Why Is a North Korean Mail Server Using a .cc Domain? – Threat Intelligence Beyond Malware
by Robin Dost Subscribe Newsletter Today I stumbled over a rather accidental finding during a routine analysis of North Korean...
Year: 2026
RustyStealer: Your Compiler Is Snitching on You
by Robin Dost Subscribe Newsletter As already mentioned in my last MuddyWater article, I originally planned to take a closer...
Gamaredon: Now Downloading via Windows Updates Best Friend “BITS”
by Robin Dost Subscribe Newsletter There’s yet another update in Gamaredons GamaLoad scripts, which pushed me to write this article...
MuddyWater: When Your Build System Becomes an IOC – “Jacob”
by Robin Dost Subscribe Newsletter EDIT 2026-01-18: I published a follow-up article analyzing the evolution and version history of the...
Defending Against Gamaredon: Practical Controls That Actually Work
by Robin Dost Subscribe Newsletter EDIT: If you're interested in how I efficiently track threat actors such as Gamaredon, feel...
Gamaredon: Same Goal, Fewer Fingerprints
by Robin Dost Subscribe Newsletter In malware analysis, it is tempting to describe change as innovation.New tricks, new tooling, new...