Research reports

Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:

2019 was an excellent year for the Taiwan superconductor industry; however, beneath this economic upturn, a digital chimera was slowly eating at it from within. Throughout 2019, multiple companies in the Taiwan high-tech ecosystem were victims of an advanced…

State-sponsored

Lx(Base) RAT: A Technical Deep Dive

During a recent malware analysis, I encountered an interesting sample ( 256 : 5a26fd462a809c89b0448318591cb98a77a7b96fca658815dc0f547a51958bed an embedded PowerShell script and Base64-encoded payload that ultimately deploys the sophisticated LxBase .NET RAT.…

Malware

Reverse Engineering the Auto-Color Linux Backdoor

Static and dynamic analysis of Auto-Color’s execution flow, C2 communication, and LD_PRELOAD rootkit. Auto-Color in a Nutshell Auto-Color is an emerging Linux backdoor first documented by Palo Alto Networks Unit 42 in February 2025. The earliest known samples…

Malware

1337_GTWK Linux Malware Analysis

This is the second part of a two-part series about a new Linux malware sample that I analysed (Click here for Part 1). In Part 1, we examined its website and the malware’ itself. The malware consists of two stages, with the second stage comprising two…

Malware

MetaStealer traffic, new DGAs and analyzing the “tracker” backdoor DGA with AI

In this blog we simply want to highlight a few new additions to what appears to be related to MetaStealer, one is a new wordlist based DGA used by MetaStealer. We also want to highlight that MetaStealer’s proxies or ‘gates’ don’t actually care what domain…

Malware

An Angry Spark, or a Triangle in Disguise?

A Union-Jack-clad triangle angrily emits sparks on the screen of a retro monitor (Source: ChatGPT) On April 14, 2026, Gen Digital published “Chasing an Angry Spark”, a report about sophisticated Windows spyware that Gen saw once in 2022, and never again.…

JADEPUFFER: The Dawn of Agentic Ransomware Operations

A landmark report from the Sysdig Threat Research Team has documented the first known case of a truly “agentic” ransomware campaign, orchestrated by a threat actor dubbed JADEPUFFER. Unlike traditional attacks where a human sits behind a terminal, JADEPUFFER…

Ransomware

INC Ransom: Infrastructure Analysis, Operational Tradecraft, and Detection Opportunities

The study was prepared in cooperation with Piotr Chęciński. Executive Summary INC Ransom is an active cybercriminal group operating under the Ransomware-as-a-Service (RaaS) model and has been observed since mid-2023. The group primarily conducts double…

Ransomware

Operation Turb00 — Part 3: Unmasking the SnappyClient RAT

The orchestrator behind the first chain, WizardDa42.exe (the legitimate Radmin VPN process), also launches this second one. Beyond that shared parent process, the two have nothing in common, as

Malware

From XLoader to Phantom Stealer: A DHL-Themed multi-stage Infection Chain

I have identified a multi-stage malware campaign delivering Phantom Stealer v3.5.0 via a DHL-themed spam email. Initial access occurs through a ZIP attachment masquerading as an invoice and requiring user execution. The archive drops a signed Java utility…

Infostealers

Linux Threat Hunting Primer — Part II

In the previous post “Linux Threat Hunting Primer — Part 1” , we discussed how to start the threat hunting process and reviewed the statistical distribution of the Linux tactics and techniques. We also created lists of techniques to search for after…

ArechClient; Decoding IOCs and finding the onboard browser extension

Found myself analyzing ArechClient recently and needed a way to automatically decode out the C2 info from lots of samples. By the end of our work we also discovered that the browser extension being delivered by ArechClient is on board the client itself. The…

Dissecting the ClickFix User-Execution Attack and Its Sophisticated Persistence via ADS

The following analysis presents how an adversary tackled the challenge of malware delivery using a set of techniques that stand out due to their specificity and operational precision. The post is not intended to comprehensively describe the entire campaign or…

Approaching stealers devs : a brief interview with Amadey

To completely understand what’s going on in a market that has been growing in the last years I found mandatory to know which players are dominating it. Always remember that behind every user of the Internet there is another human like you, so if you can be…

Infostealers

Matryoshka : Variant of ROKRAT, APT37 (Scarcruft)

- Scarcruft(a.k.a APT37, Group123)는 북한 배후로 알려진 위협그룹으로 2012년부터 현재까지 지속 적인 공격 활동이 포착되고 있음 Overview Press enter or click to view image in full size

State-sponsored

SocGholish Campaigns and Initial Access Kit

SocGholish AKA FAKEUPDATES was first reported in 2017. While the initial analysis and reporting did not gain much attention, over time the actor(s) behind the activity continued to expand and develop their operations. Partnering with Evil Corp, the FAKEUPDATE…

Winnti: More than just Windows and Gates

The Winnti malware family was first reported in 2013 by Kaspersky Lab¹. Since then, threat actors leveraging Winnti malware have victimized a diverse set of targets for varied motivations. While the name ‘Winnti’ in public reporting was previously used to…

Malware

Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer…

S2W threat research and intelligence center Talon has hunted for and analyzed a sample of what is believed to be a new malware from the Kimsuky group on VirusTotal. — The malware was found to be distributed from a page that redirects users to a specific site…

State-sponsoredMalwareInfostealers

Mapping and Pivoting from Cobalt Strike C2 Infrastructure Attributed to CVE-2021-40444

Threat Actors Infrastructure (VT Analysis). Pivoting from 45.147.229[.]242 Pivoting from 104.194.10[.]21 Pivoting from 45.153.240[.]220 Short summary and IOC’s. Press enter or click to view image in full size Threat Actors C

Vulnerabilities

Investigating the use of VHD files by cybercriminals

In recent investigations, I observed an adversary making use of a VHD attachment to a spear-phishing email being sent. VHD files are ‘Virtual Hard-Disk’ files. Originally the file format was introduced with Connectix Virtual PC and it can store the contents…