Observed Telegram Bot Naming Patterns in Recent MuddyWater Malware Activity
by Robin Dost Subscribe Newsletter I recently took a look at the wave of MuddyWater malware samples from 2026 and...
threat-actors
APT28: Geofencing as a Targeting Signal (CVE-2026-21509 Campaign)
by Robin Dost Subscribe Newsletter EDIT: 04.02.2026: I have YARA Rules available for detection, contact me at contact@robin-dost.de if you...
Why Is a North Korean Mail Server Using a .cc Domain? – Threat Intelligence Beyond Malware
by Robin Dost Subscribe Newsletter Today I stumbled over a rather accidental finding during a routine analysis of North Korean...
RustyStealer: Your Compiler Is Snitching on You
by Robin Dost Subscribe Newsletter As already mentioned in my last MuddyWater article, I originally planned to take a closer...
Gamaredon: Now Downloading via Windows Updates Best Friend “BITS”
by Robin Dost Subscribe Newsletter There’s yet another update in Gamaredons GamaLoad scripts, which pushed me to write this article...
MuddyWater: When Your Build System Becomes an IOC – “Jacob”
by Robin Dost Subscribe Newsletter EDIT 2026-01-18: I published a follow-up article analyzing the evolution and version history of the...
Defending Against Gamaredon: Practical Controls That Actually Work
by Robin Dost Subscribe Newsletter EDIT: If you're interested in how I efficiently track threat actors such as Gamaredon, feel...
Gamaredon: Same Goal, Fewer Fingerprints
by Robin Dost Subscribe Newsletter In malware analysis, it is tempting to describe change as innovation.New tricks, new tooling, new...
GamaWiper Explained: Gamaredon’s “New” Anti-Analysis Weapon
by Robin Dost Subscribe Newsletter After my recent blog posts covering Gamaredon’s ongoing PterodoGraph campaign targeting Ukraine, and following almost...
Inside Gamaredon 2025: Zero-Click Espionage at Scale
by Robin Dost Subscribe Newsletter UPDATE 22.12.2025: Gamaredon updated it's payload delivery infrastructure. You can find more information here.UPDATE 08.01.2026:...