@MatheuzSecurity

Red Team Operator, Cyber Threat Intelligence, Malware Researcher

 Brazil
github.com/MatheuZSecurity
Joined September 2020
  • Tweets762
  • Following374
  • Followers2.8K
70Media
github.com/MatheuZSecurity/U… Hey guys, I posted a really cool zine in pure TXT about Unhooking Linux EDR, attacking the cleanup_module function, to be able to remove any hook from an EDR for example. Feel free to read.
5
47
180
16,094
MatheuZ retweeted
Drenn@DrennySSOct 20
Obrigada, Felca, por mostrar que a maioria dos brasileiros tá com o cérebro podre de politicagem, vão se fuder na moralzinha
34
1,864
52
11,376
79,616
MatheuZ retweeted
LOUD 🇧🇷
@LOUDggOct 18
WE DID IT
206
6,685
565
32,267
553,517
MatheuZ retweeted
LOUD 🇧🇷
@LOUDggOct 18
Esse título também é seu. 💚
3,477
19,159
1,321
174,705
6,833,776
Mission accomplished. I'll post my full talk on Linux malware tactics and evolution when I return (no video allowed at the conference). Thanks to all that attended and the conference organizers for having me!
2
1
32
1,026
Casa hora fica pior, não sei como vocês votam num cara desses!!!!!
4
4
1
156
3,618
Hello Unfortunately, @GitHub has banned us. They have orbital nuked the entire malware source code collection.
376
611
86
15,909
791,724
❌ 🇧🇷 Manoel Gomes, o "Caneta Azul", fica de fora e NÃO É ELEITO deputado federal por São Paulo.
609
705
666
15,043
391,009
Singularity LKM rootkit evading LiME and Volatility 3 My rootkit hooks walk_system_ram_res so LiME never copies its physical pages and vol3 found nothing CheckFtrace crashes on a poisoned page and pstree, psscan, pslist all come back empty for hidden proc. hidden_modules too.
1
10
57
2,135
Singularity LKM rootkit evading LiME and Volatility 3 My rootkit hooks walk_system_ram_res so LiME never copies its physical pages and vol3 found nothing CheckFtrace crashes on a poisoned page and pstree, psscan, pslist all come back empty for hidden proc. hidden_modules too.
1
10
57
2,135
github.com/MatheuZSecurity/S…

GitHub - MatheuZSecurity/Singularity: Stealthy Linux Kernel Rootkit

Stealthy Linux Kernel Rootkit. Contribute to MatheuZSecurity/Singularity development by creating an account on GitHub.

github.com
1
4
246
New issues of @phrack have arrived just in time for the conference!!
14
130
5,743
Fileless ELF execution via the Linux kernel keyring Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere. matheuzsecurity.github.io/ha… #fileless #malware #linux #keyring

Fileless ELF Execution via Kernel Keyring · 0xMatheuZ

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

matheuzsecurity.github.io
4
45
3
166
13,812
Another cool addition to fileless hiding on Linux. This one using an interesting kernel keyring vector. @SandflySecurity still sees the deleted process, but standard memfd traces are missing. Give @MatheuzSecurity a follow.
MatheuZ@MatheuzSecuritySep 9
Fileless ELF execution via the Linux kernel keyring Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere. matheuzsecurity.github.io/ha… #fileless #malware #linux #keyring

Fileless ELF Execution via Kernel Keyring · 0xMatheuZ

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

matheuzsecurity.github.io
6
52
3,511
Fileless ELF execution via the Linux kernel keyring Stored an ELF in kernel slab memory via the keyring and ran it with a direct jump. There is no execve, no fd and no inode anywhere. matheuzsecurity.github.io/ha… #fileless #malware #linux #keyring

Fileless ELF Execution via Kernel Keyring · 0xMatheuZ

Using the Linux kernel keyring to stage an ELF in slab memory and execute it via userland exec, skipping execve and the filesystem entirely.

matheuzsecurity.github.io
4
45
3
166
13,812
Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19. matheuzsecurity.github.io/ha… #linux #redteam #edr #fileless #kernel

Fileless ELF Execution via O_TMPFILE · 0xMatheuZ

O_TMPFILE creates anonymous inodes on real filesystems with no directory entry. Combine it with execveat(AT_EMPTY_PATH) and you get fileless ELF execution that looks nothing like memfd_create in …

matheuzsecurity.github.io
2
44
1
142
10,068
This is a very cool way to do fileless loading on Linux bypassing traditional memfd. I hope he doesn't mind, but we detect this out of the box already. Here is a fileless backdoor loaded with his tool. @MatheuzSecurity always does great work and you should follow him. Black boxes below are special surprises we have coming in Sandfly 6.0. Stay tuned.
MatheuZ@MatheuzSecuritySep 7
Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19. matheuzsecurity.github.io/ha… #linux #redteam #edr #fileless #kernel

Fileless ELF Execution via O_TMPFILE · 0xMatheuZ

O_TMPFILE creates anonymous inodes on real filesystems with no directory entry. Combine it with execveat(AT_EMPTY_PATH) and you get fileless ELF execution that looks nothing like memfd_create in …

matheuzsecurity.github.io
5
30
2,666
Microsoft has failed to properly patch ShieldBreak CVE-2026-69414 - msrc.microsoft.com/update-gu… ShieldCrash demonstrates a full bypass of the patch - github.com/MSNightmare/Shiel… Works with latest September 2026 patch
Abdelhamid Naceri@MSNightmare2000Aug 11
Microsoft has failed to properly patch RoguePlanet (CVE-2026-50656), ShieldBreak, a PoC that demonstrates a full bypass to the previous patch is now public. github.com/MSNightmare/Shiel… The PoC works with the latest August 2026 patch
21
186
11
1,094
68,798
MatheuZ retweeted
Phrack Zine@phrackSep 7
Sneak peek 👀 👀 👀 👀 Coming soon from your friends at Phrack!
4
42
2
213
7,736
New, stealthy (no memfd_create-based) way for Linux Fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). Great stuff from @MatheuzSecurity as always! To keep the hamster wheel spinning :> (#Linux #redteam vs #blueteam), I tried to detect/block this behaviour via hooking into execveat() using the Tetragon Runtime Security Engine. The detection trigger/primitive is, in this case, 4096/0x1000/AT_EMPTY_PATH. Another policy added to my SHIELD Tetra collection, which already contains almost 130 validated policies. In the screenshot, in combination with darkcloak, for which I have a separate set of tracing policies. Links to the projects: - Dntry - Fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH): github.com/MatheuZSecurity/D… - DARKCLOAK - Linux process identity cloaking: github.com/0x574R/Darkcloak
3
17
1
122
5,916
Wrote a post on fileless ELF execution via O_TMPFILE + execveat(AT_EMPTY_PATH). No memfd_create, no named file, no dentry ever created. Process shows up as /tmp/#220 (deleted) in telemetry. Works since kernel 3.19. matheuzsecurity.github.io/ha… #linux #redteam #edr #fileless #kernel

Fileless ELF Execution via O_TMPFILE · 0xMatheuZ

O_TMPFILE creates anonymous inodes on real filesystems with no directory entry. Combine it with execveat(AT_EMPTY_PATH) and you get fileless ELF execution that looks nothing like memfd_create in …

matheuzsecurity.github.io
2
44
1
142
10,068
Load more