implants Archives

AppWizard

March 16, 2026

Marathon review in progress – exquisite gunplay and striking aesthetics cover up some frustrating cracks

Three bags of loot are accompanied by the bio-synthetic remains of their former owners, with pools of blue blood marking the ground. The narrator has transitioned from collaborating with players in Arc Raiders to a more competitive spirit in Marathon. The game features a striking user interface and vibrant aesthetics, but some aspects, like item transitions and menu designs, can be clunky and confusing. The map layouts have engaging points of interest but also feature obstructive barriers. The gunplay is praised for its quality, with balanced gameplay and challenging PvE enemies. PvP encounters have a quick time-to-kill, and environmental dangers add intensity. However, faction quests often rely on repetitive tasks, which can be frustrating despite the compelling narrative elements. The narrator expresses surprise at their engagement with the game and suggests that improvements to the user experience and quest diversity could enhance its longevity.

AppWizard

March 4, 2026

Marathon feels like the yin to my Arc Raiders yang

In Arc Raiders, players can collaborate through features like proximity chat and shared objectives, while also facing formidable foes. The game emphasizes a relaxed atmosphere with opportunities for camaraderie among players. In contrast, Marathon fosters a competitive mindset, encouraging aggressive interactions and a focus on maximizing player-versus-player effectiveness. The first-person perspective in Marathon aligns with a competitive gameplay style, while the third-person viewpoint in Arc Raiders promotes social interaction and community engagement. Both games provide safety nets for players to recover lost resources, but they offer distinctly different experiences in terms of gameplay dynamics and player interactions.

Winsage

January 29, 2026

Swarmer Tool Evading EDR With a Stealthy Modification on Windows Registry for Persistence

Praetorian Inc. has launched Swarmer, a tool that enables low-privilege attackers to maintain stealthy persistence in the Windows registry while avoiding detection by Endpoint Detection and Response (EDR) systems. Swarmer uses mandatory user profiles and the Offline Registry API to modify the NTUSER hive without triggering standard registry hooks. It operates by creating an NTUSER.MAN file that replaces the NTUSER.DAT hive upon user login, allowing low-privilege users to manipulate registry settings without alerting EDR tools. Swarmer employs functions from Microsoft’s Offline Registry Library, enabling it to perform operations without invoking Reg* API calls, thus evading detection mechanisms. Swarmer's workflow involves exporting the HKCU registry, modifying it, and executing the tool with specific commands to place the modified NTUSER.MAN file into the user profile. It can be used as an executable or a PowerShell module. While it presents a novel method for persistence, Swarmer has limitations, such as being unable to update without admin access and requiring user login to activate. Detection strategies include monitoring for NTUSER.MAN file creation and Offreg.dll usage in non-standard processes.

Winsage

November 5, 2025

Russian APT abuses Windows Hyper-V for persistence and malware execution

Cyber attackers used the Import-VM and Start-VM PowerShell cmdlets to introduce a virtual machine named WSL into Hyper-V. This virtual machine hosts a compact Alpine Linux environment with two implants, CurlyShell and CurlCat, identified by Bitdefender. CurlyShell uses libcurl to connect to a command-and-control server, creating a reverse shell to execute commands and return outputs. CurlCat functions as a proxy, tunneling SSH traffic through HTTP requests to evade detection by network monitoring tools.