Defending Against Gamaredon: Practical Controls That Actually Work
by Robin Dost Subscribe Newsletter EDIT: If you're interested in how I efficiently track threat actors such as Gamaredon, feel...
Gamaredon: Same Goal, Fewer Fingerprints
by Robin Dost Subscribe Newsletter In malware analysis, it is tempting to describe change as innovation.New tricks, new tooling, new...
GamaWiper Explained: Gamaredon’s “New” Anti-Analysis Weapon
by Robin Dost Subscribe Newsletter After my recent blog posts covering Gamaredon’s ongoing PterodoGraph campaign targeting Ukraine, and following almost...
QuasarRAT Malware Campaign using CVE-2025-6218
I am currently analyzing the recent surge of malware samples exploiting the WinRAR vulnerability CVE-2025-6218. During this research, I found...
Inside Gamaredon 2025: Zero-Click Espionage at Scale
by Robin Dost Subscribe Newsletter UPDATE 22.12.2025: Gamaredon updated it's payload delivery infrastructure. You can find more information here.UPDATE 08.01.2026:...
How a Russian Threat Actor Uses a Recent WinRAR Vulnerability in Their Ukraine Operations
by Robin Dost Subscribe Newsletter If you're interested in reading more about Gamaredon check out my other articles.If you're interested...
Analyzing Malware distributed by Xubuntu.org
Yesterday I discovered a malware incident that was distributed via the official Xubuntu website.There is already a Reddit post that...
APT36 – “Abaris” Deobfuscating VB Dropper
by Robin Dost Subscribe Newsletter I recently discovered a sample attributed to the threat actor APT36 ("Transparent Tribe") on MalwareBazaar....
APT44 – Sandworm Team
APT44 (Sandworm Team) – Quick Facts Type: Advanced Persistent Threat (APT) Aliases: Sandworm, Sandworm Team, Seashell Blizzard, Iron Viking, Telebots, Voodoo Bear, Iridium, FrozenBarents...
Whisper – Interesting Sandbox evasion?
In the past few days I found something fairly interesting in my sandbox. An attacker attempted to install malware, and...