MuddyWater: When Your Build System Becomes an IOC – “Jacob”
by Robin Dost Subscribe Newsletter EDIT 2026-01-18: I published a follow-up article analyzing the evolution and version history of the...
robin
Defending Against Gamaredon: Practical Controls That Actually Work
by Robin Dost Subscribe Newsletter EDIT: If you're interested in how I efficiently track threat actors such as Gamaredon, feel...
Gamaredon: Same Goal, Fewer Fingerprints
by Robin Dost Subscribe Newsletter In malware analysis, it is tempting to describe change as innovation.New tricks, new tooling, new...
GamaWiper Explained: Gamaredon’s “New” Anti-Analysis Weapon
by Robin Dost Subscribe Newsletter After my recent blog posts covering Gamaredon’s ongoing PterodoGraph campaign targeting Ukraine, and following almost...
Inside Gamaredon 2025: Zero-Click Espionage at Scale
by Robin Dost Subscribe Newsletter UPDATE 22.12.2025: Gamaredon updated it's payload delivery infrastructure. You can find more information here.UPDATE 08.01.2026:...
How a Russian Threat Actor Uses a Recent WinRAR Vulnerability in Their Ukraine Operations
by Robin Dost Subscribe Newsletter If you're interested in reading more about Gamaredon check out my other articles.If you're interested...
APT36 – “Abaris” Deobfuscating VB Dropper
by Robin Dost Subscribe Newsletter I recently discovered a sample attributed to the threat actor APT36 ("Transparent Tribe") on MalwareBazaar....
APT44 – Sandworm Team
APT44 (Sandworm Team) – Quick Facts Type: Advanced Persistent Threat (APT) Aliases: Sandworm, Sandworm Team, Seashell Blizzard, Iron Viking, Telebots, Voodoo Bear, Iridium, FrozenBarents...
Whisper – Interesting Sandbox evasion?
In the past few days I found something fairly interesting in my sandbox. An attacker attempted to install malware, and...