Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery
by Robin Dost Subscribe Newsletter Actor tracking: APT43 (Kimsuky) / MB-0010 I can't sleep right now, because it's too hot in...
Month: June 2026
UAC-0184 Tooling Evolution: OneDrive Sideload to Remcos
by Robin Dost Subscribe Newsletter Malware: HijackLoader / IDATLoader -> Remcos Agent 7.1.0 ProActor tracking: UAC-0184 / MB-0005Related analysis: UAC-0184:...
Tracking UAC-0226 Tooling Evolution: From WinRAR ADS to Reflective GIFTEDCROOK Loading
by Robin Dost Subscribe Newsletter A few months ago, I analyzed a UAC-0226 campaign delivering a GIFTEDCROOK stealer through a...
GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain
by Robin Dost Subscribe Newsletter Today, we are taking a look at malware linked to yet another threat actor, one...