LockBit 5.0 Linux encrypts files with zero network activity, uses ChaCha20 with Curve25519 key exchanges, and actively evades strace-based monitoring. This post documents the full analysis pipeline: eBPF tracing, static RE with Ghidra, and triple-confirmed network behavior analysis.

A technical analysis of why deterministic security problems cannot be solved with probabilistic AI solutions, and why container/RBAC approaches provide stronger guarantees.

Fixed-interval sleeps make system behavior predictable. Break that pattern with LCG-based jitter — combine rdtsc entropy with LCG scrambling and deliver randomized delays via nanosleep.

Static analysis tools like Ghidra and AI-driven EDRs rely on branching instructions to map malicious behavior. Discover how replacing JMPs with CMOV instructions creates a ‘Flat Graph’ illusion that completely blinds heuristic engines.

Combining SROP with Syscall 311 provides a stealthy way to load shellcode. Learn how to hide syscalls and manipulate context while surviving the debugging hell of unnoticeable opcodes.