How Russia’s “Media Land” Kept Routing After Sanctions
by Robin Dost In light of drone attacks on German airports and the direct threats against our own country on...
North Korea’s Hangro Revisited
by Robin Dost Sometime around July 2026 a new certificate hierarchy went live on the servers behind Hangro, North Koreas...
Wenn der Staat das Licht ausmacht: Warum die IFG-Novelle die deutsche Threat-Intelligence-Arbeit trifft
by Robin Dost Ein Kommentar aus der Praxis der Cyber Threat Intelligence PETITION UNTERSCHREIBEN This article is written in German,...
Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery
by Robin Dost Subscribe Newsletter Actor tracking: APT43 (Kimsuky) / MB-0010 I can't sleep right now, because it's too hot in...
UAC-0184 Tooling Evolution: OneDrive Sideload to Remcos
by Robin Dost Subscribe Newsletter Malware: HijackLoader / IDATLoader -> Remcos Agent 7.1.0 ProActor tracking: UAC-0184 / MB-0005Related analysis: UAC-0184:...
Tracking UAC-0226 Tooling Evolution: From WinRAR ADS to Reflective GIFTEDCROOK Loading
by Robin Dost Subscribe Newsletter A few months ago, I analyzed a UAC-0226 campaign delivering a GIFTEDCROOK stealer through a...
GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain
by Robin Dost Subscribe Newsletter Today, we are taking a look at malware linked to yet another threat actor, one...
IIM Feed: Attack Pattern Mapping for Adversary Infrastructure (5/7)
by Robin Dost Part 5 of 7 of building the Malwarebox EcosystemURL: https://feed.iim.malwarebox.euMalwarebox: https://malwarebox.euIIM: https://iim.malwarebox.euIIM Spec: https://github.com/MalwareboxEU/IIM I have been working on...
UAC-0244 / UAC-0247: Malware Targeting FPV drone operators
by Robin Dost Subscribe Newsletter Surprise, surprise - a new UAC article 😁 Actor: UAC-0244 / UAC-0247 / MB-0006Malwarebox Identifier:...
UAC-0184: From HTA to a Signed Network Stack
by Robin Dost Subscribe Newsletter EDIT: The next article in my UAC series is out: https://blog.synapticsystems.de/uac-0247-malware-targeting-fpv-operators/ Actor: UAC-0184 / MB-0007...