Publications

UFC 666 : Frontkick vs Rikugan

13/10/2026 In the right corner: free, open-source, boasting 678 stars on GitHub, undisputed champion of agentic AI on IDA, and a serious contender on Binary Ninja—meet Rikugan! Facing off against it, still lesser-known but determined to take over from its cousin Sidekick, here comes Frontkick, a dedicated agent for Binary Ninja. Which will prevail: ToolAgent or CodeAct? Let the fight begin!

Simulating legitimate Active Directory services on the network: the case of GPO exploitation

31/08/2026 Simulating legitimate Active Directory services on an internal network is a powerful and versatile capability that can be leveraged in various contexts. Many examples of exploits relying on the ability to simulate working LDAP and/or SMB services can be cited, such as Group Policy Object exploitation or, more recently, the Certighost (CVE-2026-54121) ADCS flaw. This is something that we started working on several years ago in the context of GPO exploitation (see this article as well as this article). The present publication introduce...

AWS EKS forensics: data sources and investigation tooling

24/08/2026 Investigating a compromise in Amazon EKS means piecing together evidence spread across three layers: the managed Kubernetes control plane, the worker nodes, and the surrounding AWS services. This article maps the data sources an EKS cluster exposes for digital forensics and threat hunting, and the tooling used to correlate them, from the Kubernetes audit log down to the AWS identity of the nodes.

Exploiting Titan Quest

29/07/2026 Titan Quest is a hack-and-slash video game released in 2006. In 2016, THQ Nordic released an Anniversary Edition. In the version provided by GOG, several development tools are installed with the game. These allow for the creation of new maps, items, and effects. This article details the various vulnerabilities found in the game engine as well as their exploitation.

The SQL Server Unicode problem: why your data might not be what you think it is?

10/07/2026 Having examined Unicode handling in other databases, we will see that its implementation in SQL Server proves to be particularly complex. We will discover how the burden of backwards compatibility has given rise to new features which, in reality, have serious shortcomings.

KYC: Bypass age verification using generative video models

06/07/2026 Historically reserved for the banking sector, the KYC (Know Your Customer) process is now making its way into many online services, driven by increasingly strict legislation on anonymity and age verification. To comply, platforms deploy significant measures aimed at guaranteeing the "proof of life" of the user behind their webcam or smartphone. However, the meteoric rise of generative video AI models completely reshuffles the deck, offering attackers formidable and accessible tools to fool these systems. The French PVID framework aims...

Exploring cross-domain & cross-forest RBCD: part 2

02/07/2026 Kerberos delegation capabilities in Linux-based tooling have been extended to allow impersonating any user within a forest. This assumed identity can then be leveraged to access resources across any domain within that forest, or even in a remote forest, provided that a trust relationship exists and appropriate delegation rights are configured. This article provides a deep dive into recursive Kerberos delegation exchanges through complex multi-domain chains. Finally, we demonstrate the feasibility of the SPN-less RBCD attack in both cr...

Caught in the Octopus Trap: Unauthenticated RCE in Argo CD with CodeQL

01/07/2026 Synacktiv has discovered an unauthenticated arbitrary code execution vulnerability in ArgoCD's repo-server component, potentially allowing full cluster compromise. This article explains how the vulnerability was identified using CodeQL, details the exploitation process to gain control over the underlying Kubernetes cluster, and introduces a tool for automating the attack.

Completing Compliance with Evidence : A Bottom-Up Approach to NIS2, DORA, and the Cyber Resilience Act

30/06/2026 GRC (Governance, Risks and Compliance) as it is most often practiced works top-down, you read a piece of regulation, draft a policy, declare coverage, and archive a documentary record. This approach has value, it structures, it documents, it meets an auditor's formal expectations. It also has a known limitation: it mostly reflects what the organization describes and far less easily what actually happens.

Charting your way in: Helm template injection

29/06/2026 During the audit of a Kubernetes cluster, we encountered an injection in a Helm template applied through ArgoCD. To our surprise, very few resources exist regarding YAML injection in vulnerable Helm templates. In this blog post, we will explore this kind of vulnerability and how to prevent its exploitation.