitimate vendor" and "APT contractor" is deliberately blurred (by design).
3. Operators don't stay siloed in their APT group.
They rotate across teams for decades, carrying often the exact same tools, tactics with them. What we label as "different APT groups" is often the same people with different hats.
This makes attribution way messier than the tidy narrative we see in threat reports.
Worth reading this epic report published by the Zurich Centre for Security Studies if this stuff keeps you up at night:
ethz.ch/content/dam/ethz/spe…
XINTRA retweeted
This was a really fun one todo, spent ages getting the ivanti appliance exploit working, some really interesting paths in there to check out!
NEW LAB: APT40 Ivanti Exploitation
APT40 (Chinese Hainan State Security Department) targets the Department of Trade and Finance of Meow Islands by exploiting a vulnerable Ivanti appliance.
The investigation involves:
🔸Ivanti Connect Secure exploitation
🔸Appliance filesystem forensics
🔸Edge device to internal pivoting
🔸Sideloading through trusted antivirus binaries
Enterprise "LIVE" customers receive full RDP access to all appliances and devices involved in the investigation.
Contributors
Adversarial Emulation @ZephrFish
Incident Response @svch0st
Solve it here xintra.org
First blood for our new lab "Meow Islands" congrats tmechen! 😍
NEW LAB: APT40 Ivanti Exploitation
APT40 (Chinese Hainan State Security Department) targets the Department of Trade and Finance of Meow Islands by exploiting a vulnerable Ivanti appliance.
The investigation involves:
🔸Ivanti Connect Secure exploitation
🔸Appliance filesystem forensics
🔸Edge device to internal pivoting
🔸Sideloading through trusted antivirus binaries
Enterprise "LIVE" customers receive full RDP access to all appliances and devices involved in the investigation.
Contributors
Adversarial Emulation @ZephrFish
Incident Response @svch0st
Solve it here xintra.org
XINTRA retweeted
NEW LAB: APT40 Ivanti Exploitation
APT40 (Chinese Hainan State Security Department) targets the Department of Trade and Finance of Meow Islands by exploiting a vulnerable Ivanti appliance.
The investigation involves:
🔸Ivanti Connect Secure exploitation
🔸Appliance filesystem forensics
🔸Edge device to internal pivoting
🔸Sideloading through trusted antivirus binaries
Enterprise "LIVE" customers receive full RDP access to all appliances and devices involved in the investigation.
Contributors
Adversarial Emulation @ZephrFish
Incident Response @svch0st
Solve it here xintra.org
XINTRA retweeted
The next decade of cyber conflict will decide how the world operates.
If you want to work on technology that defines the future and makes real impact, come build it with us @XintraOrg
xintra.org/jobs
XINTRA retweeted
Completed the Waifu University lab by @XintraOrg
Write up here
mikecybersec.notion.site/Wai…
