- UAC-0184 Tooling Evolution: OneDrive Sideload to Remcos
- Tracking UAC-0226 Tooling Evolution: From WinRAR ADS to Reflective GIFTEDCROOK Loading
- GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain
- Obfuscation Without Effort: Breaking a UAC-0226 GIFTEDCROOK Stealer
- RustyStealer: Your Compiler Is Snitching on You