The newly identified SPECTRE implant represents an evolution in commodity intrusion tooling, integrating cross-platform C2 operations, process injection, credential theft, anti-analysis protections, a...

Technical blog by Stephan Berger (@malmoeb)

Introducing velociraptor-skills, a set of reusable AI skills for DFIR with Velociraptor.

Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objec...

Kaspersky GERT experts dive into the technical incident analysis of PAYLOAD ransomware: an encryptionless, binary-less operation that abused Active Directory mechanisms for managing Group Policy Objec...

We look at a new version of the MacSync macOS stealer with a backdoor module that targets crypto enthusiasts and developers.

Extract Windows credentials directly from VM memory snapshots and virtual disks - nikaiw/VMkatz

Huntress researcher uncovers post-Black Hat & DEF CON phishing campaign using X DMs & malicious documents to deliver AMOS, NetSupport RAT, and other malware.

Technical blog by Stephan Berger (@malmoeb)

From a VHDX File to a Remcos RAT, Author: Xavier Mertens

Technical blog by Stephan Berger (@malmoeb)

Technical blog by Stephan Berger (@malmoeb)

Analysis of a Deno-based malware intrusion that began with mailbombing and a fake Microsoft Teams IT-support call, leading a victim to execute a malicious archive. The payload is a modular JavaScript ...