GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain
by Robin Dost Subscribe Newsletter Today, we are taking a look at malware linked to yet another threat actor, one...
malware
UAC-0244 / UAC-0247: Malware Targeting FPV drone operators
by Robin Dost Subscribe Newsletter Surprise, surprise - a new UAC article 😁 Actor: UAC-0244 / UAC-0247 / MB-0006Malwarebox Identifier:...
UAC-0184: From HTA to a Signed Network Stack
by Robin Dost Subscribe Newsletter EDIT: The next article in my UAC series is out: https://blog.synapticsystems.de/uac-0247-malware-targeting-fpv-operators/ Actor: UAC-0184 / MB-0007...
3.000 “Stealer” Samples, One Misconfigured Apache Server
by Robin Dost Subscribe Newsletter Today I took a look at a pretty standard LNK malware sample and ended up...
Obfuscation Without Effort: Breaking a UAC-0226 GIFTEDCROOK Stealer
by Robin Dost Subscribe Newsletter EDIT: I have YARA rules available for this one, if you need them, contact me...
Observed Telegram Bot Naming Patterns in Recent MuddyWater Malware Activity
by Robin Dost Subscribe Newsletter I recently took a look at the wave of MuddyWater malware samples from 2026 and...
APT28: Geofencing as a Targeting Signal (CVE-2026-21509 Campaign)
by Robin Dost Subscribe Newsletter EDIT: 04.02.2026: I have YARA Rules available for detection, contact me at contact@robin-dost.de if you...
RustyStealer: Your Compiler Is Snitching on You
by Robin Dost Subscribe Newsletter As already mentioned in my last MuddyWater article, I originally planned to take a closer...
Gamaredon: Now Downloading via Windows Updates Best Friend “BITS”
by Robin Dost Subscribe Newsletter There’s yet another update in Gamaredons GamaLoad scripts, which pushed me to write this article...
MuddyWater: When Your Build System Becomes an IOC – “Jacob”
by Robin Dost Subscribe Newsletter EDIT 2026-01-18: I published a follow-up article analyzing the evolution and version history of the...