UNC1739
Offensive security research. Web exploitation. Red team tradecraft.
// featured research
Centurion: Bring Your Own Execution Environment
A virtualized loader built in a week using LLM-assisted development. Custom ISA, PE loader, TLS stack, and software crypto coprocessor all running as interpreted bytecode — with only an ~18 KB native stub.
read the post →Qlik Sense Vulnerability Chain (ZeroQlik / DoubleQlik)
HTTP request tunneling and path traversal vulnerabilities enabling unauthenticated remote code execution. Exploited by Cactus ransomware and Magnet Goblin. Added to CISA KEV catalog.
view all cves →// recent posts
FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 2 of 2)
Two LLM-assisted exploit chains that escape a FreeBSD jail — a stack overflow paired with a stack infoleak to beat canaries and KASLR, and a heap overflow paired with pipe-file type confusion to defeat SMEP/SMAP — plus the staged L0-L4 pipeline that made the model effective.
FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 1 of 2)
How Claude Code turned up roughly eight FreeBSD kernel vulnerabilities in a few days, including CVE-2026-3038 — covering deep research for bug patterns, CodeQL and semgrep variant hunting, a KASAN feedback loop, and where the model hallucinated or cheated.
Centurion: Bring Your Own Execution Environment
How we built a custom virtualized loader with its own ISA, PE loader, TLS stack, and software crypto coprocessor in about a week using LLM-assisted development — and what the BYOEE model means for offensive tooling.
Et Tu, Default Creds? Introducing Brutus for Modern Credential Testing
Introducing Brutus, a multi-protocol credential testing tool for penetration testers and red teams. Covers default credential validation, SSH bad key testing, and pipeline integration with modern reconnaissance workflows.