RustyStealer: Your Compiler Is Snitching on You
by Robin Dost Subscribe Newsletter As already mentioned in my last MuddyWater article, I originally planned to take a closer...
Uncategorized
Gamaredon: Now Downloading via Windows Updates Best Friend “BITS”
by Robin Dost Subscribe Newsletter There’s yet another update in Gamaredons GamaLoad scripts, which pushed me to write this article...
MuddyWater: When Your Build System Becomes an IOC – “Jacob”
by Robin Dost Subscribe Newsletter EDIT 2026-01-18: I published a follow-up article analyzing the evolution and version history of the...
Defending Against Gamaredon: Practical Controls That Actually Work
by Robin Dost Subscribe Newsletter EDIT: If you're interested in how I efficiently track threat actors such as Gamaredon, feel...
Gamaredon: Same Goal, Fewer Fingerprints
by Robin Dost Subscribe Newsletter In malware analysis, it is tempting to describe change as innovation.New tricks, new tooling, new...
QuasarRAT Malware Campaign using CVE-2025-6218
I am currently analyzing the recent surge of malware samples exploiting the WinRAR vulnerability CVE-2025-6218. During this research, I found...
Inside Gamaredon 2025: Zero-Click Espionage at Scale
by Robin Dost Subscribe Newsletter UPDATE 22.12.2025: Gamaredon updated it's payload delivery infrastructure. You can find more information here.UPDATE 08.01.2026:...
How a Russian Threat Actor Uses a Recent WinRAR Vulnerability in Their Ukraine Operations
by Robin Dost Subscribe Newsletter If you're interested in reading more about Gamaredon check out my other articles.If you're interested...
Analyzing Malware distributed by Xubuntu.org
Yesterday I discovered a malware incident that was distributed via the official Xubuntu website.There is already a Reddit post that...
APT36 – “Abaris” Deobfuscating VB Dropper
by Robin Dost Subscribe Newsletter I recently discovered a sample attributed to the threat actor APT36 ("Transparent Tribe") on MalwareBazaar....