Date Author Title

INFO STEALER

2021-12-01Xavier MertensInfo-Stealer Using webhook.site to Exfiltrate Data
2019-11-27Brad DuncanFinding an Agent Tesla malware sample

INFO

2024-11-22/a>Xavier MertensAn Infostealer Searching for « BIP-0039 » Data
2024-11-07/a>Xavier MertensSteam Account Checker Poisoned with Infostealer
2024-10-31/a>Guy BruneauOctober 2024 Activity with Username chenzilong
2024-10-09/a>Xavier MertensFrom Perfctl to InfoStealer
2024-09-18/a>Guy BruneauTime-to-Live Analysis of DShield Data with Vega-Lite
2024-09-18/a>Xavier MertensPython Infostealer Patching Windows Exodus App
2024-08-27/a>Xavier MertensWhy Is Python so Popular to Infect Windows Hosts?
2024-05-31/a>Xavier Mertens"K1w1" InfoStealer Uses gofile.io for Exfiltration
2024-05-22/a>Rob VandenBrinkNMAP Scanning without Scanning (Part 2) - The ipinfo API
2024-02-20/a>Xavier MertensPython InfoStealer With Dynamic Sandbox Detection
2024-01-25/a>Xavier MertensFacebook AdsManager Targeted by a Python Infostealer
2023-12-22/a>Xavier MertensShall We Play a Game?
2023-09-29/a>Xavier MertensAre You Still Storing Passwords In Plain Text Files?
2023-05-04/a>Xavier MertensInfostealer Embedded in a Word Document
2023-03-12/a>Guy BruneauAsynRAT Trojan - Bill Payment (Pago de la factura)
2023-03-01/a>Xavier MertensPython Infostealer Targeting Gamers
2023-02-18/a>Guy BruneauSpear Phishing Handlers for Username/Password
2023-02-04/a>Guy BruneauAssemblyline as a Malware Analysis Sandbox
2023-01-21/a>Guy BruneauDShield Sensor JSON Log to Elasticsearch
2023-01-08/a>Guy BruneauDShield Sensor JSON Log Analysis
2022-12-21/a>Guy BruneauDShield Sensor Setup in Azure
2022-12-18/a>Guy BruneauInfostealer Malware with Double Extension
2022-08-13/a>Guy BruneauPhishing HTML Attachment as Voicemail Audio Transcription
2022-08-11/a>Xavier MertensInfoStealer Script Based on Curl and NSudo
2022-03-23/a>Brad DuncanArkei Variants: From Vidar to Mars Stealer
2022-03-09/a>Xavier MertensInfostealer in a Batch File
2022-02-13/a>Guy BruneauDHL Spear Phishing to Capture Username/Password
2021-12-21/a>Xavier MertensMore Undetected PowerShell Dropper
2021-12-14/a>Johannes UllrichLog4j: Getting ready for the long haul (CVE-2021-44228)
2021-12-01/a>Xavier MertensInfo-Stealer Using webhook.site to Exfiltrate Data
2021-05-08/a>Guy BruneauWho is Probing the Internet for Research Purposes?
2021-04-06/a>Jan KoprivaMalspam with Lokibot vs. Outlook and RFCs
2021-03-31/a>Xavier MertensQuick Analysis of a Modular InfoStealer
2021-03-12/a>Guy BruneauMicrosoft DHCP Logs Shipped to ELK
2020-12-29/a>Jan KoprivaWant to know what's in a folder you don't have a permission to access? Try asking your AV solution...
2019-11-27/a>Brad DuncanFinding an Agent Tesla malware sample
2019-10-09/a>Brad DuncanWhat data does Vidar malware steal from an infected host?
2019-01-24/a>Brad DuncanMalspam with Word docs uses macro to run Powershell script and steal system data
2018-11-11/a>Pasquale StirparoCommunity contribution: joining forces or multiply solutions?
2017-05-06/a>Xavier MertensThe story of the CFO and CEO...
2016-10-02/a>Guy BruneauIs there an Infosec Cybersecurity Talent Shortage?
2015-01-23/a>Adrien de BeaupreInfocon change to yellow for Adobe Flash issues
2014-09-26/a>Richard PorterWhy We Have Moved to InfoCon:Yellow
2014-05-22/a>Johannes UllrichDiscontinuing Support for ISC Alert Task Bar Icon
2014-04-14/a>Kevin ShorttINFOCon Green: Heartbleed - on the mend
2013-02-17/a>Guy BruneauHP ArcSight Connector Appliance and Logger Vulnerabilities
2012-03-16/a>Swa FrantzenINFOCON Yellow - Microsoft RDP - MS12-020
2012-01-19/a>Chris MohanWHOIS contacts are your friends
2012-01-13/a>Guy BruneauSysinternals Updates - http://blogs.technet.com/b/sysinternals/archive/2012/01/13/updates-autoruns-v11-21-coreinfo-v3-03-portmon-v-3-03-process-explorer-v15-12-mark-s-blog-and-mark-at-rsa-2012.aspx
2011-02-05/a>Guy BruneauOpenSSH Legacy Certificate Information Disclosure Vulnerability
2011-01-12/a>Richard PorterHow Many Loyalty Cards do you Carry?
2010-12-26/a>Manuel Humberto Santander PelaezISC infocon monitor app for OS X
2010-10-22/a>Manuel Humberto Santander PelaezIntypedia project
2010-07-24/a>Manuel Humberto Santander PelaezTransmiting logon information unsecured in the network
2010-07-20/a>Manuel Humberto Santander PelaezLowering infocon back to green
2010-06-15/a>Manuel Humberto Santander PelaeziPhone 4 Order Security Breach Exposes Private Information
2010-04-21/a>Guy BruneauGoogle Chrome Security Update v4.1.249.1059 Released: http://googlechromereleases.blogspot.com/2010/04/stable-update-security-fixes.html
2010-03-27/a>Guy BruneauHP-UX Running NFS/ONCplus, Inadvertently Enabled NFS
2010-01-17/a>Mark HofmanWhy not Yellow?
2009-11-29/a>Patrick Nolan A Cloudy Weekend
2009-10-22/a>Adrien de BeaupreSysinternals updates: Disk2vhd v1.1, ZoomIt v4.1, Coreinfo v2.0, VMMap v2.4
2009-10-04/a>Guy BruneauSamba Security Information Disclosure and DoS
2009-10-02/a>Stephen HallNew SysInternal fun for the weekend
2009-07-13/a>Adrien de Beaupre* Infocon raised to yellow for Excel Web Components ActiveX vulnerability
2009-07-10/a>Guy BruneauWordPress Fixes Multiple vulnerabilities
2009-07-07/a>Marcus Sachs* INFOCON Status - staying green
2009-06-11/a>Rick WannerMIR-ROR Motile Incident Response - Respond Objectively Remediate
2009-03-02/a>Swa FrantzenObama's leaked chopper blueprints: anything we can learn?
2008-09-11/a>David GoldsmithCookieMonster is coming to Pown (err, Town)
2008-08-12/a>Johannes UllrichUpcoming Infocon Test and new Color
2008-07-02/a>Jim ClausingAnother little script I threw together
2008-04-07/a>John BambenekHP USB Keys Shipped with Malware for your Proliant Server
2006-10-02/a>Jim ClausingBack to green, but the exploits are still running wild

STEALER

2024-11-22/a>Xavier MertensAn Infostealer Searching for « BIP-0039 » Data
2024-11-07/a>Xavier MertensSteam Account Checker Poisoned with Infostealer
2024-10-09/a>Xavier MertensFrom Perfctl to InfoStealer
2024-09-18/a>Xavier MertensPython Infostealer Patching Windows Exodus App
2024-08-27/a>Xavier MertensWhy Is Python so Popular to Infect Windows Hosts?
2024-07-26/a>Xavier MertensExelaStealer Delivered "From Russia With Love"
2024-05-31/a>Xavier Mertens"K1w1" InfoStealer Uses gofile.io for Exfiltration
2024-02-20/a>Xavier MertensPython InfoStealer With Dynamic Sandbox Detection
2024-01-25/a>Xavier MertensFacebook AdsManager Targeted by a Python Infostealer
2023-12-22/a>Xavier MertensShall We Play a Game?
2023-09-29/a>Xavier MertensAre You Still Storing Passwords In Plain Text Files?
2023-05-04/a>Xavier MertensInfostealer Embedded in a Word Document
2023-03-01/a>Xavier MertensPython Infostealer Targeting Gamers
2022-12-18/a>Guy BruneauInfostealer Malware with Double Extension
2022-08-11/a>Xavier MertensInfoStealer Script Based on Curl and NSudo
2022-04-06/a>Brad DuncanWindows MetaStealer Malware
2022-03-23/a>Brad DuncanArkei Variants: From Vidar to Mars Stealer
2022-03-09/a>Xavier MertensInfostealer in a Batch File
2021-12-21/a>Xavier MertensMore Undetected PowerShell Dropper
2021-12-01/a>Xavier MertensInfo-Stealer Using webhook.site to Exfiltrate Data
2021-07-09/a>Brad DuncanHancitor tries XLL as initial malware file
2021-06-30/a>Brad DuncanJune 2021 Forensic Contest: Answers and Analysis
2021-04-06/a>Jan KoprivaMalspam with Lokibot vs. Outlook and RFCs
2021-03-31/a>Xavier MertensQuick Analysis of a Modular InfoStealer
2019-11-27/a>Brad DuncanFinding an Agent Tesla malware sample
2019-10-09/a>Brad DuncanWhat data does Vidar malware steal from an infected host?
2019-01-24/a>Brad DuncanMalspam with Word docs uses macro to run Powershell script and steal system data
2017-03-08/a>Xavier MertensNot All Malware Samples Are Complex