North Korea’s Hangro Revisited
by Robin Dost Sometime around July 2026 a new certificate hierarchy went live on the servers behind Hangro, North Koreas...
threat-actors
Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery
by Robin Dost Subscribe Newsletter Actor tracking: APT43 (Kimsuky) / MB-0010 I can't sleep right now, because it's too hot in...
UAC-0184 Tooling Evolution: OneDrive Sideload to Remcos
by Robin Dost Subscribe Newsletter Malware: HijackLoader / IDATLoader -> Remcos Agent 7.1.0 ProActor tracking: UAC-0184 / MB-0005Related analysis: UAC-0184:...
Tracking UAC-0226 Tooling Evolution: From WinRAR ADS to Reflective GIFTEDCROOK Loading
by Robin Dost Subscribe Newsletter A few months ago, I analyzed a UAC-0226 campaign delivering a GIFTEDCROOK stealer through a...
GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain
by Robin Dost Subscribe Newsletter Today, we are taking a look at malware linked to yet another threat actor, one...
UAC-0244 / UAC-0247: Malware Targeting FPV drone operators
by Robin Dost Subscribe Newsletter Surprise, surprise - a new UAC article 😁 Actor: UAC-0244 / UAC-0247 / MB-0006Malwarebox Identifier:...
UAC-0184: From HTA to a Signed Network Stack
by Robin Dost Subscribe Newsletter EDIT: The next article in my UAC series is out: https://blog.synapticsystems.de/uac-0247-malware-targeting-fpv-operators/ Actor: UAC-0184 / MB-0007...
3.000 “Stealer” Samples, One Misconfigured Apache Server
by Robin Dost Subscribe Newsletter Today I took a look at a pretty standard LNK malware sample and ended up...
Obfuscation Without Effort: Breaking a UAC-0226 GIFTEDCROOK Stealer
by Robin Dost Subscribe Newsletter EDIT: I have YARA rules available for this one, if you need them, contact me...
Following Gamaredons Infrastructure Rotations using Kraken (1/7)
by Robin Dost Subscribe Newsletter Part 1 of 7 of building the Malwarebox EcosystemOfficial Website: https://kraken.malwarebox.eu Whitepaper Tracking Gamaredon infrastructure is...