Internet Storm Center
Sign In
Sign Up
Handler on Duty:
Guy Bruneau
Threat Level:
green
Date
Author
Title
UNSTOPPABLE TECH SUPPORT MALWARE VISH
2010-07-06
Rob VandenBrink
Bogus Support Organizations use Live Operators to Install Malware
UNSTOPPABLE
2010-07-06/a>
Rob VandenBrink
Bogus Support Organizations use Live Operators to Install Malware
TECH
2014-08-12/a>
Adrien de Beaupre
Host discovery with nmap
2013-04-29/a>
Adam Swanger
Report Fake Tech Support Calls submission form reminder
2010-07-06/a>
Rob VandenBrink
Bogus Support Organizations use Live Operators to Install Malware
2008-06-17/a>
Kyle Haugsness
Why go high-tech?
SUPPORT
2024-06-17/a>
Xavier Mertens
New NetSupport Campaign Delivered Through MSIX Packages
2023-08-18/a>
Xavier Mertens
From a Zalando Phishing to a RAT
2022-10-21/a>
Brad Duncan
sczriptzzbn inject pushes malware for NetSupport RAT
2020-02-05/a>
Brad Duncan
Fake browser update pages are "still a thing"
2015-06-27/a>
Guy Bruneau
Is Windows XP still around in your Network a year after Support Ended?
2014-07-05/a>
Guy Bruneau
Java Support ends for Windows XP
2012-12-06/a>
Daniel Wesemann
Fake tech support calls - revisited
2012-10-03/a>
Kevin Shortt
Fake Support Calls Reported
2011-05-23/a>
Mark Hofman
Microsoft Support Scam (again)
2010-07-06/a>
Rob VandenBrink
Bogus Support Organizations use Live Operators to Install Malware
2010-06-15/a>
Manuel Humberto Santander Pelaez
Microsoft Windows Help and Support Center vulnerability (CVE 2010-1885) exploit in the wild
2010-03-01/a>
Mark Hofman
Microsoft will drop support for Vista (without any Service Packs) on April 13 and support for XP SP2 ends July 13. (i.e. no more security updates). If you are still running these, it it time to update.
2010-02-03/a>
Rob VandenBrink
Support for Legacy Browsers
MALWARE
2024-11-30/a>
Xavier Mertens
From a Regular Infostealer to its Obfuscated Version
2024-11-22/a>
Xavier Mertens
An Infostealer Searching for « BIP-0039 » Data
2024-11-19/a>
Xavier Mertens
Detecting the Presence of a Debugger in Linux
2024-11-07/a>
Xavier Mertens
Steam Account Checker Poisoned with Infostealer
2024-11-05/a>
Xavier Mertens
Python RAT with a Nice Screensharing Feature
2024-10-09/a>
Xavier Mertens
From Perfctl to InfoStealer
2024-09-18/a>
Xavier Mertens
Python Infostealer Patching Windows Exodus App
2024-09-17/a>
Xavier Mertens
23:59, Time to Exfiltrate!
2024-09-16/a>
Xavier Mertens
Managing PE Files With Overlays
2024-09-11/a>
Guy Bruneau
Hygiene, Hygiene, Hygiene! [Guest Diary]
2024-08-27/a>
Xavier Mertens
Why Is Python so Popular to Infect Windows Hosts?
2024-08-26/a>
Xavier Mertens
From Highly Obfuscated Batch File to XWorm and Redline
2024-08-19/a>
Xavier Mertens
Do you Like Donuts? Here is a Donut Shellcode Delivered Through PowerShell/Python
2024-08-14/a>
Xavier Mertens
Multiple Malware Dropped Through MSI Package
2024-07-26/a>
Xavier Mertens
ExelaStealer Delivered "From Russia With Love"
2024-07-25/a>
Xavier Mertens
XWorm Hidden With Process Hollowing
2024-07-24/a>
Xavier Mertens
"Mouse Logger" Malicious Python Script
2024-06-06/a>
Xavier Mertens
Malicious Python Script with a "Best Before" Date
2024-05-28/a>
Guy Bruneau
Is that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary]
2024-05-22/a>
Guy Bruneau
Analysis of ?redtail? File Uploads to ICS Honeypot, a Multi-Architecture Coin Miner [Guest Diary]
2024-04-29/a>
Guy Bruneau
Linux Trojan - Xorddos with Filename eyshcjdmzg
2024-04-25/a>
Jesse La Grew
Does it matter if iptables isn't running on my honeypot?
2024-03-28/a>
Xavier Mertens
From JavaScript to AsyncRAT
2024-03-13/a>
Xavier Mertens
Using ChatGPT to Deobfuscate Malicious Scripts
2024-02-29/a>
Jesse La Grew
[Guest Diary] Dissecting DarkGate: Modular Malware Delivery and Persistence as a Service.
2024-02-08/a>
Xavier Mertens
A Python MP3 Player with Builtin Keylogger Capability
2024-02-06/a>
Jan Kopriva
Computer viruses are celebrating their 40th birthday (well, 54th, really)
2024-01-26/a>
Xavier Mertens
A Batch File With Multiple Payloads
2024-01-25/a>
Xavier Mertens
Facebook AdsManager Targeted by a Python Infostealer
2024-01-24/a>
Johannes Ullrich
How Bad User Interfaces Make Security Tools Harmful
2024-01-19/a>
Xavier Mertens
macOS Python Script Replacing Wallet Applications with Rogue Apps
2024-01-07/a>
Guy Bruneau
Suspicious Prometei Botnet Activity
2024-01-03/a>
Jan Kopriva
Interesting large and small malspam attachments from 2023
2023-12-22/a>
Xavier Mertens
Shall We Play a Game?
2023-11-18/a>
Xavier Mertens
Quasar RAT Delivered Through Updated SharpLoader
2023-11-15/a>
Xavier Mertens
Redline Dropped Through MSIX Package
2023-11-09/a>
Xavier Mertens
Visual Examples of Code Injection
2023-11-01/a>
Xavier Mertens
Malware Dropped Through a ZPAQ Archive
2023-10-31/a>
Xavier Mertens
Multiple Layers of Anti-Sandboxing Techniques
2023-10-28/a>
Xavier Mertens
Size Matters for Many Security Controls
2023-10-18/a>
Jesse La Grew
Hiding in Hex
2023-09-30/a>
Xavier Mertens
Simple Netcat Backdoor in Python Script
2023-09-29/a>
Xavier Mertens
Are You Still Storing Passwords In Plain Text Files?
2023-08-25/a>
Xavier Mertens
Python Malware Using Postgresql for C2 Communications
2023-08-23/a>
Xavier Mertens
More Exotic Excel Files Dropping AgentTesla
2023-08-22/a>
Xavier Mertens
Have You Ever Heard of the Fernet Encryption Algorithm?
2023-08-21/a>
Xavier Mertens
Quick Malware Triage With Inotify Tools
2023-08-20/a>
Guy Bruneau
SystemBC Malware Activity
2023-08-18/a>
Xavier Mertens
From a Zalando Phishing to a RAT
2023-08-11/a>
Xavier Mertens
Show me All Your Windows!
2023-08-03/a>
Jan Kopriva
From small LNK to large malicious BAT file with zero VT score
2023-07-29/a>
Xavier Mertens
Do Attackers Pay More Attention to IPv6?
2023-07-28/a>
Xavier Mertens
ShellCode Hidden with Steganography
2023-07-26/a>
Xavier Mertens
Suspicious IP Addresses Avoided by Malware Samples
2023-06-27/a>
Xavier Mertens
The Importance of Malware Triage
2023-06-23/a>
Xavier Mertens
Word Document with an Online Attached Template
2023-06-21/a>
Yee Ching Tok
Analyzing a YouTube Sponsorship Phishing Mail and Malware Targeting Content Creators
2023-06-20/a>
Xavier Mertens
Malicious Code Can Be Anywhere
2023-06-19/a>
Xavier Mertens
Malware Delivered Through .inf File
2023-06-16/a>
Xavier Mertens
Another RAT Delivered Through VBS
2023-05-17/a>
Xavier Mertens
Increase in Malicious RAR SFX files
2023-04-07/a>
Xavier Mertens
Detecting Suspicious API Usage with YARA Rules
2023-04-04/a>
Johannes Ullrich
Analyzing the efile.com Malware "efail"
2023-03-30/a>
Xavier Mertens
Bypassing PowerShell Strong Obfuscation
2023-03-26/a>
Didier Stevens
Extra: "String Obfuscation: Character Pair Reversal"
2023-03-01/a>
Xavier Mertens
Python Infostealer Targeting Gamers
2023-02-09/a>
Xavier Mertens
A Backdoor with Smart Screenshot Capability
2023-02-04/a>
Guy Bruneau
Assemblyline as a Malware Analysis Sandbox
2023-01-25/a>
Xavier Mertens
A First Malicious OneNote Document
2023-01-16/a>
Johannes Ullrich
PSA: Why you must run an ad blocker when using Google
2023-01-06/a>
Xavier Mertens
AutoIT Remains Popular in the Malware Landscape
2023-01-05/a>
Brad Duncan
More Brazil malspam pushing Astaroth (Guildma) in January 2023
2022-12-21/a>
Guy Bruneau
DShield Sensor Setup in Azure
2022-12-18/a>
Guy Bruneau
Infostealer Malware with Double Extension
2022-11-19/a>
Guy Bruneau
McAfee Fake Antivirus Phishing Campaign is Back!
2022-11-09/a>
Xavier Mertens
Another Script-Based Ransomware
2022-11-05/a>
Guy Bruneau
Windows Malware with VHD Extension
2022-11-04/a>
Xavier Mertens
Remcos Downloader with Unicode Obfuscation
2022-10-24/a>
Xavier Mertens
C2 Communications Through outlook.com
2022-10-21/a>
Brad Duncan
sczriptzzbn inject pushes malware for NetSupport RAT
2022-10-18/a>
Xavier Mertens
Python Obfuscation for Dummies
2022-10-17/a>
Xavier Mertens
Fileless Powershell Dropper
2022-10-15/a>
Guy Bruneau
Malware - Covid Vaccination Supplier Declaration
2022-10-07/a>
Xavier Mertens
Powershell Backdoor with DGA Capability
2022-09-25/a>
Didier Stevens
Downloading Samples From Takendown Domains
2022-09-24/a>
Didier Stevens
Maldoc Analysis Info On MalwareBazaar
2022-09-23/a>
Xavier Mertens
Kids Like Cookies, Malware Too!
2022-09-22/a>
Xavier Mertens
RAT Delivered Through FODHelper
2022-09-15/a>
Xavier Mertens
Malicious Word Document with a Frameset
2022-09-14/a>
Xavier Mertens
Easy Process Injection within Python
2022-09-10/a>
Guy Bruneau
Phishing Word Documents with Suspicious URL
2022-09-03/a>
Didier Stevens
Video: James Webb JPEG With Malware
2022-09-02/a>
Didier Stevens
James Webb JPEG With Malware
2022-08-30/a>
Johannes Ullrich
Two things that will never die: bash scripts and IRC!
2022-08-22/a>
Xavier Mertens
32 or 64 bits Malware?
2022-07-29/a>
Johannes Ullrich
PDF Analysis Intro and OpenActions Entries
2022-07-25/a>
Xavier Mertens
PowerShell Script with Fileless Capability
2022-07-20/a>
Xavier Mertens
Malicious Python Script Behaving Like a Rubber Ducky
2022-06-25/a>
Xavier Mertens
Malicious Code Passed to PowerShell via the Clipboard
2022-06-22/a>
Xavier Mertens
Malicious PowerShell Targeting Cryptocurrency Browser Extensions
2022-06-16/a>
Xavier Mertens
Houdini is Back Delivered Through a JavaScript Dropper
2022-06-04/a>
Guy Bruneau
Spam Email Contains a Very Large ISO file
2022-06-03/a>
Xavier Mertens
Sandbox Evasion... With Just a Filename!
2022-05-31/a>
Xavier Mertens
First Exploitation of Follina Seen in the Wild
2022-05-20/a>
Xavier Mertens
A 'Zip Bomb' to Bypass Security Controls & Sandboxes
2022-05-19/a>
Brad Duncan
Bumblebee Malware from TransferXL URLs
2022-05-11/a>
Brad Duncan
TA578 using thread-hijacked emails to push ISO files for Bumblebee malware
2022-05-07/a>
Guy Bruneau
Phishing PDF Received in my ISC Mailbox
2022-05-06/a>
Jan Kopriva
What is the simplest malware in the world?
2022-05-05/a>
Brad Duncan
Password-protected Excel spreadsheet pushes Remcos RAT
2022-04-21/a>
Xavier Mertens
Multi-Cryptocurrency Clipboard Swapper
2022-04-06/a>
Brad Duncan
Windows MetaStealer Malware
2022-03-25/a>
Xavier Mertens
XLSB Files: Because Binary is Stealthier Than XML
2022-03-24/a>
Xavier Mertens
Malware Delivered Through Free Sharing Tool
2022-03-23/a>
Brad Duncan
Arkei Variants: From Vidar to Mars Stealer
2022-03-11/a>
Xavier Mertens
Keep an Eye on WebSockets
2022-03-09/a>
Xavier Mertens
Infostealer in a Batch File
2022-02-22/a>
Xavier Mertens
A Good Old Equation Editor Vulnerability Delivering Malware
2022-02-18/a>
Xavier Mertens
Remcos RAT Delivered Through Double Compressed Archive
2022-02-11/a>
Xavier Mertens
CinaRAT Delivered Through HTML ID Attributes
2022-01-20/a>
Xavier Mertens
RedLine Stealer Delivered Through FTP
2022-01-07/a>
Xavier Mertens
Custom Python RAT Builder
2022-01-06/a>
Xavier Mertens
Malicious Python Script Targeting Chinese People
2022-01-05/a>
Xavier Mertens
Code Reuse In the Malware Landscape
2021-12-21/a>
Xavier Mertens
More Undetected PowerShell Dropper
2021-12-15/a>
Xavier Mertens
Simple but Undetected PowerShell Backdoor
2021-12-03/a>
Xavier Mertens
The UPX Packer Will Never Die!
2021-12-02/a>
Brad Duncan
TA551 (Shathak) pushes IcedID (Bokbot)
2021-11-19/a>
Xavier Mertens
Downloader Disguised as Excel Add-In (XLL)
2021-11-18/a>
Xavier Mertens
JavaScript Downloader Delivers Agent Tesla Trojan
2021-10-21/a>
Brad Duncan
"Stolen Images Evidence" campaign pushes Sliver-based malware
2021-10-01/a>
Xavier Mertens
New Tool to Add to Your LOLBAS List: cvtres.exe
2021-09-23/a>
Xavier Mertens
Excel Recipe: Some VBA Code with a Touch of Excel4 Macro
2021-09-01/a>
Brad Duncan
STRRAT: a Java-based RAT that doesn't care if you have Java
2021-08-30/a>
Xavier Mertens
Cryptocurrency Clipboard Swapper Delivered With Love
2021-08-20/a>
Xavier Mertens
Waiting for the C2 to Show Up
2021-08-15/a>
Didier Stevens
Simple Tips For Triage Of MALWARE Bazaar's Daily Malware Batches
2021-08-07/a>
Didier Stevens
MALWARE Bazaar "Download daily malware batches"
2021-08-06/a>
Xavier Mertens
Malicious Microsoft Word Remains A Key Infection Vector
2021-07-30/a>
Xavier Mertens
Infected With a .reg File
2021-07-29/a>
Xavier Mertens
Malicious Content Delivered Through archive.org
2021-07-24/a>
Xavier Mertens
Agent.Tesla Dropped via a .daa Image and Talking to Telegram
2021-07-16/a>
Xavier Mertens
Multiple BaseXX Obfuscations
2021-07-06/a>
Xavier Mertens
Python DLL Injection Check
2021-06-30/a>
Brad Duncan
June 2021 Forensic Contest: Answers and Analysis
2021-06-11/a>
Xavier Mertens
Keeping an Eye on Dangerous Python Modules
2021-06-09/a>
Jan Kopriva
Architecture, compilers and black magic, or "what else affects the ability of AVs to detect malicious files"
2021-06-04/a>
Xavier Mertens
Russian Dolls VBS Obfuscation
2021-05-28/a>
Xavier Mertens
Malicious PowerShell Hosted on script.google.com
2021-05-27/a>
Jan Kopriva
All your Base are...nearly equal when it comes to AV evasion, but 64-bit executables are not
2021-05-21/a>
Xavier Mertens
Locking Kernel32.dll As Anti-Debugging Technique
2021-05-19/a>
Brad Duncan
May 2021 Forensic Contest: Answers and Analysis
2021-05-18/a>
Xavier Mertens
From RunDLL32 to JavaScript then PowerShell
2021-05-06/a>
Xavier Mertens
Alternative Ways To Perform Basic Tasks
2021-05-05/a>
Brad Duncan
May 2021 Forensic Contest
2021-04-29/a>
Xavier Mertens
From Python to .Net
2021-04-28/a>
Xavier Mertens
Deeper Analyzis of my Last Malicious PowerPoint Add-On
2021-04-23/a>
Xavier Mertens
Malicious PowerPoint Add-On: "Small Is Beautiful"
2021-04-09/a>
Xavier Mertens
No Python Interpreter? This Simple RAT Installs Its Own Copy
2021-04-08/a>
Xavier Mertens
Simple Powershell Ransomware Creating a 7Z Archive of your Files
2021-04-06/a>
Jan Kopriva
Malspam with Lokibot vs. Outlook and RFCs
2021-04-02/a>
Xavier Mertens
C2 Activity: Sandboxes or Real Victims?
2021-04-01/a>
Brad Duncan
April 2021 Forensic Quiz
2021-03-31/a>
Xavier Mertens
Quick Analysis of a Modular InfoStealer
2021-03-19/a>
Xavier Mertens
Pastebin.com Used As a Simple C2 Channel
2021-03-18/a>
Xavier Mertens
Simple Python Keylogger
2021-03-17/a>
Xavier Mertens
Defenders, Know Your Operating System Like Attackers Do!
2021-03-16/a>
Jan Kopriva
50 years of malware? Not really. 50 years of computer worms? That's a different story...
2021-03-04/a>
Xavier Mertens
From VBS, PowerShell, C Sharp, Process Hollowing to RAT
2021-02-19/a>
Xavier Mertens
Dynamic Data Exchange (DDE) is Back in the Wild?
2021-02-14/a>
Didier Stevens
Video: tshark & Malware Analysis
2021-02-12/a>
Xavier Mertens
AgentTesla Dropped Through Automatic Click in Microsoft Help File
2021-02-11/a>
Jan Kopriva
Agent Tesla hidden in a historical anti-malware tool
2021-02-03/a>
Brad Duncan
Excel spreadsheets push SystemBC malware
2021-02-02/a>
Xavier Mertens
New Example of XSL Script Processing aka "Mitre T1220"
2021-01-22/a>
Xavier Mertens
Another File Extension to Block in your MTA: .jnlp
2021-01-21/a>
Xavier Mertens
Powershell Dropping a REvil Ransomware
2021-01-04/a>
Jan Kopriva
From a small BAT file to Mass Logger infostealer
2021-01-02/a>
Guy Bruneau
Protecting Home Office and Enterprise in 2021
2020-12-24/a>
Xavier Mertens
Malicious Word Document Delivering an Octopus Backdoor
2020-12-22/a>
Xavier Mertens
Malware Victim Selection Through WiFi Identification
2020-12-03/a>
Brad Duncan
Traffic Analysis Quiz: Mr Natural
2020-11-25/a>
Xavier Mertens
Live Patching Windows API Calls Using PowerShell
2020-11-23/a>
Didier Stevens
Quick Tip: Cobalt Strike Beacon Analysis
2020-11-09/a>
Xavier Mertens
How Attackers Brush Up Their Malicious Scripts
2020-10-25/a>
Didier Stevens
Video: Pascal Strings
2020-10-21/a>
Daniel Wesemann
Shipping dangerous goods
2020-09-24/a>
Xavier Mertens
Party in Ibiza with PowerShell
2020-09-23/a>
Xavier Mertens
Malicious Word Document with Dynamic Content
2020-09-18/a>
Xavier Mertens
A Mix of Python & VBA in a Malicious Word Document
2020-09-15/a>
Brad Duncan
Traffic Analysis Quiz: Oh No... Another Infection!
2020-09-04/a>
Jan Kopriva
A blast from the past - XXEncoded VB6.0 Trojan
2020-09-03/a>
Xavier Mertens
Sandbox Evasion Using NTP
2020-08-28/a>
Xavier Mertens
Example of Malicious DLL Injected in PowerShell
2020-08-26/a>
Xavier Mertens
Malicious Excel Sheet with a NULL VT Score
2020-08-24/a>
Xavier Mertens
Tracking A Malware Campaign Through VT
2020-08-19/a>
Xavier Mertens
Example of Word Document Delivering Qakbot
2020-08-18/a>
Xavier Mertens
Using API's to Track Attackers
2020-08-14/a>
Jan Kopriva
Definition of 'overkill' - using 130 MB executable to hide 24 kB malware
2020-08-06/a>
Xavier Mertens
A Fork of the FTCode Powershell Ransomware
2020-08-05/a>
Brad Duncan
Traffic Analysis Quiz: What's the Malware From This Infection?
2020-07-24/a>
Xavier Mertens
Compromized Desktop Applications by Web Technologies
2020-07-15/a>
Brad Duncan
Word docs with macros for IcedID (Bokbot)
2020-07-10/a>
Brad Duncan
Excel spreasheet macro kicks off Formbook infection
2020-07-08/a>
Xavier Mertens
If You Want Something Done Right, You Have To Do It Yourself... Malware Too!
2020-06-13/a>
Guy Bruneau
Mirai Botnet Activity
2020-06-04/a>
Xavier Mertens
Anti-Debugging Technique based on Memory Protection
2020-06-01/a>
Jim Clausing
Stackstrings, type 2
2020-05-23/a>
Xavier Mertens
AgentTesla Delivered via a Malicious PowerPoint Add-In
2020-05-21/a>
Xavier Mertens
Malware Triage with FLOSS: API Calls Based Behavior
2020-05-20/a>
Brad Duncan
Microsoft Word document with malicious macro pushes IcedID (Bokbot)
2020-05-06/a>
Xavier Mertens
Keeping an Eye on Malicious Files Life Time
2020-04-27/a>
Xavier Mertens
Powershell Payload Stored in a PSCredential Object
2020-04-25/a>
Didier Stevens
MALWARE Bazaar
2020-04-24/a>
Xavier Mertens
Malicious Excel With a Strong Obfuscation and Sandbox Evasion
2020-04-20/a>
Didier Stevens
KPOT AutoIt Script: Analysis
2020-04-17/a>
Xavier Mertens
Weaponized RTF Document Generator & Mailer in PowerShell
2020-04-12/a>
Didier Stevens
Reader Analysis: "Dynamic analysis technique to get decrypted KPOT Malware."
2020-04-10/a>
Xavier Mertens
PowerShell Sample Extracting Payload From SSL
2020-04-03/a>
Xavier Mertens
Obfuscated with a Simple 0x0A
2020-03-31/a>
Johannes Ullrich
Kwampirs Targeted Attacks Involving Healthcare Sector
2020-03-27/a>
Xavier Mertens
Malicious JavaScript Dropping Payload in the Registry
2020-03-26/a>
Xavier Mertens
Very Large Sample as Evasion Technique?
2020-03-23/a>
Didier Stevens
KPOT Deployed via AutoIt Script
2020-03-22/a>
Didier Stevens
More COVID-19 Themed Malware
2020-03-21/a>
Guy Bruneau
Honeypot - Scanning and Targeting Devices & Services
2020-03-19/a>
Xavier Mertens
COVID-19 Themed Multistage Malware
2020-03-11/a>
Xavier Mertens
Agent Tesla Delivered via Fake Canon EOS Notification on Free OwnCloud Account
2020-03-06/a>
Xavier Mertens
A Safe Excel Sheet Not So Safe
2020-02-21/a>
Xavier Mertens
Quick Analysis of an Encrypted Compound Document Format
2020-02-14/a>
Xavier Mertens
Keep an Eye on Command-Line Browsers
2020-02-07/a>
Xavier Mertens
Sandbox Detection Tricks & Nice Obfuscation in a Single VBScript
2020-02-03/a>
Jan Kopriva
Analysis of a triple-encrypted AZORult downloader
2020-01-16/a>
Jan Kopriva
Picks of 2019 malware - the large, the small and the one full of null bytes
2020-01-10/a>
Xavier Mertens
More Data Exfiltration
2020-01-09/a>
Xavier Mertens
Quick Analyzis of a(nother) Maldoc
2020-01-02/a>
Xavier Mertens
Ransomware in Node.js
2019-12-24/a>
Brad Duncan
Malspam with links to Word docs pushes IcedID (Bokbot)
2019-12-12/a>
Xavier Mertens
Code & Data Reuse in the Malware Ecosystem
2019-11-23/a>
Guy Bruneau
Local Malware Analysis with Malice
2019-10-18/a>
Xavier Mertens
Quick Malicious VBS Analysis
2019-10-03/a>
Xavier Mertens
"Lost_Files" Ransomware
2019-09-19/a>
Xavier Mertens
Agent Tesla Trojan Abusing Corporate Email Accounts
2019-08-30/a>
Xavier Mertens
Malware Dropping a Local Node.js Instance
2019-08-28/a>
Xavier Mertens
Malware Samples Compiling Their Next Stage on Premise
2019-08-22/a>
Xavier Mertens
Simple Mimikatz & RDPWrapper Dropper
2019-08-18/a>
Didier Stevens
Video: Analyzing DAA Files
2019-08-16/a>
Didier Stevens
The DAA File Format
2019-08-12/a>
Didier Stevens
Malicious .DAA Attachments
2019-07-18/a>
Xavier Mertens
Malicious PHP Script Back on Stage?
2019-07-11/a>
Xavier Mertens
Russian Dolls Malicious Script Delivering Ursnif
2019-07-02/a>
Xavier Mertens
Malicious Script With Multiple Payloads
2019-06-14/a>
Jim Clausing
A few Ghidra tips for IDA users, part 4 - function call graphs
2019-06-10/a>
Xavier Mertens
Interesting JavaScript Obfuscation Example
2019-05-29/a>
Xavier Mertens
Behavioural Malware Analysis with Microsoft ASA
2019-05-13/a>
Xavier Mertens
From Phishing To Ransomware?
2019-05-03/a>
Jim Clausing
A few Ghidra tips for IDA users, part 3 - conversion, labels, and comments
2019-05-01/a>
Xavier Mertens
Another Day, Another Suspicious UDF File
2019-04-19/a>
Didier Stevens
Analyzing UDF Files with Python
2019-04-17/a>
Jim Clausing
A few Ghidra tips for IDA users, part 2 - strings and parameters
2019-04-17/a>
Xavier Mertens
Malware Sample Delivered Through UDF Image
2019-04-08/a>
Jim Clausing
A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code
2019-04-03/a>
Jim Clausing
A few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters
2019-03-30/a>
Didier Stevens
"404" is not Malware
2019-03-10/a>
Didier Stevens
Malicious HTA Analysis by a Reader
2019-03-10/a>
Didier Stevens
Quick and Dirty Malicious HTA Analysis
2019-02-14/a>
Xavier Mertens
Old H-Worm Delivered Through GitHub
2019-01-16/a>
Brad Duncan
Emotet infections and follow-up malware
2019-01-06/a>
Didier Stevens
Malicious .tar Attachments
2019-01-05/a>
Didier Stevens
A Malicious JPEG? Second Example
2019-01-04/a>
Didier Stevens
A Malicious JPEG?
2019-01-02/a>
Xavier Mertens
Malicious Script Leaking Data via FTP
2018-12-09/a>
Didier Stevens
Quickie: String Analysis is Still Useful
2018-12-08/a>
Didier Stevens
Reader Malware Submission: MHT File Inside a ZIP File
2018-11-27/a>
Xavier Mertens
More obfuscated shell scripts: Fake MacOS Flash update
2018-11-26/a>
Xavier Mertens
Obfuscated bash script targeting QNap boxes
2018-11-22/a>
Xavier Mertens
Divided Payload in Multiple Pasties
2018-11-06/a>
Xavier Mertens
Malicious Powershell Script Dissection
2018-10-23/a>
Xavier Mertens
Diving into Malicious AutoIT Code
2018-10-22/a>
Xavier Mertens
Malicious Powershell using a Decoy Picture
2018-10-21/a>
Pasquale Stirparo
Beyond good ol’ LaunchAgent - part 0
2018-10-12/a>
Xavier Mertens
More Equation Editor Exploit Waves
2018-09-28/a>
Xavier Mertens
More Excel DDE Code Injection
2018-09-22/a>
Didier Stevens
Suspicious DNS Requests ... Issued by a Firewall
2018-09-16/a>
Didier Stevens
20/20 malware vision
2018-09-13/a>
Xavier Mertens
Malware Delivered Through MHT Files
2018-09-05/a>
Xavier Mertens
Malicious PowerShell Compiling C# Code on the Fly
2018-08-31/a>
Jim Clausing
Quickie: Using radare2 to disassemble shellcode
2018-08-30/a>
Xavier Mertens
Crypto Mining Is More Popular Than Ever!
2018-08-26/a>
Didier Stevens
Identifying numeric obfuscation
2018-08-26/a>
Didier Stevens
"When was this machine infected?"
2018-08-24/a>
Xavier Mertens
Microsoft Publisher Files Delivering Malware
2018-08-21/a>
Xavier Mertens
Malicious DLL Loaded Through AutoIT
2018-08-06/a>
Didier Stevens
Numeric obfuscation: another example
2018-08-04/a>
Didier Stevens
Dealing with numeric obfuscation in malicious scripts
2018-08-02/a>
Brad Duncan
DHL-themed malspam reveals embedded malware in animated gif
2018-07-26/a>
Xavier Mertens
Windows Batch File Deobfuscation
2018-07-09/a>
Renato Marinho
Criminals Don't Read Instructions or Use Strong Passwords
2018-06-07/a>
Remco Verhoef
Automated twitter loot collection
2018-06-05/a>
Xavier Mertens
Malicious Post-Exploitation Batch File
2018-06-01/a>
Remco Verhoef
Binary analysis with Radare2
2018-05-22/a>
Xavier Mertens
Malware Distributed via .slk Files
2018-05-19/a>
Xavier Mertens
Malicious Powershell Targeting UK Bank Customers
2018-05-09/a>
Xavier Mertens
Nice Phishing Sample Delivering Trickbot
2018-05-07/a>
Xavier Mertens
Adding Persistence Via Scheduled Tasks
2018-05-01/a>
Xavier Mertens
Diving into a Simple Maldoc Generator
2018-03-05/a>
Xavier Mertens
Malicious Bash Script with Multiple Features
2018-03-04/a>
Xavier Mertens
The Crypto Miners Fight For CPU Cycles
2018-02-25/a>
Didier Stevens
Retrieving malware over Tor on Windows
2018-02-02/a>
Xavier Mertens
Simple but Effective Malicious XLS Sheet
2018-01-28/a>
Didier Stevens
Is this a pentest?
2018-01-26/a>
Xavier Mertens
Investigating Microsoft BITS Activity
2018-01-25/a>
Xavier Mertens
Ransomware as a Service
2018-01-11/a>
Xavier Mertens
Mining or Nothing!
2017-12-19/a>
Xavier Mertens
Example of 'MouseOver' Link in a Powerpoint File
2017-12-16/a>
Xavier Mertens
Microsoft Office VBA Macro Obfuscation via Metadata
2017-11-29/a>
Xavier Mertens
Fileless Malicious PowerShell Sample
2017-11-16/a>
Xavier Mertens
Suspicious Domains Tracking Dashboard
2017-11-15/a>
Xavier Mertens
If you want something done right, do it yourself!
2017-11-13/a>
Guy Bruneau
VBE Embeded Script (info.zip)
2017-11-07/a>
Xavier Mertens
Interesting VBA Dropper
2017-11-03/a>
Xavier Mertens
Simple Analysis of an Obfuscated JAR File
2017-10-31/a>
Xavier Mertens
Some Powershell Malicious Code
2017-10-29/a>
Didier Stevens
Remember ACE files?
2017-10-24/a>
Xavier Mertens
BadRabbit: New ransomware wave hitting RU & UA
2017-10-15/a>
Didier Stevens
Peeking into .msg files
2017-09-09/a>
Didier Stevens
Malware analysis output sanitization
2017-09-02/a>
Xavier Mertens
AutoIT based malware back in the wild
2017-08-26/a>
Didier Stevens
Malware analysis: searching for dots
2017-08-25/a>
Xavier Mertens
Malicious AutoIT script delivered in a self-extracting RAR file
2017-08-23/a>
Xavier Mertens
Malicious script dropping an executable signed by Avast?
2017-08-18/a>
Renato Marinho
EngineBox Malware Supports 10+ Brazilian Banks
2017-07-21/a>
Didier Stevens
Malicious .iso Attachments
2017-07-09/a>
Russ McRee
Adversary hunting with SOF-ELK
2017-07-05/a>
Didier Stevens
Selecting domains with random names
2017-06-22/a>
Xavier Mertens
Obfuscating without XOR
2017-06-06/a>
Didier Stevens
Malware and XOR - Part 2
2017-06-05/a>
Didier Stevens
Malware and XOR - Part 1
2017-05-16/a>
Russ McRee
WannaCry? Do your own data analysis.
2017-05-13/a>
Guy Bruneau
Microsoft Released Guidance for WannaCrypt
2017-04-28/a>
Xavier Mertens
Another Day, Another Obfuscation Technique
2017-04-19/a>
Xavier Mertens
Hunting for Malicious Excel Sheets
2017-04-05/a>
Xavier Mertens
Whitelists: The Holy Grail of Attackers
2017-03-18/a>
Xavier Mertens
Example of Multiple Stages Dropper
2017-03-12/a>
Guy Bruneau
Honeypot Logs and Tracking a VBE Script
2017-03-08/a>
Xavier Mertens
Not All Malware Samples Are Complex
2017-02-05/a>
Xavier Mertens
Many Malware Samples Found on Pastebin
2017-01-31/a>
Johannes Ullrich
Malicious Office files using fileless UAC bypass to drop KEYBASE malware
2017-01-24/a>
Xavier Mertens
Malicious SVG Files in the Wild
2017-01-06/a>
John Bambenek
Ransomware Operators Cold Calling UK Schools to Get Malware Through
2017-01-05/a>
John Bambenek
New Year's Resolution: Build Your Own Malware Lab?
2017-01-01/a>
Didier Stevens
py2exe Decompiling - Part 1
2016-12-13/a>
Xavier Mertens
UAC Bypass in JScript Dropper
2016-11-11/a>
Rick Wanner
Benevolent malware? reincarna/Linux.Wifatch
2016-10-30/a>
Pasquale Stirparo
Volatility Bot: Automated Memory Analysis
2016-09-30/a>
Xavier Mertens
Another Day, Another Malicious Behaviour
2016-09-13/a>
Rob VandenBrink
If it's Free, YOU are the Product
2016-09-05/a>
Xavier Mertens
Malware Delivered via '.pub' Files
2016-09-01/a>
Xavier Mertens
Maxmind.com (Ab)used As Anti-Analysis Technique
2016-08-25/a>
Xavier Mertens
Out-of-Band iOS Patch Fixes 0-Day Vulnerabilities
2016-08-24/a>
Xavier Mertens
Example of Targeted Attack Through a Proxy PAC File
2016-08-23/a>
Xavier Mertens
Voice Message Notifications Deliver Ransomware
2016-08-01/a>
Daniel Wesemann
Are you getting I-CANNED ?
2016-07-27/a>
Xavier Mertens
Analyze of a Linux botnet client source code
2016-07-25/a>
Didier Stevens
Python Malware - Part 4
2016-07-16/a>
Didier Stevens
Python Malware - Part 3
2016-07-12/a>
Xavier Mertens
Hunting for Malicious Files with MISP + OSSEC
2016-06-20/a>
Xavier Mertens
Ongoing Spam Campaign Related to Swift
2016-06-18/a>
Rob VandenBrink
Controlling JavaScript Malware Before it Runs
2016-05-15/a>
Didier Stevens
Python Malware - Part 1
2016-05-13/a>
Xavier Mertens
MISP - Malware Information Sharing Platform
2016-05-05/a>
Xavier Mertens
Microsoft BITS Used to Download Payloads
2016-05-02/a>
Rick Wanner
Fake Chrome update for Android
2016-04-21/a>
Daniel Wesemann
Decoding Pseudo-Darkleech (#1)
2016-04-21/a>
Daniel Wesemann
Decoding Pseudo-Darkleech (Part #2)
2016-04-10/a>
Didier Stevens
Handling Malware Samples
2016-03-07/a>
Xavier Mertens
Another Malicious Document, Another Way to Deliver Malicious Code
2016-02-24/a>
Xavier Mertens
Analyzis of a Malicious .lnk File with an Embedded Payload
2016-02-18/a>
Xavier Mertens
Hunting for Executable Code in Windows Environments
2016-02-11/a>
Tom Webb
Tomcat IR with XOR.DDoS
2016-01-24/a>
Didier Stevens
Obfuscated MIME Files
2016-01-15/a>
Xavier Mertens
JavaScript Deobfuscation Tool
2016-01-01/a>
Didier Stevens
Failure Is An Option
2015-12-26/a>
Didier Stevens
Malfunctioning Malware
2015-12-16/a>
Xavier Mertens
Playing With Sandboxes Like a Boss
2015-12-06/a>
Mark Hofman
Malware SPAM a new run has started.
2015-11-09/a>
John Bambenek
Protecting Users and Enterprises from the Mobile Malware Threat
2015-09-29/a>
Pedro Bueno
Tricks for DLL analysis
2015-09-28/a>
Johannes Ullrich
"Transport of London" Malicious E-Mail
2015-09-21/a>
Xavier Mertens
Detecting XCodeGhost Activity
2015-04-24/a>
Basil Alawi S.Taher
Fileless Malware
2015-04-09/a>
Brad Duncan
An example of the malicious emails sometimes sent to the ISC handler addresses
2015-03-18/a>
Daniel Wesemann
New SANS memory forensics poster
2015-03-14/a>
Didier Stevens
Maldoc VBA Sandbox/Virtualization Detection
2015-03-08/a>
Brad Duncan
What Happened to You, Asprox Botnet?
2015-02-19/a>
Daniel Wesemann
Macros? Really?!
2014-10-03/a>
Johannes Ullrich
CSAM: The Power of Virustotal to Turn Harmless Binaries Malicious
2014-09-22/a>
Johannes Ullrich
Fake LogMeIn Certificate Update with Bad AV Detection Rate
2014-08-06/a>
Chris Mohan
Free Service to Help CryptoLocker Victims by FireEye and Fox-IT
2014-07-22/a>
Daniel Wesemann
Ivan's Order of Magnitude
2014-07-19/a>
Russ McRee
Keeping the RATs out: the trap is sprung - Part 3
2014-07-18/a>
Russ McRee
Keeping the RATs out: **it happens - Part 2
2014-07-18/a>
Russ McRee
Gameover Zeus reported as "returned from the dead"
2014-07-16/a>
Russ McRee
Keeping the RATs out: an exercise in building IOCs - Part 1
2014-07-05/a>
Guy Bruneau
Malware Analysis with pedump
2014-06-22/a>
Russ McRee
OfficeMalScanner helps identify the source of a compromise
2014-06-08/a>
Guy Bruneau
efax Spam Containing Malware
2014-04-06/a>
Basil Alawi S.Taher
"Power Worm" PowerShell based Malware
2014-04-05/a>
Jim Clausing
Those strange e-mails with URLs in them can lead to Android malware
2014-03-04/a>
Daniel Wesemann
XPired!
2014-02-28/a>
Daniel Wesemann
Fiesta!
2014-01-19/a>
Rick Wanner
Anatomy of a Malware distribution campaign
2013-12-24/a>
Daniel Wesemann
Mr Jones wants you to appear in court!
2013-12-23/a>
Daniel Wesemann
Costco, BestBuy, Walmart really want to send you a package!
2013-12-07/a>
Guy Bruneau
Suspected Active Rovnix Botnet Controller
2013-11-02/a>
Rick Wanner
Protecting Your Family's Computers
2013-10-31/a>
Russ McRee
Happy Halloween: The Ghost Really May Be In The Machine
2013-10-30/a>
Russ McRee
SIR v15: Five good reasons to leave Windows XP behind
2013-10-28/a>
Daniel Wesemann
Exploit cocktail (Struts, Java, Windows) going after 3-month old vulnerabilities
2013-10-24/a>
Johannes Ullrich
False Positive: php.net Malware Alert
2013-09-30/a>
Adrien de Beaupre
Twitter DM spam/malware
2013-09-12/a>
Daniel Wesemann
37.58.73.42 / 95.156.228.69 / 195.210.43.42, anyone?
2013-09-10/a>
Swa Frantzen
Macs need to patch too!
2013-08-29/a>
Russ McRee
Suspect Sendori software
2013-07-04/a>
Russ McRee
Celebrating 4th of July With a Malware PCAP Visualization
2013-06-18/a>
Russ McRee
Volatility rules...any questions?
2013-05-21/a>
Adrien de Beaupre
Moore, Oklahoma tornado charitable organization scams, malware, and phishing
2013-05-17/a>
Daniel Wesemann
e-netprotections.su ?
2013-05-16/a>
Daniel Wesemann
Extracting signatures from Apple .apps
2013-05-11/a>
Lenny Zeltser
Extracting Digital Signatures from Signed Malware
2013-05-01/a>
Daniel Wesemann
The cost of cleaning up
2013-04-10/a>
Manuel Humberto Santander Pelaez
Massive Google scam sent by email to Colombian domains
2013-03-22/a>
Mark Baggett
Wipe the drive! Stealthy Malware Persistence - Part 4
2013-03-20/a>
Mark Baggett
Wipe the drive! Stealthy Malware Persistence - Part 3
2013-03-19/a>
Johannes Ullrich
Scam of the day: More fake CNN e-mails
2013-03-15/a>
Mark Baggett
AVG detect legit file as virus
2013-03-14/a>
Mark Baggett
Wipe the drive! Stealthy Malware Persistence - Part 2
2013-03-13/a>
Mark Baggett
Wipe the drive! Stealthy Malware Persistence Mechanism - Part 1
2013-02-25/a>
Johannes Ullrich
Mass-Customized Malware Lures: Don't trust your cat!
2013-01-08/a>
Jim Clausing
Cuckoo 0.5 is out and the world didn't end
2012-12-18/a>
Rob VandenBrink
All I Want for Christmas is to Not Get Hacked !
2012-12-03/a>
Kevin Liston
Mobile Malware: Request for Field Reports
2012-11-02/a>
Daniel Wesemann
Lamiabiocasa
2012-11-01/a>
Daniel Wesemann
Patched your Java yet?
2012-10-14/a>
Pedro Bueno
Cyber Security Awareness Month - Day 14 - Poor Man's File Analysis System - Part 1
2012-09-21/a>
Guy Bruneau
Storing your Collection of Malware Samples with Malwarehouse
2012-09-14/a>
Lenny Zeltser
Analyzing Malicious RTF Files Using OfficeMalScanner's RTFScan
2012-07-21/a>
Rick Wanner
OpenDNS is looking for a few good malware people!
2012-07-05/a>
Adrien de Beaupre
New OS X trojan backdoor MaControl variant reported
2012-06-27/a>
Swa Frantzen
Online Banking Heists
2012-06-26/a>
Daniel Wesemann
Run, Forest! (Update)
2012-06-25/a>
Rick Wanner
Targeted Malware for Industrial Espionage?
2012-06-25/a>
Swa Frantzen
Belgian online banking customers hacked.
2012-06-22/a>
Daniel Wesemann
Run, Forest!
2012-06-21/a>
Raul Siles
Print Bomb? (Take 2)
2012-06-21/a>
Russ McRee
Analysis of drive-by attack sample set
2012-06-19/a>
Daniel Wesemann
Vulnerabilityqueerprocessbrittleness
2012-06-04/a>
Lenny Zeltser
Decoding Common XOR Obfuscation in Malicious Code
2012-04-26/a>
Richard Porter
Define Irony: A medical device with a Virus?
2012-04-25/a>
Daniel Wesemann
Blacole's obfuscated JavaScript
2012-04-25/a>
Daniel Wesemann
Blacole's shell code
2012-04-12/a>
Guy Bruneau
HP ProCurve 5400 zl Switch, Flash Cards Infected with Malware
2012-04-12/a>
Guy Bruneau
Apple Java Updates for Mac OS X
2012-03-25/a>
Daniel Wesemann
evilcode.class
2012-03-03/a>
Jim Clausing
New automated sandbox for Android malware
2012-02-24/a>
Guy Bruneau
Flashback Trojan in the Wild
2012-02-20/a>
Pedro Bueno
Simple Malware Research Tools
2012-02-20/a>
Rick Wanner
DNSChanger resolver shutdown deadline is March 8th
2012-01-14/a>
Daniel Wesemann
Hello, Antony!
2011-12-28/a>
Daniel Wesemann
.nl.ai ?
2011-12-10/a>
Daniel Wesemann
Unwanted Presents
2011-12-07/a>
Lenny Zeltser
V8 as an Alternative to SpiderMonkey for JavaScript Deobfuscation
2011-11-04/a>
Guy Bruneau
Duqu Mitigation
2011-10-20/a>
Johannes Ullrich
Evil Printers Sending Mail
2011-09-07/a>
Lenny Zeltser
Analyzing Mobile Device Malware - Honeynet Forensic Challenge 9 and Some Tools
2011-08-29/a>
Kevin Shortt
Internet Worm in the Wild
2011-06-15/a>
Pedro Bueno
Hit by MacDefender, Apple Web Security (name your Mac FakeAV here)...
2011-05-25/a>
Daniel Wesemann
Apple advisory on "MacDefender" malware
2011-05-19/a>
Daniel Wesemann
Fake AV Bingo
2011-05-14/a>
Guy Bruneau
Websense Study Claims Canada Next Hotbed for Cybercrime Web Hosting Activity
2011-05-03/a>
Johannes Ullrich
Update on Osama Bin Laden themed Malware
2011-05-02/a>
Johannes Ullrich
Bin Laden Death Related Malware
2011-04-23/a>
Manuel Humberto Santander Pelaez
Image search can lead to malware download
2011-03-01/a>
Daniel Wesemann
AV software and "sharing samples"
2011-02-07/a>
Pedro Bueno
The Good , the Bad and the Unknown Online Scanners
2011-02-01/a>
Lenny Zeltser
The Importance of HTTP Headers When Investigating Malicious Sites
2010-12-29/a>
Daniel Wesemann
Malware Domains 2234.in, 0000002.in & co
2010-12-29/a>
Daniel Wesemann
Beware of strange web sites bearing gifts ...
2010-10-26/a>
Pedro Bueno
Cyber Security Awareness Month - Day 26 - Sharing Office Files
2010-09-09/a>
Marcus Sachs
'Here You Have' Email
2010-07-21/a>
Adrien de Beaupre
autorun.inf and .lnk Malware (NOT 'Vulnerability in Windows Shell Could Allow Remote Code Execution' 2286198)
2010-07-21/a>
Adrien de Beaupre
Dell PowerEdge R410 replacement motherboard firmware contains malware
2010-07-06/a>
Rob VandenBrink
Bogus Support Organizations use Live Operators to Install Malware
2010-07-04/a>
Manuel Humberto Santander Pelaez
Malware inside PDF Files
2010-06-17/a>
Deborah Hale
FYI - Another bogus site
2010-06-14/a>
Manuel Humberto Santander Pelaez
Rogue facebook application acting like a worm
2010-06-07/a>
Manuel Humberto Santander Pelaez
Software Restriction Policy to keep malware away
2010-06-02/a>
Rob VandenBrink
New Mac malware - OSX/Onionspy
2010-05-26/a>
Bojan Zdrnja
Malware modularization and AV detection evasion
2010-05-23/a>
Manuel Humberto Santander Pelaez
e-mail scam announcing Fidel Castro's funeral ... and nasty malware to your computer.
2010-05-21/a>
Rick Wanner
IBM distributes malware at AusCERT!
2010-04-30/a>
Kevin Liston
The Importance of Small Files
2010-04-19/a>
Daniel Wesemann
Linked into scams?
2010-04-18/a>
Guy Bruneau
Some NetSol hosted sites breached
2010-04-13/a>
Johannes Ullrich
More Legal Threat Malware E-Mail
2010-03-30/a>
Pedro Bueno
Sharing the Tools
2010-03-26/a>
Daniel Wesemann
Getting the EXE out of the RTF again
2010-03-09/a>
Marcus Sachs
Energizer Malware
2010-03-04/a>
Daniel Wesemann
salefale-dot-com is bad
2010-03-03/a>
Johannes Ullrich
Reports about large number of fake Amazon order confirmations
2010-02-21/a>
Patrick Nolan
Looking for "more useful" malware information? Help develop the format.
2010-01-14/a>
Bojan Zdrnja
PDF Babushka
2010-01-07/a>
Daniel Wesemann
Static analysis of malicious PDFs
2010-01-07/a>
Daniel Wesemann
Static analysis of malicous PDFs (Part #2)
2009-12-17/a>
Daniel Wesemann
overlay.xul is back
2009-12-17/a>
Daniel Wesemann
In caches, danger lurks
2009-12-16/a>
Rob VandenBrink
Beware the Attack of the Christmas Greeting Cards !
2009-12-07/a>
Rick Wanner
Cheat Sheet: Analyzing Malicious Documents
2009-12-04/a>
Daniel Wesemann
Max Power's Malware Paradise
2009-12-02/a>
Rob VandenBrink
SPAM and Malware taking advantage of H1N1 concerns
2009-11-25/a>
Jim Clausing
Updates to my GREM Gold scripts and a new script
2009-09-25/a>
Deborah Hale
Conficker Continues to Impact Networks
2009-09-25/a>
Deborah Hale
Malware delivered over Google and Yahoo Ad's?
2009-09-25/a>
Lenny Zeltser
Categories of Common Malware Traits
2009-09-04/a>
Adrien de Beaupre
Fake anti-virus
2009-08-29/a>
Guy Bruneau
Immunet Protect - Cloud and Community Malware Protection
2009-08-26/a>
Johannes Ullrich
Malicious CD ROMs mailed to banks
2009-07-26/a>
Jim Clausing
New Volatility plugins
2009-07-03/a>
Adrien de Beaupre
Happy 4th of July!
2009-07-02/a>
Daniel Wesemann
Getting the EXE out of the RTF
2009-07-02/a>
Bojan Zdrnja
Cold Fusion web sites getting compromised
2009-06-16/a>
John Bambenek
Iran Internet Blackout: Using Twitter for Operational Intelligence
2009-06-16/a>
John Bambenek
URL Shortening Service Cligs Hacked
2009-06-04/a>
Raul Siles
Malware targetting banks ATM's
2009-06-04/a>
Raul Siles
Targeted e-mail attacks asking to verify wire transfer details
2009-06-01/a>
G. N. White
Yet another "Digital Certificate" malware campaign
2009-05-20/a>
Pedro Bueno
Cyber Warfare and Kylin thoughts
2009-05-07/a>
Deborah Hale
Malicious Content on the Web
2009-05-04/a>
Tom Liston
Facebook phishing malware
2009-04-24/a>
Pedro Bueno
Did you check your conference goodies?
2009-03-13/a>
Bojan Zdrnja
When web application security, Microsoft and the AV vendors all fail
2009-02-23/a>
Daniel Wesemann
Turf War
2009-02-23/a>
Daniel Wesemann
And the Oscar goes to...
2009-02-10/a>
Bojan Zdrnja
More tricks from Conficker and VM detection
2009-02-09/a>
Bojan Zdrnja
Some tricks from Conficker's bag
2009-02-04/a>
Daniel Wesemann
Titan Shields up!
2009-01-31/a>
John Bambenek
Google Search Engine's Malware Detection Broken
2009-01-24/a>
Pedro Bueno
Identifying and Removing the iWork09 Trojan
2009-01-18/a>
Daniel Wesemann
3322. org
2009-01-15/a>
Bojan Zdrnja
Conficker's autorun and social engineering
2009-01-12/a>
William Salusky
Downadup / Conficker - MS08-067 exploit and Windows domain account lockout
2009-01-07/a>
Bojan Zdrnja
An Israeli patriot program or a trojan
2009-01-02/a>
Rick Wanner
Tools on my Christmas list.
2008-12-25/a>
Maarten Van Horenbeeck
Merry Christmas, and beware of digital hitchhikers!
2008-12-25/a>
Maarten Van Horenbeeck
Christmas Ecard Malware
2008-12-17/a>
donald smith
Team CYMRU's Malware Hash Registry
2008-12-05/a>
Daniel Wesemann
Been updatin' your Flash player lately?
2008-12-05/a>
Daniel Wesemann
Baby, baby!
2008-12-04/a>
Bojan Zdrnja
Rogue DHCP servers
2008-11-17/a>
Jim Clausing
Finding stealth injected DLLs
2008-11-16/a>
Maarten Van Horenbeeck
Detection of Trojan control channels
2008-11-12/a>
John Bambenek
Thoughts on Security Intelligence (McColo Corp alleged spam/malware host knocked offline)
2008-11-11/a>
Swa Frantzen
Acrobat continued activity in the wild
2008-11-10/a>
Stephen Hall
Adobe Reader Vulnerability - part 2
2008-10-07/a>
Kyle Haugsness
Good reading and a malware challenge
2008-09-29/a>
Daniel Wesemann
ASPROX mutant
2008-09-22/a>
Maarten Van Horenbeeck
Data exfiltration and the use of anonymity providers
2008-09-18/a>
Bojan Zdrnja
Monitoring HTTP User-Agent fields
2008-09-07/a>
Lorna Hutcheson
Malware Analysis: Tools are only so good
2008-09-03/a>
Daniel Wesemann
Static analysis of Shellcode
2008-09-03/a>
Daniel Wesemann
Static analysis of Shellcode - Part 2
2008-09-01/a>
John Bambenek
The Number of Machines Controlled by Botnets Has Jumped 4x in Last 3 Months
2008-08-13/a>
Adrien de Beaupre
CNN switched to MSNBC
2008-08-05/a>
Daniel Wesemann
The news update you never asked for
2008-07-20/a>
Kevin Liston
Malware Intelligence: Making it Actionable
2008-07-15/a>
Maarten Van Horenbeeck
Extracting scripts and data from suspect PDF files
2008-07-14/a>
Daniel Wesemann
Obfuscated JavaScript Redux
2008-07-07/a>
Pedro Bueno
Bad url classification
2008-06-18/a>
Marcus Sachs
Olympics Part II
2008-06-14/a>
Lorna Hutcheson
Malware Detection - Take the Blinders Off
2008-06-10/a>
Swa Frantzen
Ransomware keybreaking
2008-06-01/a>
Mark Hofman
Free Yahoo email account! Sign me up, Ok well maybe not.
2008-05-28/a>
Adrien de Beaupre
Another example of malicious SWF
2008-05-27/a>
Adrien de Beaupre
Malicious swf files?
2008-05-26/a>
Marcus Sachs
Predictable Response
2008-05-14/a>
Bojan Zdrnja
War of the worlds?
2008-05-02/a>
Adrien de Beaupre
Hi, remember me?...
2008-04-30/a>
Bojan Zdrnja
(Minor) evolution in Mac DNS changer malware
2008-04-24/a>
Maarten Van Horenbeeck
Targeted attacks using malicious PDF files
2008-04-16/a>
Bojan Zdrnja
The 10.000 web sites infection mystery solved
2008-04-15/a>
Johannes Ullrich
SRI Malware Threat Center
2008-04-14/a>
John Bambenek
A Federal Subpoena or Just Some More Spam & Malware?
2008-04-07/a>
John Bambenek
HP USB Keys Shipped with Malware for your Proliant Server
2008-04-07/a>
John Bambenek
Got Kraken?
2008-04-07/a>
John Bambenek
Kraken Technical Details: UPDATED x3
2008-04-06/a>
Daniel Wesemann
Advanced obfuscated JavaScript analysis
2008-04-04/a>
Daniel Wesemann
nmidahena
2008-04-03/a>
Bojan Zdrnja
VB detection: is it so difficult?
2008-04-02/a>
Adrien de Beaupre
When is a DMG file not a DMG file
2008-03-27/a>
Maarten Van Horenbeeck
Guarding the guardians: a story of PGP key ring theft
2006-08-31/a>
Swa Frantzen
NT botnet submitted
2000-01-02/a>
Deborah Hale
2010 A Look Back - 2011 A Look Ahead
VISH
2012-11-08/a>
Daniel Wesemann
Get a 40% discount on your hotel room!
2010-07-06/a>
Rob VandenBrink
Bogus Support Organizations use Live Operators to Install Malware
2008-10-20/a>
Johannes Ullrich
Fraudulent ATM Reactivation Phone Calls.
Homepage
Diaries
Podcasts
Jobs
Data
TCP/UDP Port Activity
Port Trends
SSH/Telnet Scanning Activity
Weblogs
Threat Feeds Activity
Threat Feeds Map
Useful InfoSec Links
Presentations & Papers
Research Papers
API
Tools
DShield Sensor
DNS Looking Glass
Honeypot (RPi/AWS)
InfoSec Glossary
Contact Us
Contact Us
About Us
Handlers
About Us
Slack Channel
Mastodon
Bluesky
X
Keep yourself informed with our
aggregate InfoSec news