00Archive

Research notes.

Published write-ups across 0-days, n-days, malware, and anything else that earned a note. Drafts stay off this list until they are cleared.

SearchTypeRisk

2 results

00MalwareNo CVEHighPublic

beacon.exe: custom Go C2 found in the wild

Found beacon.exe in the wild. The filename begged for Sliver. The pclntab and the C2 URLs said otherwise: a privately built Go implant with HTTPS plus framed TCP, AES-256-GCM, and a full post-ex menu. Not Sliver. Not Cobalt. Not stock Adaptix.

19 Aug 2026n/a (private C2; callback on PEG TECH / AROSSCLOUD)

Read analysis→

01N-dayNo CVEInfoPublic

Can a Rubber Ducky do Plug & Pwn?

I opened plugandpwn.com with a Rubber Ducky on the desk and a stupid hope in my heart. Ten minutes later the hope was gone. Different USB device. Different primitive. Different trust boundary. Here is the teaching cut.

18 Aug 2026n/a (HID vs Windows PnP)

Read analysis→