🎯 Living off the Land

The items that name it 7

• IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
  article2026-10-29It is written here as Living-off-the-land: abuse of VPN access, traffic mirroring and management protocols for backdoors, exfiltration and reconnaissance.
• [tl;dr sec] #348 - Google's PageBreak Scanner, Perplexity's Agent Security Tool, Defending Agentically
  article2026-10-01

  AI agents use curl, tcpdump and throwaway Python scripts as normal work, which breaks tripwire detections

• Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
  writeup2026-09-09It is written here as Living-off-the-land (LOTL).

  UAT-11988 abused legitimate built-in FMC tooling (package_info.pl) to conduct reconnaissance, credential harvesting, and deploy malicious packages

• Every Ransomware Attack Has a Backstory
  article2026-07-15It is written here as Living off the Land (LoTL).

  Attackers use trusted native tools and processes (PowerShell, RMM tools, built-in Windows admin utilities) instead of custom malware to blend in as normal administration and avoid detection.

• ZX41R/awesome-reverse-engineering-and-malware-analysis
  repo2026-07-06

  abusing pre-installed binaries, LOLBAS/GTFOBins family

• Hiding in Plain Sight with App Domain Manager Injection
  writeup2026-02-19

  Abusing native operating system binaries and trusted applications to execute, persist, or move laterally in a breached network, rather than deploying overt malware

• Detecting and countering misuse of AI: September 2026
  article