Cybersecurity articles tagged #Living-off-the-Land on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/node-js-abuse-attackers-deploy-malware-via-trusted-runtimehttps://runtimerebel.com/blog/node-js-abuse-attackers-deploy-malware-via-trusted-runtimeThreat actors are leveraging Node.js as a signed, trusted tool to deploy various malicious payloads, evading detection in targeted attacks since February 2026.Thu, 03 Sep 2026 12:22:47 GMTNode JsMalware DeliveryClickFixLiving-off-the-LandEtherHidinghttps://runtimerebel.com/blog/microsoft-removes-wmic-tool-in-windows-11-to-curb-living-off-the-land-tacticshttps://runtimerebel.com/blog/microsoft-removes-wmic-tool-in-windows-11-to-curb-living-off-the-land-tacticsMicrosoft removes the legacy WMIC tool from Windows 11 builds to disrupt living-off-the-land techniques used by ransomware and malware.Tue, 18 Aug 2026 08:25:06 GMTMicrosoftWindows 11RansomwareMalwareLiving-off-the-Landhttps://runtimerebel.com/blog/finance-executive-email-compromise-via-native-windows-toolshttps://runtimerebel.com/blog/finance-executive-email-compromise-via-native-windows-toolsA monthslong campaign targeted a global stock exchange executive, leveraging native Windows tools for persistence and unauthorized email monitoring.Wed, 03 Jun 2026 13:50:15 GMTFinancial SectorEmail SecurityLiving-off-the-LandM365 Securityhttps://runtimerebel.com/blog/microsoft-coreutils-for-windows-security-and-memory-safety-analysishttps://runtimerebel.com/blog/microsoft-coreutils-for-windows-security-and-memory-safety-analysisMicrosoft introduces native Linux Coreutils for Windows via Rust. Analyze the security impact, memory safety benefits, and potential living-off-the-land risks.Wed, 03 Jun 2026 01:09:39 GMTMicrosoftCoreutilsRustWindows SecurityLiving-off-the-Landhttps://runtimerebel.com/blog/weaponized-trust-analyzing-the-abuse-of-administrative-utilitieshttps://runtimerebel.com/blog/weaponized-trust-analyzing-the-abuse-of-administrative-utilitiesResearch reveals how threat actors leverage legitimate tools like PowerShell and WMIC to bypass detection by masquerading as routine administration.Fri, 15 May 2026 12:44:24 GMTLiving-off-the-LandPowerShellWmicAdversary TacticsBitdefenderhttps://runtimerebel.com/blog/gopherwhisper-apt-abuses-legitimate-services-in-government-attackshttps://runtimerebel.com/blog/gopherwhisper-apt-abuses-legitimate-services-in-government-attacksChina-linked APT GopherWhisper targets Southeast Asian governments using Go-based backdoors and legitimate cloud services for stealthy C2 communications.Sat, 25 Apr 2026 12:20:45 GMTGopherWhisperGo Based MalwareSoutheast AsiaGovernment TargetingLiving-off-the-Landhttps://runtimerebel.com/blog/microsoft-defender-binaries-exploited-as-attack-toolshttps://runtimerebel.com/blog/microsoft-defender-binaries-exploited-as-attack-toolsSecurity researchers have identified methods to subvert Microsoft Defender binaries for malicious code execution and EDR bypass. Learn how to defend.Wed, 22 Apr 2026 08:44:37 GMTMicrosoft DefenderLiving-off-the-LandMpCmdRun ExeLockBitEDR Bypasshttps://runtimerebel.com/blog/mitigating-the-rise-of-trusted-tool-abuse-in-modern-cyberattackshttps://runtimerebel.com/blog/mitigating-the-rise-of-trusted-tool-abuse-in-modern-cyberattacksExplore why threat actors are pivoting from malware to Living-off-the-Land (LotL) techniques by abusing trusted administrative tools and native binaries.Wed, 01 Apr 2026 12:26:47 GMTLiving-off-the-LandLOTLAdversary TtpsEndpoint SecurityDefense Evasion