SpecterOps

specterops.io

15 July 2026 21:35

Need to do an NTLM relay over C2 but local priv-esc isn't possible? @logangoins.bsky.social new post walks through relaying NTLM auth out of a network and back in through red team infra to bypass traditional relay controls, plus how defenders actually stop it. Check it out: https://ghst.ly/4wA3fkg

SpecterOps

specterops.io

14 January 2026 21:47

SCCM client push strikes again for hierarchy takeover! @logangoins.bsky.social just dropped a new blog showing how WebClient doesn't need to be already running on site servers to coerce HTTP (WebDav) auth & enable NTLM relay to LDAP for SCCM takeover Read more: ghst.ly/3Z9Gbu6

SpecterOps

specterops.io

29 October 2025 03:17

Credential Guard was supposed to end credential dumping. It didn't. Valdemar Carøe just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled. Read for more: ghst.ly/4qtl2rm

SpecterOps

specterops.io

20 October 2025 16:55

Patching one technique doesn't close the entire attack vector. dMSA abuse is still a problem, and @logangoins.bsky.social just dropped a reality check with new tooling to prove it. Learn more about the issue & the new BadTakeover BOF. ghst.ly/42POg9L

SpecterOps

specterops.io

30 August 2025 17:29

Trying to fly under EDR's radar? @logangoins.bsky.social explains how to use HTTP-to-LDAP relay attacks to execute tooling completely off-host through the C2 payload context. Perfect for when you need LDAP access but want to avoid being caught stealing creds. ghst.ly/41mjMv7