North Korea’s Hangro Revisited
by Robin Dost Sometime around July 2026 a new certificate hierarchy went live on the servers behind Hangro, North Koreas...
Wenn der Staat das Licht ausmacht: Warum die IFG-Novelle die deutsche Threat-Intelligence-Arbeit trifft
by Robin Dost Ein Kommentar aus der Praxis der Cyber Threat Intelligence PETITION UNTERSCHREIBEN This article is written in German,...
Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery
by Robin Dost Subscribe Newsletter Actor tracking: APT43 (Kimsuky) / MB-0010 I can't sleep right now, because it's too hot in...
UAC-0184 Tooling Evolution: OneDrive Sideload to Remcos
by Robin Dost Subscribe Newsletter Malware: HijackLoader / IDATLoader -> Remcos Agent 7.1.0 ProActor tracking: UAC-0184 / MB-0005Related analysis: UAC-0184:...
Tracking UAC-0226 Tooling Evolution: From WinRAR ADS to Reflective GIFTEDCROOK Loading
by Robin Dost Subscribe Newsletter A few months ago, I analyzed a UAC-0226 campaign delivering a GIFTEDCROOK stealer through a...
GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain
by Robin Dost Subscribe Newsletter Today, we are taking a look at malware linked to yet another threat actor, one...
IIM Feed: Attack Pattern Mapping for Adversary Infrastructure (5/7)
by Robin Dost Part 5 of 7 of building the Malwarebox EcosystemURL: https://feed.iim.malwarebox.euMalwarebox: https://malwarebox.euIIM: https://iim.malwarebox.euIIM Spec: https://github.com/MalwareboxEU/IIM I have been working on...
UAC-0244 / UAC-0247: Malware Targeting FPV drone operators
by Robin Dost Subscribe Newsletter Surprise, surprise - a new UAC article 😁 Actor: UAC-0244 / UAC-0247 / MB-0006Malwarebox Identifier:...
UAC-0184: From HTA to a Signed Network Stack
by Robin Dost Subscribe Newsletter EDIT: The next article in my UAC series is out: https://blog.synapticsystems.de/uac-0247-malware-targeting-fpv-operators/ Actor: UAC-0184 / MB-0007...
IIMQL – The Query Language for Adversary Infrastructure (4/7)
by Robin DostPart 4 of 7 of building the Malwarebox EcosystemWebsite: https://iimql.malwarebox.euGitHub: https://github.com/MalwareboxEU/IIMQL In the previous part, I introduced IIM,...