Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as hotels since May 2026 in order ...

A dispatch from the woods. In defense of ASCII, quiet computers, and telling your family you made it home.

ALT: It's Never Ending Constant Chaos Charlie

Implement SIMD-accelerated masked literal matching (#691). Improve atom extraction heuristics for better performance (#690, 1e14f60). Improve scan performance by applying file size and file header ...

Distinct Russian clusters have been conducting phishing activity focused on Application Specific Passwords (ASP), OAuth flows, and malware delivery. All of these operations seem focused on account com...

ALT: Archer You Want Ants

Introducing the new unintended_pattern_in_set compiler warning in YARA-X to catch overlapping variable prefixes and pattern set collisions.

Distinct Russian clusters have been conducting phishing activity focused on Application Specific Passwords (ASP), OAuth flows, and malware delivery. All of these operations seem focused on account com...

ALT: Bender from Futurama Says Neat

This fixes the "private" modifier on hex strings so they are properly hidden from output and also fixes it so the modifier is properly displayed in both AST and CST representations. This ...

Analysis of a backdoor, STOCKSTAY, that has been continually developed and deployed by the Russia-linked threat actor Turla.

Add missing machine architecture types to pe module (#687). Add warning for single-byte patterns (71baa67). Add warning for duplicate patterns in a rule (9061803). Small optimization when generatin...

Multiple performance improvements (#623, #624, #626, #627, #629, #631, #632, #635, #649, #654). Implement constant folding for bitwise operations (#634). Allow specifying context size for matches (...

Add full support for WASM. The whole yara-x create now can be built for WASM (#583, #588, #598). New playground at https://virustotal.github.io/yara-x/playground/ (#601). The yr check command now n...

https://www.mandiant.com/blog/tracking-malware-import-hashing/ Mandiant's imphash convention requires the following: Resolving ordinals to function names when they appear Converting both DLL names ...

ALT: a man holding a banana says " pretty pretty pretty pretty pretty good "

When the tag linter comes across multiple errors only the first one is returned. This is due to an oversight in the API where we can only return a single error, not a vector of errors. I realize th...

ALT: two men are standing next to each other and one of them is wearing a shirt that says nuts

ALT: a man in a suit and tie sits at a desk with the words " i don 't even really work here " above him