Research reports

How-to-use-msfvenom

No excerpt available.

GitHub - FallenAstaroth/stink: the cutest python-native infostealer

No excerpt available.

Infostealers

GitHub - GhostPack/SafetyKatz: SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subtee's .NET PE Loader

First, the MiniDumpWriteDump Win32 API call is used to create a minidump of LSASS to C:\Windows\Temp\debug.bin. Then @subtee's PELoader is used to load a customized version of Mimikatz that runs sekurlsa::logonpasswords and sekurlsa::ekeys on the minidump…

Malware

cti/runster/readme.md at main · cert-orangecyberdefense/cti

Update (2026-06-17): our related "Payload C" is likely tied to MetaStealer and was recently detailed by Huntress, which named it Potemkin loader. Another blog by Walmart on this new DGA is available here. Orange Cyberdefense CERT has been tracking a…

Malware

GitHub - yankywilson/jdy-botnet-threat-analysis: Defensive CTI analysis of the JDY reconnaissance botnet (China-nexus, Volt Typhoon / KV lineage, MITRE G1017): MIPS64 implant reverse engineering, infrastructure enumeration, tiered intelligence reporting, Sigma/YARA detections, and a tasking decryptor. TLP:CLEAR.

A complete defensive analysis of the JDY botnet: reverse engineering of the implant, enumeration of its control infrastructure, three-tier intelligence reporting, deployable detections, and a working tasking decryptor. JDY is a China-nexus reconnaissance…

State-sponsoredMalwareBotnets and DDoS

XenoRAT-Malware-Analysis/Reports/XenoRAT_EN.md at main · Yavuzhanzgen/XenoRAT-Malware-Analysis

This repository is intended solely for malware analysis, reverse engineering research, and educational purposes. All malware samples were analyzed in an isolated laboratory environment. XenoRAT Technical Analysis Report Static Analysis • Dynamic Analysis •…

Malware

threat-research/ancient-botnet at main · ksi-digital/threat-research

We captured a botnet family that calls itself "ancient" in our SSH/Telnet honeypot. Between 2026-10-04 and 2026-10-05 we observed its delivery chain, three iterations of its dropper, and its C2 behaviour. We confirmed its C2 server live. We have not found a…

MalwareBotnets and DDoS