UAC-0184: From HTA to a Signed Network Stack
by Robin Dost Subscribe Newsletter EDIT: The next article in my UAC series is out: https://blog.synapticsystems.de/uac-0247-malware-targeting-fpv-operators/ Actor: UAC-0184 / MB-0007...
IIMQL – The Query Language for Adversary Infrastructure (4/7)
by Robin DostPart 4 of 7 of building the Malwarebox EcosystemWebsite: https://iimql.malwarebox.euGitHub: https://github.com/MalwareboxEU/IIMQL In the previous part, I introduced IIM,...
IIM – The Grammar of Adversary Infrastructure (3/7)
by Robin Dost Part 3 of 7 of building the Malwarebox EcosystemOfficial Website: https://iim.malwarebox.euGitHub: https://github.com/MalwareboxEU/IIM EDIT: I released part 4...
3.000 “Stealer” Samples, One Misconfigured Apache Server
by Robin Dost Subscribe Newsletter Today I took a look at a pretty standard LNK malware sample and ended up...
Obfuscation Without Effort: Breaking a UAC-0226 GIFTEDCROOK Stealer
by Robin Dost Subscribe Newsletter EDIT: I have YARA rules available for this one, if you need them, contact me...
Following Gamaredons Infrastructure Rotations using Kraken (1/7)
by Robin Dost Subscribe Newsletter Part 1 of 7 of building the Malwarebox EcosystemOfficial Website: https://kraken.malwarebox.eu Whitepaper Tracking Gamaredon infrastructure is...
Observed Telegram Bot Naming Patterns in Recent MuddyWater Malware Activity
by Robin Dost Subscribe Newsletter I recently took a look at the wave of MuddyWater malware samples from 2026 and...
APT28: Geofencing as a Targeting Signal (CVE-2026-21509 Campaign)
by Robin Dost Subscribe Newsletter EDIT: 04.02.2026: I have YARA Rules available for detection, contact me at contact@robin-dost.de if you...
Actor-Centric Defensive Prioritization – ACDP (2/7)
by Robin DostPart 2 of 7 of building the Malwarebox EcosystemOfficial Website: https://acdp.malwarebox.euGitHub: https://github.com/MalwareboxEU/ACDP Introduction Much of my previous work has focused...
Why Is a North Korean Mail Server Using a .cc Domain? – Threat Intelligence Beyond Malware
by Robin Dost Subscribe Newsletter Today I stumbled over a rather accidental finding during a routine analysis of North Korean...