Why Is a North Korean Mail Server Using a .cc Domain? – Threat Intelligence Beyond Malware
by Robin Dost Subscribe Newsletter Today I stumbled over a rather accidental finding during a routine analysis of North Korean...
RustyStealer: Your Compiler Is Snitching on You
by Robin Dost Subscribe Newsletter As already mentioned in my last MuddyWater article, I originally planned to take a closer...
Gamaredon: Now Downloading via Windows Updates Best Friend “BITS”
by Robin Dost Subscribe Newsletter There’s yet another update in Gamaredons GamaLoad scripts, which pushed me to write this article...
MuddyWater: When Your Build System Becomes an IOC – “Jacob”
by Robin Dost Subscribe Newsletter EDIT 2026-01-18: I published a follow-up article analyzing the evolution and version history of the...
Defending Against Gamaredon: Practical Controls That Actually Work
by Robin Dost Subscribe Newsletter EDIT: If you're interested in how I efficiently track threat actors such as Gamaredon, feel...
Gamaredon: Same Goal, Fewer Fingerprints
by Robin Dost Subscribe Newsletter In malware analysis, it is tempting to describe change as innovation.New tricks, new tooling, new...
GamaWiper Explained: Gamaredon’s “New” Anti-Analysis Weapon
by Robin Dost Subscribe Newsletter After my recent blog posts covering Gamaredon’s ongoing PterodoGraph campaign targeting Ukraine, and following almost...
QuasarRAT Malware Campaign using CVE-2025-6218
I am currently analyzing the recent surge of malware samples exploiting the WinRAR vulnerability CVE-2025-6218. During this research, I found...
Inside Gamaredon 2025: Zero-Click Espionage at Scale
by Robin Dost Subscribe Newsletter UPDATE 22.12.2025: Gamaredon updated it's payload delivery infrastructure. You can find more information here.UPDATE 08.01.2026:...
How a Russian Threat Actor Uses a Recent WinRAR Vulnerability in Their Ukraine Operations
by Robin Dost Subscribe Newsletter If you're interested in reading more about Gamaredon check out my other articles.If you're interested...