Year: 2026

6d0aec7f-6bf9-44ec-a6f0-76a5b86d3481 (1)

3.000 “Stealer” Samples, One Misconfigured Apache Server

robin April 13, 2026 0

by Robin Dost Subscribe Newsletter Today I took a look at a pretty standard LNK malware sample and ended up...

55ca8c7c-bd08-46dd-a2bb-2cfa9f6f9938 (1)

Obfuscation Without Effort: Breaking a UAC-0226 GIFTEDCROOK Stealer

robin April 9, 2026 1

by Robin Dost Subscribe Newsletter EDIT: I have YARA rules available for this one, if you need them, contact me...

Following Gamaredons Infrastructure Rotations using Kraken (1/7)

robin March 23, 2026 3

by Robin Dost Subscribe Newsletter Part 1 of 7 of building the Malwarebox EcosystemOfficial Website: https://kraken.malwarebox.eu Whitepaper Tracking Gamaredon infrastructure is...

a2bc5a4f-9848-42ef-ab7b-d29a20c4d01b (1)

Observed Telegram Bot Naming Patterns in Recent MuddyWater Malware Activity

robin March 21, 2026 1

by Robin Dost Subscribe Newsletter I recently took a look at the wave of MuddyWater malware samples from 2026 and...

3b6493ed-81ef-417f-b662-1e2db0dd645c (1)

APT28: Geofencing as a Targeting Signal (CVE-2026-21509 Campaign)

robin February 3, 2026 13

by Robin Dost Subscribe Newsletter EDIT: 04.02.2026: I have YARA Rules available for detection, contact me at contact@robin-dost.de if you...

Actor-Centric Defensive Prioritization – ACDP (2/7)

robin January 31, 2026 1

by Robin DostPart 2 of 7 of building the Malwarebox EcosystemOfficial Website: https://acdp.malwarebox.euGitHub: https://github.com/MalwareboxEU/ACDP Introduction Much of my previous work has focused...