MAC OSX TROJAN MALWARE APPLE |
| 2009-01-24 | Pedro Bueno | Identifying and Removing the iWork09 Trojan |
MAC |
| 2025-04-02/a> | Guy Bruneau | Exploring Statistical Measures to Predict URLs as Legitimate or Intrusive [Guest Diary] |
| 2025-03-31/a> | Johannes Ullrich | Apple Patches Everything: March 31st 2025 Edition |
| 2025-03-26/a> | Jesse La Grew | [Guest Diary] Leveraging CNNs and Entropy-Based Feature Selection to Identify Potential Malware Artifacts of Interest |
| 2025-03-11/a> | Johannes Ullrich | Apple Fixes Exploited WebKit Vulnerability in iOS, MacOS, visionOS and Safari |
| 2024-12-11/a> | Johannes Ullrich | Apple Updates Everything (iOS, iPadOS, macOS, watchOS, tvOS, visionOS) |
| 2024-10-28/a> | Johannes Ullrich | Apple Updates Everything |
| 2024-10-07/a> | Xavier Mertens | macOS Sequoia: System/Network Admins, Hold On! |
| 2024-07-30/a> | Johannes Ullrich | Apple Patches Everything. July 2024 Edition |
| 2024-07-10/a> | Jesse La Grew | Finding Honeypot Data Clusters Using DBSCAN: Part 1 |
| 2024-01-22/a> | Johannes Ullrich | Apple Updates Everything - New 0 Day in WebKit |
| 2024-01-19/a> | Xavier Mertens | macOS Python Script Replacing Wallet Applications with Rogue Apps |
| 2023-12-11/a> | Johannes Ullrich | Apple Patches Everything |
| 2023-09-26/a> | Johannes Ullrich | Apple Releases MacOS Sonoma Including Numerous Security Patches |
| 2023-09-11/a> | Johannes Ullrich | Apple fixes 0-Day Vulnerability in Older Operating Systems |
| 2023-09-07/a> | Johannes Ullrich | Apple Releases iOS/iPadOS 16.6.1, macOS 13.5.2, watchOS 9.6.2 fixing two zeroday vulnerabilities |
| 2023-08-26/a> | Xavier Mertens | macOS: Who?s Behind This Network Connection? |
| 2023-06-22/a> | Johannes Ullrich | Apple Patches Exploited Vulnerabilities in iOS/iPadOS, macOS, watchOS and Safari |
| 2023-04-07/a> | Johannes Ullrich | Apple Patching Two 0-Day Vulnerabilities in iOS and macOS |
| 2023-03-27/a> | Johannes Ullrich | Apple Updates Everything (including Studio Display) |
| 2022-07-26/a> | Xavier Mertens | How is Your macOS Security Posture? |
| 2022-07-20/a> | Johannes Ullrich | Apple Patches Everything Day |
| 2022-04-20/a> | Brad Duncan | "aa" distribution Qakbot (Qbot) infection with DarkVNC traffic |
| 2022-03-31/a> | Johannes Ullrich | Apple Patches Actively Exploited Vulnerability in macOS, iOS and iPadOS, |
| 2022-03-25/a> | Xavier Mertens | XLSB Files: Because Binary is Stealthier Than XML |
| 2022-03-14/a> | Johannes Ullrich | Apple Updates Everything: MacOS 12.3, XCode 13.3, tvOS 15.4, watchOS 8.5, iPadOS 15.4 and more |
| 2022-02-10/a> | Johannes Ullrich | iOS/iPadOS and MacOS Update: Single WebKit 0-Day Vulnerability Patched |
| 2022-01-27/a> | Johannes Ullrich | Apple Patches Everything |
| 2022-01-22/a> | Xavier Mertens | Mixed VBA & Excel4 Macro In a Targeted Excel Sheet |
| 2021-12-28/a> | Russ McRee | LotL Classifier tests for shells, exfil, and miners |
| 2021-12-20/a> | Jan Kopriva | PowerPoint attachments, Agent Tesla and code reuse in malware |
| 2021-12-02/a> | Brad Duncan | TA551 (Shathak) pushes IcedID (Bokbot) |
| 2021-09-23/a> | Xavier Mertens | Excel Recipe: Some VBA Code with a Touch of Excel4 Macro |
| 2021-09-01/a> | Brad Duncan | STRRAT: a Java-based RAT that doesn't care if you have Java |
| 2021-08-06/a> | Xavier Mertens | Malicious Microsoft Word Remains A Key Infection Vector |
| 2021-04-23/a> | Xavier Mertens | Malicious PowerPoint Add-On: "Small Is Beautiful" |
| 2021-03-12/a> | Guy Bruneau | Microsoft DHCP Logs Shipped to ELK |
| 2021-03-03/a> | Brad Duncan | Qakbot infection with Cobalt Strike |
| 2021-02-25/a> | Daniel Wesemann | Forensicating Azure VMs |
| 2021-02-23/a> | Jan Kopriva | Qakbot in a response to Full Disclosure post |
| 2021-02-05/a> | Xavier Mertens | VBA Macro Trying to Alter the Application Menus |
| 2021-02-03/a> | Brad Duncan | Excel spreadsheets push SystemBC malware |
| 2021-02-02/a> | Xavier Mertens | New Example of XSL Script Processing aka "Mitre T1220" |
| 2021-01-26/a> | Brad Duncan | TA551 (Shathak) Word docs push Qakbot (Qbot) |
| 2021-01-20/a> | Brad Duncan | Qakbot activity resumes after holiday break |
| 2021-01-14/a> | Bojan Zdrnja | Dynamically analyzing a heavily obfuscated Excel 4 macro malicious file |
| 2021-01-13/a> | Brad Duncan | Hancitor activity resumes after a hoilday break |
| 2020-12-22/a> | Xavier Mertens | Malware Victim Selection Through WiFi Identification |
| 2020-12-09/a> | Brad Duncan | Recent Qakbot (Qbot) activity |
| 2020-11-20/a> | Xavier Mertens | Malicious Python Code and LittleSnitch Detection |
| 2020-11-09/a> | Xavier Mertens | How Attackers Brush Up Their Malicious Scripts |
| 2020-10-26/a> | Didier Stevens | Excel 4 Macros: "Abnormal Sheet Visibility" |
| 2020-10-14/a> | Brad Duncan | More TA551 (Shathak) Word docs push IcedID (Bokbot) |
| 2020-09-23/a> | Xavier Mertens | Malicious Word Document with Dynamic Content |
| 2020-09-18/a> | Xavier Mertens | A Mix of Python & VBA in a Malicious Word Document |
| 2020-09-10/a> | Brad Duncan | Recent Dridex activity |
| 2020-09-09/a> | Johannes Ullrich | A First Look at macOS 11 Big Sur Network Traffic (New! Now with more GREASE!) |
| 2020-08-26/a> | Xavier Mertens | Malicious Excel Sheet with a NULL VT Score |
| 2020-08-19/a> | Xavier Mertens | Example of Word Document Delivering Qakbot |
| 2020-08-07/a> | Brad Duncan | TA551 (Shathak) Word docs push IcedID (Bokbot) |
| 2020-08-06/a> | Xavier Mertens | A Fork of the FTCode Powershell Ransomware |
| 2020-08-03/a> | Xavier Mertens | Powershell Bot with Multiple C2 Protocols |
| 2020-07-15/a> | Brad Duncan | Word docs with macros for IcedID (Bokbot) |
| 2020-07-11/a> | Guy Bruneau | VMware XPC Client validation privilege escalation vulnerability - https://www.vmware.com/security/advisories/VMSA-2020-0017.html |
| 2020-07-10/a> | Brad Duncan | Excel spreasheet macro kicks off Formbook infection |
| 2020-07-04/a> | Russ McRee | Happy FouRth of July from the Internet Storm Center |
| 2020-06-12/a> | Xavier Mertens | Malicious Excel Delivering Fileless Payload |
| 2020-06-10/a> | Brad Duncan | Job application-themed malspam pushes ZLoader |
| 2020-06-01/a> | Didier Stevens | XLMMacroDeobfuscator: An Update |
| 2020-05-20/a> | Brad Duncan | Microsoft Word document with malicious macro pushes IcedID (Bokbot) |
| 2020-04-05/a> | Guy Bruneau | Maldoc XLS Invoice with Excel 4 Macros |
| 2020-03-29/a> | Didier Stevens | Obfuscated Excel 4 Macros |
| 2020-03-18/a> | Brad Duncan | Trickbot gtag red5 distributed as a DLL file |
| 2020-03-09/a> | Didier Stevens | Malicious Spreadsheet With Data Connection and Excel 4 Macros |
| 2020-03-06/a> | Xavier Mertens | A Safe Excel Sheet Not So Safe |
| 2020-02-24/a> | Didier Stevens | Maldoc: Excel 4 Macros and VBA, Devil and Angel? |
| 2020-02-23/a> | Didier Stevens | Maldoc: Excel 4 Macros in OOXML Format |
| 2020-02-21/a> | Xavier Mertens | Quick Analysis of an Encrypted Compound Document Format |
| 2020-01-22/a> | Brad Duncan | German language malspam pushes Ursnif |
| 2020-01-09/a> | Xavier Mertens | Quick Analyzis of a(nother) Maldoc |
| 2019-12-11/a> | Brad Duncan | German language malspam pushes yet another wave of Trickbot |
| 2019-12-04/a> | Jan Kopriva | Analysis of a strangely poetic malware |
| 2019-10-02/a> | Brad Duncan | A recent example of Emotet malspam |
| 2019-09-26/a> | Rob VandenBrink | Mining MAC Address and OUI Information |
| 2019-09-18/a> | Brad Duncan | Emotet malspam is back |
| 2019-07-08/a> | Didier Stevens | Machine Code? No! |
| 2019-07-04/a> | Didier Stevens | Machine Code? |
| 2019-06-18/a> | Brad Duncan | Malspam with password-protected Word docs pushing Dridex |
| 2019-03-17/a> | Didier Stevens | Video: Maldoc Analysis: Excel 4.0 Macro |
| 2019-03-16/a> | Didier Stevens | Maldoc: Excel 4.0 Macros |
| 2019-03-13/a> | Brad Duncan | Malspam pushes Emotet with Qakbot as the follow-up malware |
| 2019-01-24/a> | Brad Duncan | Malspam with Word docs uses macro to run Powershell script and steal system data |
| 2018-12-18/a> | Brad Duncan | Malspam links to password-protected Word docs that push IcedID (Bokbot) |
| 2018-11-27/a> | Xavier Mertens | More obfuscated shell scripts: Fake MacOS Flash update |
| 2018-11-15/a> | Brad Duncan | Emotet infection with IcedID banking Trojan |
| 2018-11-04/a> | Pasquale Stirparo | Beyond good ol' LaunchAgent - part 1 |
| 2018-10-21/a> | Pasquale Stirparo | Beyond good ol’ LaunchAgent - part 0 |
| 2018-08-24/a> | Xavier Mertens | Microsoft Publisher Files Delivering Malware |
| 2018-06-29/a> | Remco Verhoef | Crypto community target of MacOS malware |
| 2018-05-25/a> | Xavier Mertens | Antivirus Evasion? Easy as 1,2,3 |
| 2018-05-23/a> | Remco Verhoef | Track naughty and nice binaries with Google Santa |
| 2018-05-01/a> | Xavier Mertens | Diving into a Simple Maldoc Generator |
| 2017-12-19/a> | Xavier Mertens | Example of 'MouseOver' Link in a Powerpoint File |
| 2017-12-16/a> | Xavier Mertens | Microsoft Office VBA Macro Obfuscation via Metadata |
| 2017-11-15/a> | Xavier Mertens | If you want something done right, do it yourself! |
| 2017-09-19/a> | Jim Clausing | New tool: mac-robber.py |
| 2017-02-26/a> | Guy Bruneau | It is Tax Season - Watch out for Suspicious Attachment |
| 2016-09-30/a> | Xavier Mertens | Another Day, Another Malicious Behaviour |
| 2015-02-19/a> | Daniel Wesemann | Macros? Really?! |
| 2014-01-24/a> | Chris Mohan | Security Update for OS X for CVE-2014-1252 http://support.apple.com/kb/HT6117 |
| 2013-12-17/a> | Adrien de Beaupre | Apple security updates Mac OS X and Safari |
| 2013-10-22/a> | Richard Porter | Greenbone and OpenVAS Scanner |
| 2013-10-02/a> | John Bambenek | Obamacare related domain registration spike, Government shutdown domain registration beginning |
| 2013-09-10/a> | Swa Frantzen | Macs need to patch too! |
| 2013-08-09/a> | Kevin Shortt | Copy Machines - Changing Scanned Content |
| 2013-03-02/a> | Scott Fendley | Apple Blocks Older Insecure Versions of Flash Player |
| 2012-07-05/a> | Adrien de Beaupre | New OS X trojan backdoor MaControl variant reported |
| 2012-05-05/a> | Tony Carothers | Vulnerability Exploit for Snow Leopard |
| 2012-04-12/a> | Guy Bruneau | Apple Java Updates for Mac OS X |
| 2012-02-24/a> | Guy Bruneau | Flashback Trojan in the Wild |
| 2012-02-04/a> | Scott Fendley | Apple Security Advisory 2012-001 v1.1 |
| 2011-08-05/a> | donald smith | New Mac Trojan: BASH/QHost.WB |
| 2011-06-23/a> | Jim Clausing | Apple Security Updates 2011-004 |
| 2011-06-15/a> | Pedro Bueno | Hit by MacDefender, Apple Web Security (name your Mac FakeAV here)... |
| 2011-05-26/a> | Swa Frantzen | MacDefender ups the ante with removing the password need for installation |
| 2011-05-06/a> | Richard Porter | Unpatched Exploit: Skype for MAC |
| 2010-11-16/a> | Guy Bruneau | Mac OS X Server v10.6.5 (10H575) Security Update: http://support.apple.com/kb/HT4452 |
| 2010-06-17/a> | Deborah Hale | Digital Copy Machines - Security Risk? |
| 2010-06-15/a> | Manuel Humberto Santander Pelaez | Apple releases advisory for Mac OS X - Multiple vulnerabilities discovered |
| 2010-03-29/a> | Adrien de Beaupre | APPLE-SA-2010-03-29-1 Security Update 2010-002 / Mac OS X v10.6.3 |
| 2010-02-05/a> | Jim Clausing | Memory Analysis - time to move beyond XP |
| 2010-01-12/a> | Adrien de Beaupre | PoC for CVE-2009-0689 MacOS X 10.5/10.6 vulnerability |
| 2009-12-07/a> | Rob VandenBrink | Layer 2 Network Protections – reloaded! |
| 2009-11-09/a> | Guy Bruneau | Apple Security Update 2009-006 for Mac OS X v10.6.2 |
| 2009-01-24/a> | Pedro Bueno | Identifying and Removing the iWork09 Trojan |
| 2008-07-17/a> | Mari Nichols | Firefox Releases 3.0.1 and fixes 3 security vulnerabilities |
| 2008-04-30/a> | Bojan Zdrnja | (Minor) evolution in Mac DNS changer malware |
| 2008-04-02/a> | Adrien de Beaupre | When is a DMG file not a DMG file |
| 2006-12-12/a> | Swa Frantzen | Microsoft Office 2004 - Mac OS X updated |
| 2006-11-29/a> | Toby Kohlenberg | New Vulnerability Announcement and patches from Apple |
OSX |
| 2017-11-28/a> | Xavier Mertens | Apple High Sierra Uses a Passwordless Root Account |
| 2016-03-07/a> | Xavier Mertens | OSX Ransomware Spread via a Rogue BitTorrent Client Installer |
| 2014-07-11/a> | Rob VandenBrink | Apple pushes OS X update to block out of date Flash versions - http://support.apple.com/kb/HT5655 |
| 2014-02-25/a> | Alex Stanford | Apple releases OS X 10.9.2 patching SSL vulnerability and updates Safari |
| 2013-09-13/a> | Rob VandenBrink | OS X v10.8.5 update - details here: http://support.apple.com/kb/HT5880 |
| 2012-05-05/a> | Tony Carothers | Vulnerability Exploit for Snow Leopard |
| 2010-06-02/a> | Rob VandenBrink | New Mac malware - OSX/Onionspy |
| 2010-02-05/a> | Jim Clausing | Memory Analysis - time to move beyond XP |
| 2010-01-12/a> | Adrien de Beaupre | PoC for CVE-2009-0689 MacOS X 10.5/10.6 vulnerability |
| 2009-09-12/a> | Jim Clausing | Apple Updates |
| 2009-01-24/a> | Pedro Bueno | Identifying and Removing the iWork09 Trojan |
| 2008-11-25/a> | Andre Ludwig | OS X Dns Changers part three |
| 2007-01-03/a> | Toby Kohlenberg | VLC Media Player udp URL handler Format String Vulnerability |
| 2006-11-29/a> | Toby Kohlenberg | New Vulnerability Announcement and patches from Apple |
| 2006-09-21/a> | Johannes Ullrich | Apple updates Airport Drivers |
TROJAN |
| 2023-06-24/a> | Guy Bruneau | Email Spam with Attachment Modiloader |
| 2022-11-05/a> | Guy Bruneau | Windows Malware with VHD Extension |
| 2022-10-15/a> | Guy Bruneau | Malware - Covid Vaccination Supplier Declaration |
| 2021-07-24/a> | Xavier Mertens | Agent.Tesla Dropped via a .daa Image and Talking to Telegram |
| 2021-01-04/a> | Jan Kopriva | From a small BAT file to Mass Logger infostealer |
| 2020-11-19/a> | Xavier Mertens | PowerShell Dropper Delivering Formbook |
| 2020-09-04/a> | Jan Kopriva | A blast from the past - XXEncoded VB6.0 Trojan |
| 2020-08-14/a> | Jan Kopriva | Definition of 'overkill' - using 130 MB executable to hide 24 kB malware |
| 2020-07-11/a> | Guy Bruneau | Scanning Home Internet Facing Devices to Exploit |
| 2020-03-11/a> | Xavier Mertens | Agent Tesla Delivered via Fake Canon EOS Notification on Free OwnCloud Account |
| 2019-09-19/a> | Xavier Mertens | Agent Tesla Trojan Abusing Corporate Email Accounts |
| 2019-07-18/a> | Xavier Mertens | Malicious PHP Script Back on Stage? |
| 2019-06-25/a> | Brad Duncan | Rig Exploit Kit sends Pitou.B Trojan |
| 2018-11-15/a> | Brad Duncan | Emotet infection with IcedID banking Trojan |
| 2018-10-10/a> | Xavier Mertens | New Campaign Using Old Equation Editor Vulnerability |
| 2018-09-13/a> | Xavier Mertens | Malware Delivered Through MHT Files |
| 2017-08-15/a> | Brad Duncan | Malspam pushing Trickbot banking Trojan |
| 2013-12-07/a> | Guy Bruneau | Suspected Active Rovnix Botnet Controller |
| 2013-10-26/a> | Guy Bruneau | Active Perl/Shellbot Trojan |
| 2013-10-25/a> | Rob VandenBrink | Kaspersky flags TCPIP.SYS as Malware |
| 2013-05-04/a> | Kevin Shortt | The Zero-Day Pendulum Swings |
| 2012-07-05/a> | Adrien de Beaupre | New OS X trojan backdoor MaControl variant reported |
| 2012-04-14/a> | Rick Wanner | Flashback Trojan Removal Tool Released |
| 2011-08-05/a> | donald smith | New Mac Trojan: BASH/QHost.WB |
| 2011-05-21/a> | Daniel Wesemann | Weekend reading |
| 2010-12-31/a> | Bojan Zdrnja | Android malware enters 2011 |
| 2010-08-22/a> | Rick Wanner | Failure of controls...Spanair crash caused by a Trojan |
| 2010-07-03/a> | Deborah Hale | Delivery Status Failure Notice That Packed A Wallop |
| 2010-06-13/a> | Rick Wanner | UnRealCD compromised by Trojan |
| 2010-05-23/a> | Manuel Humberto Santander Pelaez | e-mail scam announcing Fidel Castro's funeral ... and nasty malware to your computer. |
| 2010-03-17/a> | Deborah Hale | Trojan outbreak on a College Campus |
| 2009-11-03/a> | Bojan Zdrnja | Opachki, from (and to) Russia with love |
| 2009-10-05/a> | Adrien de Beaupre | Cyber Security Awareness Month - Day 5 port 31337 |
| 2009-07-01/a> | Bojan Zdrnja | Mobile phone trojans |
| 2009-03-16/a> | Johannes Ullrich | new rogue-DHCP server malware |
| 2009-02-06/a> | Adrien de Beaupre | Fake stimulus payments |
| 2009-01-24/a> | Pedro Bueno | Identifying and Removing the iWork09 Trojan |
| 2009-01-07/a> | Bojan Zdrnja | An Israeli patriot program or a trojan |
| 2008-11-16/a> | Maarten Van Horenbeeck | Detection of Trojan control channels |
| 2008-09-16/a> | donald smith | Don't open that invoice.zip file its not from UPS |
| 2008-06-25/a> | Deborah Hale | Report of Coreflood.dr Infection |
MALWARE |
| 2025-05-07/a> | Xavier Mertens | Example of "Modular" Malware |
| 2025-05-06/a> | Xavier Mertens | Python InfoStealer with Embedded Phishing Webserver |
| 2025-04-25/a> | Xavier Mertens | Example of a Payload Delivered Through Steganography |
| 2025-04-09/a> | Xavier Mertens | Obfuscated Malicious Python Scripts with PyArmor |
| 2025-03-26/a> | Jesse La Grew | [Guest Diary] Leveraging CNNs and Entropy-Based Feature Selection to Identify Potential Malware Artifacts of Interest |
| 2025-03-18/a> | Xavier Mertens | Python Bot Delivered Through DLL Side-Loading |
| 2025-03-12/a> | Guy Bruneau | File Hashes Analysis with Power BI from Data Stored in DShield SIEM |
| 2025-03-10/a> | Xavier Mertens | Shellcode Encoded in UUIDs |
| 2025-02-27/a> | Xavier Mertens | Njrat Campaign Using Microsoft Dev Tunnels |
| 2025-02-26/a> | Jesse La Grew | [Guest Diary] Malware Source Servers: The Threat of Attackers Using Ephemeral Ports as Service Ports to Upload Data |
| 2025-02-19/a> | Xavier Mertens | XWorm Cocktail: A Mix of PE data with PowerShell Code |
| 2025-02-14/a> | Xavier Mertens | Fake BSOD Delivered by Malicious Python Script |
| 2025-02-06/a> | Xavier Mertens | The Unbreakable Multi-Layer Anti-Debugging System |
| 2025-01-29/a> | Xavier Mertens | From PowerShell to a Python Obfuscation Race! |
| 2025-01-28/a> | Xavier Mertens | Fileless Python InfoStealer Targeting Exodus |
| 2025-01-09/a> | Guy Bruneau | Examining Redtail Analyzing a Sophisticated Cryptomining Malware and its Advanced Tactics [Guest Diary] |
| 2025-01-06/a> | Xavier Mertens | Make Malware Happy |
| 2025-01-03/a> | Xavier Mertens | SwaetRAT Delivery Through Python |
| 2025-01-02/a> | Xavier Mertens | Goodware Hash Sets |
| 2024-12-24/a> | Xavier Mertens | More SSH Fun! |
| 2024-12-23/a> | Xavier Mertens | Modiloader From Obfuscated Batch File |
| 2024-12-20/a> | Xavier Mertens | Christmas "Gift" Delivered Through SSH |
| 2024-12-17/a> | Xavier Mertens | Python Delivering AnyDesk Client as RAT |
| 2024-12-17/a> | Guy Bruneau | Command Injection Exploit For PHPUnit before 4.8.28 and 5.x before 5.6.3 [Guest Diary] |
| 2024-11-30/a> | Xavier Mertens | From a Regular Infostealer to its Obfuscated Version |
| 2024-11-22/a> | Xavier Mertens | An Infostealer Searching for « BIP-0039 » Data |
| 2024-11-19/a> | Xavier Mertens | Detecting the Presence of a Debugger in Linux |
| 2024-11-07/a> | Xavier Mertens | Steam Account Checker Poisoned with Infostealer |
| 2024-11-05/a> | Xavier Mertens | Python RAT with a Nice Screensharing Feature |
| 2024-10-09/a> | Xavier Mertens | From Perfctl to InfoStealer |
| 2024-09-18/a> | Xavier Mertens | Python Infostealer Patching Windows Exodus App |
| 2024-09-17/a> | Xavier Mertens | 23:59, Time to Exfiltrate! |
| 2024-09-16/a> | Xavier Mertens | Managing PE Files With Overlays |
| 2024-09-11/a> | Guy Bruneau | Hygiene, Hygiene, Hygiene! [Guest Diary] |
| 2024-08-27/a> | Xavier Mertens | Why Is Python so Popular to Infect Windows Hosts? |
| 2024-08-26/a> | Xavier Mertens | From Highly Obfuscated Batch File to XWorm and Redline |
| 2024-08-19/a> | Xavier Mertens | Do you Like Donuts? Here is a Donut Shellcode Delivered Through PowerShell/Python |
| 2024-08-14/a> | Xavier Mertens | Multiple Malware Dropped Through MSI Package |
| 2024-07-26/a> | Xavier Mertens | ExelaStealer Delivered "From Russia With Love" |
| 2024-07-25/a> | Xavier Mertens | XWorm Hidden With Process Hollowing |
| 2024-07-24/a> | Xavier Mertens | "Mouse Logger" Malicious Python Script |
| 2024-06-06/a> | Xavier Mertens | Malicious Python Script with a "Best Before" Date |
| 2024-05-28/a> | Guy Bruneau | Is that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary] |
| 2024-05-22/a> | Guy Bruneau | Analysis of ?redtail? File Uploads to ICS Honeypot, a Multi-Architecture Coin Miner [Guest Diary] |
| 2024-04-29/a> | Guy Bruneau | Linux Trojan - Xorddos with Filename eyshcjdmzg |
| 2024-04-25/a> | Jesse La Grew | Does it matter if iptables isn't running on my honeypot? |
| 2024-03-28/a> | Xavier Mertens | From JavaScript to AsyncRAT |
| 2024-03-13/a> | Xavier Mertens | Using ChatGPT to Deobfuscate Malicious Scripts |
| 2024-02-29/a> | Jesse La Grew | [Guest Diary] Dissecting DarkGate: Modular Malware Delivery and Persistence as a Service. |
| 2024-02-08/a> | Xavier Mertens | A Python MP3 Player with Builtin Keylogger Capability |
| 2024-02-06/a> | Jan Kopriva | Computer viruses are celebrating their 40th birthday (well, 54th, really) |
| 2024-01-26/a> | Xavier Mertens | A Batch File With Multiple Payloads |
| 2024-01-25/a> | Xavier Mertens | Facebook AdsManager Targeted by a Python Infostealer |
| 2024-01-24/a> | Johannes Ullrich | How Bad User Interfaces Make Security Tools Harmful |
| 2024-01-19/a> | Xavier Mertens | macOS Python Script Replacing Wallet Applications with Rogue Apps |
| 2024-01-07/a> | Guy Bruneau | Suspicious Prometei Botnet Activity |
| 2024-01-03/a> | Jan Kopriva | Interesting large and small malspam attachments from 2023 |
| 2023-12-22/a> | Xavier Mertens | Shall We Play a Game? |
| 2023-11-18/a> | Xavier Mertens | Quasar RAT Delivered Through Updated SharpLoader |
| 2023-11-15/a> | Xavier Mertens | Redline Dropped Through MSIX Package |
| 2023-11-09/a> | Xavier Mertens | Visual Examples of Code Injection |
| 2023-11-01/a> | Xavier Mertens | Malware Dropped Through a ZPAQ Archive |
| 2023-10-31/a> | Xavier Mertens | Multiple Layers of Anti-Sandboxing Techniques |
| 2023-10-28/a> | Xavier Mertens | Size Matters for Many Security Controls |
| 2023-10-18/a> | Jesse La Grew | Hiding in Hex |
| 2023-09-30/a> | Xavier Mertens | Simple Netcat Backdoor in Python Script |
| 2023-09-29/a> | Xavier Mertens | Are You Still Storing Passwords In Plain Text Files? |
| 2023-08-25/a> | Xavier Mertens | Python Malware Using Postgresql for C2 Communications |
| 2023-08-23/a> | Xavier Mertens | More Exotic Excel Files Dropping AgentTesla |
| 2023-08-22/a> | Xavier Mertens | Have You Ever Heard of the Fernet Encryption Algorithm? |
| 2023-08-21/a> | Xavier Mertens | Quick Malware Triage With Inotify Tools |
| 2023-08-20/a> | Guy Bruneau | SystemBC Malware Activity |
| 2023-08-18/a> | Xavier Mertens | From a Zalando Phishing to a RAT |
| 2023-08-11/a> | Xavier Mertens | Show me All Your Windows! |
| 2023-08-03/a> | Jan Kopriva | From small LNK to large malicious BAT file with zero VT score |
| 2023-07-29/a> | Xavier Mertens | Do Attackers Pay More Attention to IPv6? |
| 2023-07-28/a> | Xavier Mertens | ShellCode Hidden with Steganography |
| 2023-07-26/a> | Xavier Mertens | Suspicious IP Addresses Avoided by Malware Samples |
| 2023-06-27/a> | Xavier Mertens | The Importance of Malware Triage |
| 2023-06-23/a> | Xavier Mertens | Word Document with an Online Attached Template |
| 2023-06-21/a> | Yee Ching Tok | Analyzing a YouTube Sponsorship Phishing Mail and Malware Targeting Content Creators |
| 2023-06-20/a> | Xavier Mertens | Malicious Code Can Be Anywhere |
| 2023-06-19/a> | Xavier Mertens | Malware Delivered Through .inf File |
| 2023-06-16/a> | Xavier Mertens | Another RAT Delivered Through VBS |
| 2023-05-17/a> | Xavier Mertens | Increase in Malicious RAR SFX files |
| 2023-04-07/a> | Xavier Mertens | Detecting Suspicious API Usage with YARA Rules |
| 2023-04-04/a> | Johannes Ullrich | Analyzing the efile.com Malware "efail" |
| 2023-03-30/a> | Xavier Mertens | Bypassing PowerShell Strong Obfuscation |
| 2023-03-26/a> | Didier Stevens | Extra: "String Obfuscation: Character Pair Reversal" |
| 2023-03-01/a> | Xavier Mertens | Python Infostealer Targeting Gamers |
| 2023-02-09/a> | Xavier Mertens | A Backdoor with Smart Screenshot Capability |
| 2023-02-04/a> | Guy Bruneau | Assemblyline as a Malware Analysis Sandbox |
| 2023-01-25/a> | Xavier Mertens | A First Malicious OneNote Document |
| 2023-01-16/a> | Johannes Ullrich | PSA: Why you must run an ad blocker when using Google |
| 2023-01-06/a> | Xavier Mertens | AutoIT Remains Popular in the Malware Landscape |
| 2023-01-05/a> | Brad Duncan | More Brazil malspam pushing Astaroth (Guildma) in January 2023 |
| 2022-12-21/a> | Guy Bruneau | DShield Sensor Setup in Azure |
| 2022-12-18/a> | Guy Bruneau | Infostealer Malware with Double Extension |
| 2022-11-19/a> | Guy Bruneau | McAfee Fake Antivirus Phishing Campaign is Back! |
| 2022-11-09/a> | Xavier Mertens | Another Script-Based Ransomware |
| 2022-11-05/a> | Guy Bruneau | Windows Malware with VHD Extension |
| 2022-11-04/a> | Xavier Mertens | Remcos Downloader with Unicode Obfuscation |
| 2022-10-24/a> | Xavier Mertens | C2 Communications Through outlook.com |
| 2022-10-21/a> | Brad Duncan | sczriptzzbn inject pushes malware for NetSupport RAT |
| 2022-10-18/a> | Xavier Mertens | Python Obfuscation for Dummies |
| 2022-10-17/a> | Xavier Mertens | Fileless Powershell Dropper |
| 2022-10-15/a> | Guy Bruneau | Malware - Covid Vaccination Supplier Declaration |
| 2022-10-07/a> | Xavier Mertens | Powershell Backdoor with DGA Capability |
| 2022-09-25/a> | Didier Stevens | Downloading Samples From Takendown Domains |
| 2022-09-24/a> | Didier Stevens | Maldoc Analysis Info On MalwareBazaar |
| 2022-09-23/a> | Xavier Mertens | Kids Like Cookies, Malware Too! |
| 2022-09-22/a> | Xavier Mertens | RAT Delivered Through FODHelper |
| 2022-09-15/a> | Xavier Mertens | Malicious Word Document with a Frameset |
| 2022-09-14/a> | Xavier Mertens | Easy Process Injection within Python |
| 2022-09-10/a> | Guy Bruneau | Phishing Word Documents with Suspicious URL |
| 2022-09-03/a> | Didier Stevens | Video: James Webb JPEG With Malware |
| 2022-09-02/a> | Didier Stevens | James Webb JPEG With Malware |
| 2022-08-30/a> | Johannes Ullrich | Two things that will never die: bash scripts and IRC! |
| 2022-08-22/a> | Xavier Mertens | 32 or 64 bits Malware? |
| 2022-07-29/a> | Johannes Ullrich | PDF Analysis Intro and OpenActions Entries |
| 2022-07-25/a> | Xavier Mertens | PowerShell Script with Fileless Capability |
| 2022-07-20/a> | Xavier Mertens | Malicious Python Script Behaving Like a Rubber Ducky |
| 2022-06-25/a> | Xavier Mertens | Malicious Code Passed to PowerShell via the Clipboard |
| 2022-06-22/a> | Xavier Mertens | Malicious PowerShell Targeting Cryptocurrency Browser Extensions |
| 2022-06-16/a> | Xavier Mertens | Houdini is Back Delivered Through a JavaScript Dropper |
| 2022-06-04/a> | Guy Bruneau | Spam Email Contains a Very Large ISO file |
| 2022-06-03/a> | Xavier Mertens | Sandbox Evasion... With Just a Filename! |
| 2022-05-31/a> | Xavier Mertens | First Exploitation of Follina Seen in the Wild |
| 2022-05-20/a> | Xavier Mertens | A 'Zip Bomb' to Bypass Security Controls & Sandboxes |
| 2022-05-19/a> | Brad Duncan | Bumblebee Malware from TransferXL URLs |
| 2022-05-11/a> | Brad Duncan | TA578 using thread-hijacked emails to push ISO files for Bumblebee malware |
| 2022-05-07/a> | Guy Bruneau | Phishing PDF Received in my ISC Mailbox |
| 2022-05-06/a> | Jan Kopriva | What is the simplest malware in the world? |
| 2022-05-05/a> | Brad Duncan | Password-protected Excel spreadsheet pushes Remcos RAT |
| 2022-04-21/a> | Xavier Mertens | Multi-Cryptocurrency Clipboard Swapper |
| 2022-04-06/a> | Brad Duncan | Windows MetaStealer Malware |
| 2022-03-25/a> | Xavier Mertens | XLSB Files: Because Binary is Stealthier Than XML |
| 2022-03-24/a> | Xavier Mertens | Malware Delivered Through Free Sharing Tool |
| 2022-03-23/a> | Brad Duncan | Arkei Variants: From Vidar to Mars Stealer |
| 2022-03-11/a> | Xavier Mertens | Keep an Eye on WebSockets |
| 2022-03-09/a> | Xavier Mertens | Infostealer in a Batch File |
| 2022-02-22/a> | Xavier Mertens | A Good Old Equation Editor Vulnerability Delivering Malware |
| 2022-02-18/a> | Xavier Mertens | Remcos RAT Delivered Through Double Compressed Archive |
| 2022-02-11/a> | Xavier Mertens | CinaRAT Delivered Through HTML ID Attributes |
| 2022-01-20/a> | Xavier Mertens | RedLine Stealer Delivered Through FTP |
| 2022-01-07/a> | Xavier Mertens | Custom Python RAT Builder |
| 2022-01-06/a> | Xavier Mertens | Malicious Python Script Targeting Chinese People |
| 2022-01-05/a> | Xavier Mertens | Code Reuse In the Malware Landscape |
| 2021-12-21/a> | Xavier Mertens | More Undetected PowerShell Dropper |
| 2021-12-15/a> | Xavier Mertens | Simple but Undetected PowerShell Backdoor |
| 2021-12-03/a> | Xavier Mertens | The UPX Packer Will Never Die! |
| 2021-12-02/a> | Brad Duncan | TA551 (Shathak) pushes IcedID (Bokbot) |
| 2021-11-19/a> | Xavier Mertens | Downloader Disguised as Excel Add-In (XLL) |
| 2021-11-18/a> | Xavier Mertens | JavaScript Downloader Delivers Agent Tesla Trojan |
| 2021-10-21/a> | Brad Duncan | "Stolen Images Evidence" campaign pushes Sliver-based malware |
| 2021-10-01/a> | Xavier Mertens | New Tool to Add to Your LOLBAS List: cvtres.exe |
| 2021-09-23/a> | Xavier Mertens | Excel Recipe: Some VBA Code with a Touch of Excel4 Macro |
| 2021-09-01/a> | Brad Duncan | STRRAT: a Java-based RAT that doesn't care if you have Java |
| 2021-08-30/a> | Xavier Mertens | Cryptocurrency Clipboard Swapper Delivered With Love |
| 2021-08-20/a> | Xavier Mertens | Waiting for the C2 to Show Up |
| 2021-08-15/a> | Didier Stevens | Simple Tips For Triage Of MALWARE Bazaar's Daily Malware Batches |
| 2021-08-07/a> | Didier Stevens | MALWARE Bazaar "Download daily malware batches" |
| 2021-08-06/a> | Xavier Mertens | Malicious Microsoft Word Remains A Key Infection Vector |
| 2021-07-30/a> | Xavier Mertens | Infected With a .reg File |
| 2021-07-29/a> | Xavier Mertens | Malicious Content Delivered Through archive.org |
| 2021-07-24/a> | Xavier Mertens | Agent.Tesla Dropped via a .daa Image and Talking to Telegram |
| 2021-07-16/a> | Xavier Mertens | Multiple BaseXX Obfuscations |
| 2021-07-06/a> | Xavier Mertens | Python DLL Injection Check |
| 2021-06-30/a> | Brad Duncan | June 2021 Forensic Contest: Answers and Analysis |
| 2021-06-11/a> | Xavier Mertens | Keeping an Eye on Dangerous Python Modules |
| 2021-06-09/a> | Jan Kopriva | Architecture, compilers and black magic, or "what else affects the ability of AVs to detect malicious files" |
| 2021-06-04/a> | Xavier Mertens | Russian Dolls VBS Obfuscation |
| 2021-05-28/a> | Xavier Mertens | Malicious PowerShell Hosted on script.google.com |
| 2021-05-27/a> | Jan Kopriva | All your Base are...nearly equal when it comes to AV evasion, but 64-bit executables are not |
| 2021-05-21/a> | Xavier Mertens | Locking Kernel32.dll As Anti-Debugging Technique |
| 2021-05-19/a> | Brad Duncan | May 2021 Forensic Contest: Answers and Analysis |
| 2021-05-18/a> | Xavier Mertens | From RunDLL32 to JavaScript then PowerShell |
| 2021-05-06/a> | Xavier Mertens | Alternative Ways To Perform Basic Tasks |
| 2021-05-05/a> | Brad Duncan | May 2021 Forensic Contest |
| 2021-04-29/a> | Xavier Mertens | From Python to .Net |
| 2021-04-28/a> | Xavier Mertens | Deeper Analyzis of my Last Malicious PowerPoint Add-On |
| 2021-04-23/a> | Xavier Mertens | Malicious PowerPoint Add-On: "Small Is Beautiful" |
| 2021-04-09/a> | Xavier Mertens | No Python Interpreter? This Simple RAT Installs Its Own Copy |
| 2021-04-08/a> | Xavier Mertens | Simple Powershell Ransomware Creating a 7Z Archive of your Files |
| 2021-04-06/a> | Jan Kopriva | Malspam with Lokibot vs. Outlook and RFCs |
| 2021-04-02/a> | Xavier Mertens | C2 Activity: Sandboxes or Real Victims? |
| 2021-04-01/a> | Brad Duncan | April 2021 Forensic Quiz |
| 2021-03-31/a> | Xavier Mertens | Quick Analysis of a Modular InfoStealer |
| 2021-03-19/a> | Xavier Mertens | Pastebin.com Used As a Simple C2 Channel |
| 2021-03-18/a> | Xavier Mertens | Simple Python Keylogger |
| 2021-03-17/a> | Xavier Mertens | Defenders, Know Your Operating System Like Attackers Do! |
| 2021-03-16/a> | Jan Kopriva | 50 years of malware? Not really. 50 years of computer worms? That's a different story... |
| 2021-03-04/a> | Xavier Mertens | From VBS, PowerShell, C Sharp, Process Hollowing to RAT |
| 2021-02-19/a> | Xavier Mertens | Dynamic Data Exchange (DDE) is Back in the Wild? |
| 2021-02-14/a> | Didier Stevens | Video: tshark & Malware Analysis |
| 2021-02-12/a> | Xavier Mertens | AgentTesla Dropped Through Automatic Click in Microsoft Help File |
| 2021-02-11/a> | Jan Kopriva | Agent Tesla hidden in a historical anti-malware tool |
| 2021-02-03/a> | Brad Duncan | Excel spreadsheets push SystemBC malware |
| 2021-02-02/a> | Xavier Mertens | New Example of XSL Script Processing aka "Mitre T1220" |
| 2021-01-22/a> | Xavier Mertens | Another File Extension to Block in your MTA: .jnlp |
| 2021-01-21/a> | Xavier Mertens | Powershell Dropping a REvil Ransomware |
| 2021-01-04/a> | Jan Kopriva | From a small BAT file to Mass Logger infostealer |
| 2021-01-02/a> | Guy Bruneau | Protecting Home Office and Enterprise in 2021 |
| 2020-12-24/a> | Xavier Mertens | Malicious Word Document Delivering an Octopus Backdoor |
| 2020-12-22/a> | Xavier Mertens | Malware Victim Selection Through WiFi Identification |
| 2020-12-03/a> | Brad Duncan | Traffic Analysis Quiz: Mr Natural |
| 2020-11-25/a> | Xavier Mertens | Live Patching Windows API Calls Using PowerShell |
| 2020-11-23/a> | Didier Stevens | Quick Tip: Cobalt Strike Beacon Analysis |
| 2020-11-09/a> | Xavier Mertens | How Attackers Brush Up Their Malicious Scripts |
| 2020-10-25/a> | Didier Stevens | Video: Pascal Strings |
| 2020-10-21/a> | Daniel Wesemann | Shipping dangerous goods |
| 2020-09-24/a> | Xavier Mertens | Party in Ibiza with PowerShell |
| 2020-09-23/a> | Xavier Mertens | Malicious Word Document with Dynamic Content |
| 2020-09-18/a> | Xavier Mertens | A Mix of Python & VBA in a Malicious Word Document |
| 2020-09-15/a> | Brad Duncan | Traffic Analysis Quiz: Oh No... Another Infection! |
| 2020-09-04/a> | Jan Kopriva | A blast from the past - XXEncoded VB6.0 Trojan |
| 2020-09-03/a> | Xavier Mertens | Sandbox Evasion Using NTP |
| 2020-08-28/a> | Xavier Mertens | Example of Malicious DLL Injected in PowerShell |
| 2020-08-26/a> | Xavier Mertens | Malicious Excel Sheet with a NULL VT Score |
| 2020-08-24/a> | Xavier Mertens | Tracking A Malware Campaign Through VT |
| 2020-08-19/a> | Xavier Mertens | Example of Word Document Delivering Qakbot |
| 2020-08-18/a> | Xavier Mertens | Using API's to Track Attackers |
| 2020-08-14/a> | Jan Kopriva | Definition of 'overkill' - using 130 MB executable to hide 24 kB malware |
| 2020-08-06/a> | Xavier Mertens | A Fork of the FTCode Powershell Ransomware |
| 2020-08-05/a> | Brad Duncan | Traffic Analysis Quiz: What's the Malware From This Infection? |
| 2020-07-24/a> | Xavier Mertens | Compromized Desktop Applications by Web Technologies |
| 2020-07-15/a> | Brad Duncan | Word docs with macros for IcedID (Bokbot) |
| 2020-07-10/a> | Brad Duncan | Excel spreasheet macro kicks off Formbook infection |
| 2020-07-08/a> | Xavier Mertens | If You Want Something Done Right, You Have To Do It Yourself... Malware Too! |
| 2020-06-13/a> | Guy Bruneau | Mirai Botnet Activity |
| 2020-06-04/a> | Xavier Mertens | Anti-Debugging Technique based on Memory Protection |
| 2020-06-01/a> | Jim Clausing | Stackstrings, type 2 |
| 2020-05-23/a> | Xavier Mertens | AgentTesla Delivered via a Malicious PowerPoint Add-In |
| 2020-05-21/a> | Xavier Mertens | Malware Triage with FLOSS: API Calls Based Behavior |
| 2020-05-20/a> | Brad Duncan | Microsoft Word document with malicious macro pushes IcedID (Bokbot) |
| 2020-05-06/a> | Xavier Mertens | Keeping an Eye on Malicious Files Life Time |
| 2020-04-27/a> | Xavier Mertens | Powershell Payload Stored in a PSCredential Object |
| 2020-04-25/a> | Didier Stevens | MALWARE Bazaar |
| 2020-04-24/a> | Xavier Mertens | Malicious Excel With a Strong Obfuscation and Sandbox Evasion |
| 2020-04-20/a> | Didier Stevens | KPOT AutoIt Script: Analysis |
| 2020-04-17/a> | Xavier Mertens | Weaponized RTF Document Generator & Mailer in PowerShell |
| 2020-04-12/a> | Didier Stevens | Reader Analysis: "Dynamic analysis technique to get decrypted KPOT Malware." |
| 2020-04-10/a> | Xavier Mertens | PowerShell Sample Extracting Payload From SSL |
| 2020-04-03/a> | Xavier Mertens | Obfuscated with a Simple 0x0A |
| 2020-03-31/a> | Johannes Ullrich | Kwampirs Targeted Attacks Involving Healthcare Sector |
| 2020-03-27/a> | Xavier Mertens | Malicious JavaScript Dropping Payload in the Registry |
| 2020-03-26/a> | Xavier Mertens | Very Large Sample as Evasion Technique? |
| 2020-03-23/a> | Didier Stevens | KPOT Deployed via AutoIt Script |
| 2020-03-22/a> | Didier Stevens | More COVID-19 Themed Malware |
| 2020-03-21/a> | Guy Bruneau | Honeypot - Scanning and Targeting Devices & Services |
| 2020-03-19/a> | Xavier Mertens | COVID-19 Themed Multistage Malware |
| 2020-03-11/a> | Xavier Mertens | Agent Tesla Delivered via Fake Canon EOS Notification on Free OwnCloud Account |
| 2020-03-06/a> | Xavier Mertens | A Safe Excel Sheet Not So Safe |
| 2020-02-21/a> | Xavier Mertens | Quick Analysis of an Encrypted Compound Document Format |
| 2020-02-14/a> | Xavier Mertens | Keep an Eye on Command-Line Browsers |
| 2020-02-07/a> | Xavier Mertens | Sandbox Detection Tricks & Nice Obfuscation in a Single VBScript |
| 2020-02-03/a> | Jan Kopriva | Analysis of a triple-encrypted AZORult downloader |
| 2020-01-16/a> | Jan Kopriva | Picks of 2019 malware - the large, the small and the one full of null bytes |
| 2020-01-10/a> | Xavier Mertens | More Data Exfiltration |
| 2020-01-09/a> | Xavier Mertens | Quick Analyzis of a(nother) Maldoc |
| 2020-01-02/a> | Xavier Mertens | Ransomware in Node.js |
| 2019-12-24/a> | Brad Duncan | Malspam with links to Word docs pushes IcedID (Bokbot) |
| 2019-12-12/a> | Xavier Mertens | Code & Data Reuse in the Malware Ecosystem |
| 2019-11-23/a> | Guy Bruneau | Local Malware Analysis with Malice |
| 2019-10-18/a> | Xavier Mertens | Quick Malicious VBS Analysis |
| 2019-10-03/a> | Xavier Mertens | "Lost_Files" Ransomware |
| 2019-09-19/a> | Xavier Mertens | Agent Tesla Trojan Abusing Corporate Email Accounts |
| 2019-08-30/a> | Xavier Mertens | Malware Dropping a Local Node.js Instance |
| 2019-08-28/a> | Xavier Mertens | Malware Samples Compiling Their Next Stage on Premise |
| 2019-08-22/a> | Xavier Mertens | Simple Mimikatz & RDPWrapper Dropper |
| 2019-08-18/a> | Didier Stevens | Video: Analyzing DAA Files |
| 2019-08-16/a> | Didier Stevens | The DAA File Format |
| 2019-08-12/a> | Didier Stevens | Malicious .DAA Attachments |
| 2019-07-18/a> | Xavier Mertens | Malicious PHP Script Back on Stage? |
| 2019-07-11/a> | Xavier Mertens | Russian Dolls Malicious Script Delivering Ursnif |
| 2019-07-02/a> | Xavier Mertens | Malicious Script With Multiple Payloads |
| 2019-06-14/a> | Jim Clausing | A few Ghidra tips for IDA users, part 4 - function call graphs |
| 2019-06-10/a> | Xavier Mertens | Interesting JavaScript Obfuscation Example |
| 2019-05-29/a> | Xavier Mertens | Behavioural Malware Analysis with Microsoft ASA |
| 2019-05-13/a> | Xavier Mertens | From Phishing To Ransomware? |
| 2019-05-03/a> | Jim Clausing | A few Ghidra tips for IDA users, part 3 - conversion, labels, and comments |
| 2019-05-01/a> | Xavier Mertens | Another Day, Another Suspicious UDF File |
| 2019-04-19/a> | Didier Stevens | Analyzing UDF Files with Python |
| 2019-04-17/a> | Jim Clausing | A few Ghidra tips for IDA users, part 2 - strings and parameters |
| 2019-04-17/a> | Xavier Mertens | Malware Sample Delivered Through UDF Image |
| 2019-04-08/a> | Jim Clausing | A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code |
| 2019-04-03/a> | Jim Clausing | A few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters |
| 2019-03-30/a> | Didier Stevens | "404" is not Malware |
| 2019-03-10/a> | Didier Stevens | Malicious HTA Analysis by a Reader |
| 2019-03-10/a> | Didier Stevens | Quick and Dirty Malicious HTA Analysis |
| 2019-02-14/a> | Xavier Mertens | Old H-Worm Delivered Through GitHub |
| 2019-01-16/a> | Brad Duncan | Emotet infections and follow-up malware |
| 2019-01-06/a> | Didier Stevens | Malicious .tar Attachments |
| 2019-01-05/a> | Didier Stevens | A Malicious JPEG? Second Example |
| 2019-01-04/a> | Didier Stevens | A Malicious JPEG? |
| 2019-01-02/a> | Xavier Mertens | Malicious Script Leaking Data via FTP |
| 2018-12-09/a> | Didier Stevens | Quickie: String Analysis is Still Useful |
| 2018-12-08/a> | Didier Stevens | Reader Malware Submission: MHT File Inside a ZIP File |
| 2018-11-27/a> | Xavier Mertens | More obfuscated shell scripts: Fake MacOS Flash update |
| 2018-11-26/a> | Xavier Mertens | Obfuscated bash script targeting QNap boxes |
| 2018-11-22/a> | Xavier Mertens | Divided Payload in Multiple Pasties |
| 2018-11-06/a> | Xavier Mertens | Malicious Powershell Script Dissection |
| 2018-10-23/a> | Xavier Mertens | Diving into Malicious AutoIT Code |
| 2018-10-22/a> | Xavier Mertens | Malicious Powershell using a Decoy Picture |
| 2018-10-21/a> | Pasquale Stirparo | Beyond good ol’ LaunchAgent - part 0 |
| 2018-10-12/a> | Xavier Mertens | More Equation Editor Exploit Waves |
| 2018-09-28/a> | Xavier Mertens | More Excel DDE Code Injection |
| 2018-09-22/a> | Didier Stevens | Suspicious DNS Requests ... Issued by a Firewall |
| 2018-09-16/a> | Didier Stevens | 20/20 malware vision |
| 2018-09-13/a> | Xavier Mertens | Malware Delivered Through MHT Files |
| 2018-09-05/a> | Xavier Mertens | Malicious PowerShell Compiling C# Code on the Fly |
| 2018-08-31/a> | Jim Clausing | Quickie: Using radare2 to disassemble shellcode |
| 2018-08-30/a> | Xavier Mertens | Crypto Mining Is More Popular Than Ever! |
| 2018-08-26/a> | Didier Stevens | Identifying numeric obfuscation |
| 2018-08-26/a> | Didier Stevens | "When was this machine infected?" |
| 2018-08-24/a> | Xavier Mertens | Microsoft Publisher Files Delivering Malware |
| 2018-08-21/a> | Xavier Mertens | Malicious DLL Loaded Through AutoIT |
| 2018-08-06/a> | Didier Stevens | Numeric obfuscation: another example |
| 2018-08-04/a> | Didier Stevens | Dealing with numeric obfuscation in malicious scripts |
| 2018-08-02/a> | Brad Duncan | DHL-themed malspam reveals embedded malware in animated gif |
| 2018-07-26/a> | Xavier Mertens | Windows Batch File Deobfuscation |
| 2018-07-09/a> | Renato Marinho | Criminals Don't Read Instructions or Use Strong Passwords |
| 2018-06-07/a> | Remco Verhoef | Automated twitter loot collection |
| 2018-06-05/a> | Xavier Mertens | Malicious Post-Exploitation Batch File |
| 2018-06-01/a> | Remco Verhoef | Binary analysis with Radare2 |
| 2018-05-22/a> | Xavier Mertens | Malware Distributed via .slk Files |
| 2018-05-19/a> | Xavier Mertens | Malicious Powershell Targeting UK Bank Customers |
| 2018-05-09/a> | Xavier Mertens | Nice Phishing Sample Delivering Trickbot |
| 2018-05-07/a> | Xavier Mertens | Adding Persistence Via Scheduled Tasks |
| 2018-05-01/a> | Xavier Mertens | Diving into a Simple Maldoc Generator |
| 2018-03-05/a> | Xavier Mertens | Malicious Bash Script with Multiple Features |
| 2018-03-04/a> | Xavier Mertens | The Crypto Miners Fight For CPU Cycles |
| 2018-02-25/a> | Didier Stevens | Retrieving malware over Tor on Windows |
| 2018-02-02/a> | Xavier Mertens | Simple but Effective Malicious XLS Sheet |
| 2018-01-28/a> | Didier Stevens | Is this a pentest? |
| 2018-01-26/a> | Xavier Mertens | Investigating Microsoft BITS Activity |
| 2018-01-25/a> | Xavier Mertens | Ransomware as a Service |
| 2018-01-11/a> | Xavier Mertens | Mining or Nothing! |
| 2017-12-19/a> | Xavier Mertens | Example of 'MouseOver' Link in a Powerpoint File |
| 2017-12-16/a> | Xavier Mertens | Microsoft Office VBA Macro Obfuscation via Metadata |
| 2017-11-29/a> | Xavier Mertens | Fileless Malicious PowerShell Sample |
| 2017-11-16/a> | Xavier Mertens | Suspicious Domains Tracking Dashboard |
| 2017-11-15/a> | Xavier Mertens | If you want something done right, do it yourself! |
| 2017-11-13/a> | Guy Bruneau | VBE Embeded Script (info.zip) |
| 2017-11-07/a> | Xavier Mertens | Interesting VBA Dropper |
| 2017-11-03/a> | Xavier Mertens | Simple Analysis of an Obfuscated JAR File |
| 2017-10-31/a> | Xavier Mertens | Some Powershell Malicious Code |
| 2017-10-29/a> | Didier Stevens | Remember ACE files? |
| 2017-10-24/a> | Xavier Mertens | BadRabbit: New ransomware wave hitting RU & UA |
| 2017-10-15/a> | Didier Stevens | Peeking into .msg files |
| 2017-09-09/a> | Didier Stevens | Malware analysis output sanitization |
| 2017-09-02/a> | Xavier Mertens | AutoIT based malware back in the wild |
| 2017-08-26/a> | Didier Stevens | Malware analysis: searching for dots |
| 2017-08-25/a> | Xavier Mertens | Malicious AutoIT script delivered in a self-extracting RAR file |
| 2017-08-23/a> | Xavier Mertens | Malicious script dropping an executable signed by Avast? |
| 2017-08-18/a> | Renato Marinho | EngineBox Malware Supports 10+ Brazilian Banks |
| 2017-07-21/a> | Didier Stevens | Malicious .iso Attachments |
| 2017-07-09/a> | Russ McRee | Adversary hunting with SOF-ELK |
| 2017-07-05/a> | Didier Stevens | Selecting domains with random names |
| 2017-06-22/a> | Xavier Mertens | Obfuscating without XOR |
| 2017-06-06/a> | Didier Stevens | Malware and XOR - Part 2 |
| 2017-06-05/a> | Didier Stevens | Malware and XOR - Part 1 |
| 2017-05-16/a> | Russ McRee | WannaCry? Do your own data analysis. |
| 2017-05-13/a> | Guy Bruneau | Microsoft Released Guidance for WannaCrypt |
| 2017-04-28/a> | Xavier Mertens | Another Day, Another Obfuscation Technique |
| 2017-04-19/a> | Xavier Mertens | Hunting for Malicious Excel Sheets |
| 2017-04-05/a> | Xavier Mertens | Whitelists: The Holy Grail of Attackers |
| 2017-03-18/a> | Xavier Mertens | Example of Multiple Stages Dropper |
| 2017-03-12/a> | Guy Bruneau | Honeypot Logs and Tracking a VBE Script |
| 2017-03-08/a> | Xavier Mertens | Not All Malware Samples Are Complex |
| 2017-02-05/a> | Xavier Mertens | Many Malware Samples Found on Pastebin |
| 2017-01-31/a> | Johannes Ullrich | Malicious Office files using fileless UAC bypass to drop KEYBASE malware |
| 2017-01-24/a> | Xavier Mertens | Malicious SVG Files in the Wild |
| 2017-01-06/a> | John Bambenek | Ransomware Operators Cold Calling UK Schools to Get Malware Through |
| 2017-01-05/a> | John Bambenek | New Year's Resolution: Build Your Own Malware Lab? |
| 2017-01-01/a> | Didier Stevens | py2exe Decompiling - Part 1 |
| 2016-12-13/a> | Xavier Mertens | UAC Bypass in JScript Dropper |
| 2016-11-11/a> | Rick Wanner | Benevolent malware? reincarna/Linux.Wifatch |
| 2016-10-30/a> | Pasquale Stirparo | Volatility Bot: Automated Memory Analysis |
| 2016-09-30/a> | Xavier Mertens | Another Day, Another Malicious Behaviour |
| 2016-09-13/a> | Rob VandenBrink | If it's Free, YOU are the Product |
| 2016-09-05/a> | Xavier Mertens | Malware Delivered via '.pub' Files |
| 2016-09-01/a> | Xavier Mertens | Maxmind.com (Ab)used As Anti-Analysis Technique |
| 2016-08-25/a> | Xavier Mertens | Out-of-Band iOS Patch Fixes 0-Day Vulnerabilities |
| 2016-08-24/a> | Xavier Mertens | Example of Targeted Attack Through a Proxy PAC File |
| 2016-08-23/a> | Xavier Mertens | Voice Message Notifications Deliver Ransomware |
| 2016-08-01/a> | Daniel Wesemann | Are you getting I-CANNED ? |
| 2016-07-27/a> | Xavier Mertens | Analyze of a Linux botnet client source code |
| 2016-07-25/a> | Didier Stevens | Python Malware - Part 4 |
| 2016-07-16/a> | Didier Stevens | Python Malware - Part 3 |
| 2016-07-12/a> | Xavier Mertens | Hunting for Malicious Files with MISP + OSSEC |
| 2016-06-20/a> | Xavier Mertens | Ongoing Spam Campaign Related to Swift |
| 2016-06-18/a> | Rob VandenBrink | Controlling JavaScript Malware Before it Runs |
| 2016-05-15/a> | Didier Stevens | Python Malware - Part 1 |
| 2016-05-13/a> | Xavier Mertens | MISP - Malware Information Sharing Platform |
| 2016-05-05/a> | Xavier Mertens | Microsoft BITS Used to Download Payloads |
| 2016-05-02/a> | Rick Wanner | Fake Chrome update for Android |
| 2016-04-21/a> | Daniel Wesemann | Decoding Pseudo-Darkleech (#1) |
| 2016-04-21/a> | Daniel Wesemann | Decoding Pseudo-Darkleech (Part #2) |
| 2016-04-10/a> | Didier Stevens | Handling Malware Samples |
| 2016-03-07/a> | Xavier Mertens | Another Malicious Document, Another Way to Deliver Malicious Code |
| 2016-02-24/a> | Xavier Mertens | Analyzis of a Malicious .lnk File with an Embedded Payload |
| 2016-02-18/a> | Xavier Mertens | Hunting for Executable Code in Windows Environments |
| 2016-02-11/a> | Tom Webb | Tomcat IR with XOR.DDoS |
| 2016-01-24/a> | Didier Stevens | Obfuscated MIME Files |
| 2016-01-15/a> | Xavier Mertens | JavaScript Deobfuscation Tool |
| 2016-01-01/a> | Didier Stevens | Failure Is An Option |
| 2015-12-26/a> | Didier Stevens | Malfunctioning Malware |
| 2015-12-16/a> | Xavier Mertens | Playing With Sandboxes Like a Boss |
| 2015-12-06/a> | Mark Hofman | Malware SPAM a new run has started. |
| 2015-11-09/a> | John Bambenek | Protecting Users and Enterprises from the Mobile Malware Threat |
| 2015-09-29/a> | Pedro Bueno | Tricks for DLL analysis |
| 2015-09-28/a> | Johannes Ullrich | "Transport of London" Malicious E-Mail |
| 2015-09-21/a> | Xavier Mertens | Detecting XCodeGhost Activity |
| 2015-04-24/a> | Basil Alawi S.Taher | Fileless Malware |
| 2015-04-09/a> | Brad Duncan | An example of the malicious emails sometimes sent to the ISC handler addresses |
| 2015-03-18/a> | Daniel Wesemann | New SANS memory forensics poster |
| 2015-03-14/a> | Didier Stevens | Maldoc VBA Sandbox/Virtualization Detection |
| 2015-03-08/a> | Brad Duncan | What Happened to You, Asprox Botnet? |
| 2015-02-19/a> | Daniel Wesemann | Macros? Really?! |
| 2014-10-03/a> | Johannes Ullrich | CSAM: The Power of Virustotal to Turn Harmless Binaries Malicious |
| 2014-09-22/a> | Johannes Ullrich | Fake LogMeIn Certificate Update with Bad AV Detection Rate |
| 2014-08-06/a> | Chris Mohan | Free Service to Help CryptoLocker Victims by FireEye and Fox-IT |
| 2014-07-22/a> | Daniel Wesemann | Ivan's Order of Magnitude |
| 2014-07-19/a> | Russ McRee | Keeping the RATs out: the trap is sprung - Part 3 |
| 2014-07-18/a> | Russ McRee | Keeping the RATs out: **it happens - Part 2 |
| 2014-07-18/a> | Russ McRee | Gameover Zeus reported as "returned from the dead" |
| 2014-07-16/a> | Russ McRee | Keeping the RATs out: an exercise in building IOCs - Part 1 |
| 2014-07-05/a> | Guy Bruneau | Malware Analysis with pedump |
| 2014-06-22/a> | Russ McRee | OfficeMalScanner helps identify the source of a compromise |
| 2014-06-08/a> | Guy Bruneau | efax Spam Containing Malware |
| 2014-04-06/a> | Basil Alawi S.Taher | "Power Worm" PowerShell based Malware |
| 2014-04-05/a> | Jim Clausing | Those strange e-mails with URLs in them can lead to Android malware |
| 2014-03-04/a> | Daniel Wesemann | XPired! |
| 2014-02-28/a> | Daniel Wesemann | Fiesta! |
| 2014-01-19/a> | Rick Wanner | Anatomy of a Malware distribution campaign |
| 2013-12-24/a> | Daniel Wesemann | Mr Jones wants you to appear in court! |
| 2013-12-23/a> | Daniel Wesemann | Costco, BestBuy, Walmart really want to send you a package! |
| 2013-12-07/a> | Guy Bruneau | Suspected Active Rovnix Botnet Controller |
| 2013-11-02/a> | Rick Wanner | Protecting Your Family's Computers |
| 2013-10-31/a> | Russ McRee | Happy Halloween: The Ghost Really May Be In The Machine |
| 2013-10-30/a> | Russ McRee | SIR v15: Five good reasons to leave Windows XP behind |
| 2013-10-28/a> | Daniel Wesemann | Exploit cocktail (Struts, Java, Windows) going after 3-month old vulnerabilities |
| 2013-10-24/a> | Johannes Ullrich | False Positive: php.net Malware Alert |
| 2013-09-30/a> | Adrien de Beaupre | Twitter DM spam/malware |
| 2013-09-12/a> | Daniel Wesemann | 37.58.73.42 / 95.156.228.69 / 195.210.43.42, anyone? |
| 2013-09-10/a> | Swa Frantzen | Macs need to patch too! |
| 2013-08-29/a> | Russ McRee | Suspect Sendori software |
| 2013-07-04/a> | Russ McRee | Celebrating 4th of July With a Malware PCAP Visualization |
| 2013-06-18/a> | Russ McRee | Volatility rules...any questions? |
| 2013-05-21/a> | Adrien de Beaupre | Moore, Oklahoma tornado charitable organization scams, malware, and phishing |
| 2013-05-17/a> | Daniel Wesemann | e-netprotections.su ? |
| 2013-05-16/a> | Daniel Wesemann | Extracting signatures from Apple .apps |
| 2013-05-11/a> | Lenny Zeltser | Extracting Digital Signatures from Signed Malware |
| 2013-05-01/a> | Daniel Wesemann | The cost of cleaning up |
| 2013-04-10/a> | Manuel Humberto Santander Pelaez | Massive Google scam sent by email to Colombian domains |
| 2013-03-22/a> | Mark Baggett | Wipe the drive! Stealthy Malware Persistence - Part 4 |
| 2013-03-20/a> | Mark Baggett | Wipe the drive! Stealthy Malware Persistence - Part 3 |
| 2013-03-19/a> | Johannes Ullrich | Scam of the day: More fake CNN e-mails |
| 2013-03-15/a> | Mark Baggett | AVG detect legit file as virus |
| 2013-03-14/a> | Mark Baggett | Wipe the drive! Stealthy Malware Persistence - Part 2 |
| 2013-03-13/a> | Mark Baggett | Wipe the drive! Stealthy Malware Persistence Mechanism - Part 1 |
| 2013-02-25/a> | Johannes Ullrich | Mass-Customized Malware Lures: Don't trust your cat! |
| 2013-01-08/a> | Jim Clausing | Cuckoo 0.5 is out and the world didn't end |
| 2012-12-18/a> | Rob VandenBrink | All I Want for Christmas is to Not Get Hacked ! |
| 2012-12-03/a> | Kevin Liston | Mobile Malware: Request for Field Reports |
| 2012-11-02/a> | Daniel Wesemann | Lamiabiocasa |
| 2012-11-01/a> | Daniel Wesemann | Patched your Java yet? |
| 2012-10-14/a> | Pedro Bueno | Cyber Security Awareness Month - Day 14 - Poor Man's File Analysis System - Part 1 |
| 2012-09-21/a> | Guy Bruneau | Storing your Collection of Malware Samples with Malwarehouse |
| 2012-09-14/a> | Lenny Zeltser | Analyzing Malicious RTF Files Using OfficeMalScanner's RTFScan |
| 2012-07-21/a> | Rick Wanner | OpenDNS is looking for a few good malware people! |
| 2012-07-05/a> | Adrien de Beaupre | New OS X trojan backdoor MaControl variant reported |
| 2012-06-27/a> | Swa Frantzen | Online Banking Heists |
| 2012-06-26/a> | Daniel Wesemann | Run, Forest! (Update) |
| 2012-06-25/a> | Rick Wanner | Targeted Malware for Industrial Espionage? |
| 2012-06-25/a> | Swa Frantzen | Belgian online banking customers hacked. |
| 2012-06-22/a> | Daniel Wesemann | Run, Forest! |
| 2012-06-21/a> | Raul Siles | Print Bomb? (Take 2) |
| 2012-06-21/a> | Russ McRee | Analysis of drive-by attack sample set |
| 2012-06-19/a> | Daniel Wesemann | Vulnerabilityqueerprocessbrittleness |
| 2012-06-04/a> | Lenny Zeltser | Decoding Common XOR Obfuscation in Malicious Code |
| 2012-04-26/a> | Richard Porter | Define Irony: A medical device with a Virus? |
| 2012-04-25/a> | Daniel Wesemann | Blacole's obfuscated JavaScript |
| 2012-04-25/a> | Daniel Wesemann | Blacole's shell code |
| 2012-04-12/a> | Guy Bruneau | HP ProCurve 5400 zl Switch, Flash Cards Infected with Malware |
| 2012-04-12/a> | Guy Bruneau | Apple Java Updates for Mac OS X |
| 2012-03-25/a> | Daniel Wesemann | evilcode.class |
| 2012-03-03/a> | Jim Clausing | New automated sandbox for Android malware |
| 2012-02-24/a> | Guy Bruneau | Flashback Trojan in the Wild |
| 2012-02-20/a> | Rick Wanner | DNSChanger resolver shutdown deadline is March 8th |
| 2012-02-20/a> | Pedro Bueno | Simple Malware Research Tools |
| 2012-01-14/a> | Daniel Wesemann | Hello, Antony! |
| 2011-12-28/a> | Daniel Wesemann | .nl.ai ? |
| 2011-12-10/a> | Daniel Wesemann | Unwanted Presents |
| 2011-12-07/a> | Lenny Zeltser | V8 as an Alternative to SpiderMonkey for JavaScript Deobfuscation |
| 2011-11-04/a> | Guy Bruneau | Duqu Mitigation |
| 2011-10-20/a> | Johannes Ullrich | Evil Printers Sending Mail |
| 2011-09-07/a> | Lenny Zeltser | Analyzing Mobile Device Malware - Honeynet Forensic Challenge 9 and Some Tools |
| 2011-08-29/a> | Kevin Shortt | Internet Worm in the Wild |
| 2011-06-15/a> | Pedro Bueno | Hit by MacDefender, Apple Web Security (name your Mac FakeAV here)... |
| 2011-05-25/a> | Daniel Wesemann | Apple advisory on "MacDefender" malware |
| 2011-05-19/a> | Daniel Wesemann | Fake AV Bingo |
| 2011-05-14/a> | Guy Bruneau | Websense Study Claims Canada Next Hotbed for Cybercrime Web Hosting Activity |
| 2011-05-03/a> | Johannes Ullrich | Update on Osama Bin Laden themed Malware |
| 2011-05-02/a> | Johannes Ullrich | Bin Laden Death Related Malware |
| 2011-04-23/a> | Manuel Humberto Santander Pelaez | Image search can lead to malware download |
| 2011-03-01/a> | Daniel Wesemann | AV software and "sharing samples" |
| 2011-02-07/a> | Pedro Bueno | The Good , the Bad and the Unknown Online Scanners |
| 2011-02-01/a> | Lenny Zeltser | The Importance of HTTP Headers When Investigating Malicious Sites |
| 2010-12-29/a> | Daniel Wesemann | Malware Domains 2234.in, 0000002.in & co |
| 2010-12-29/a> | Daniel Wesemann | Beware of strange web sites bearing gifts ... |
| 2010-10-26/a> | Pedro Bueno | Cyber Security Awareness Month - Day 26 - Sharing Office Files |
| 2010-09-09/a> | Marcus Sachs | 'Here You Have' Email |
| 2010-07-21/a> | Adrien de Beaupre | Dell PowerEdge R410 replacement motherboard firmware contains malware |
| 2010-07-21/a> | Adrien de Beaupre | autorun.inf and .lnk Malware (NOT 'Vulnerability in Windows Shell Could Allow Remote Code Execution' 2286198) |
| 2010-07-06/a> | Rob VandenBrink | Bogus Support Organizations use Live Operators to Install Malware |
| 2010-07-04/a> | Manuel Humberto Santander Pelaez | Malware inside PDF Files |
| 2010-06-17/a> | Deborah Hale | FYI - Another bogus site |
| 2010-06-14/a> | Manuel Humberto Santander Pelaez | Rogue facebook application acting like a worm |
| 2010-06-07/a> | Manuel Humberto Santander Pelaez | Software Restriction Policy to keep malware away |
| 2010-06-02/a> | Rob VandenBrink | New Mac malware - OSX/Onionspy |
| 2010-05-26/a> | Bojan Zdrnja | Malware modularization and AV detection evasion |
| 2010-05-23/a> | Manuel Humberto Santander Pelaez | e-mail scam announcing Fidel Castro's funeral ... and nasty malware to your computer. |
| 2010-05-21/a> | Rick Wanner | IBM distributes malware at AusCERT! |
| 2010-04-30/a> | Kevin Liston | The Importance of Small Files |
| 2010-04-19/a> | Daniel Wesemann | Linked into scams? |
| 2010-04-18/a> | Guy Bruneau | Some NetSol hosted sites breached |
| 2010-04-13/a> | Johannes Ullrich | More Legal Threat Malware E-Mail |
| 2010-03-30/a> | Pedro Bueno | Sharing the Tools |
| 2010-03-26/a> | Daniel Wesemann | Getting the EXE out of the RTF again |
| 2010-03-09/a> | Marcus Sachs | Energizer Malware |
| 2010-03-04/a> | Daniel Wesemann | salefale-dot-com is bad |
| 2010-03-03/a> | Johannes Ullrich | Reports about large number of fake Amazon order confirmations |
| 2010-02-21/a> | Patrick Nolan | Looking for "more useful" malware information? Help develop the format. |
| 2010-01-14/a> | Bojan Zdrnja | PDF Babushka |
| 2010-01-07/a> | Daniel Wesemann | Static analysis of malicious PDFs |
| 2010-01-07/a> | Daniel Wesemann | Static analysis of malicous PDFs (Part #2) |
| 2009-12-17/a> | Daniel Wesemann | In caches, danger lurks |
| 2009-12-17/a> | Daniel Wesemann | overlay.xul is back |
| 2009-12-16/a> | Rob VandenBrink | Beware the Attack of the Christmas Greeting Cards ! |
| 2009-12-07/a> | Rick Wanner | Cheat Sheet: Analyzing Malicious Documents |
| 2009-12-04/a> | Daniel Wesemann | Max Power's Malware Paradise |
| 2009-12-02/a> | Rob VandenBrink | SPAM and Malware taking advantage of H1N1 concerns |
| 2009-11-25/a> | Jim Clausing | Updates to my GREM Gold scripts and a new script |
| 2009-09-25/a> | Lenny Zeltser | Categories of Common Malware Traits |
| 2009-09-25/a> | Deborah Hale | Conficker Continues to Impact Networks |
| 2009-09-25/a> | Deborah Hale | Malware delivered over Google and Yahoo Ad's? |
| 2009-09-04/a> | Adrien de Beaupre | Fake anti-virus |
| 2009-08-29/a> | Guy Bruneau | Immunet Protect - Cloud and Community Malware Protection |
| 2009-08-26/a> | Johannes Ullrich | Malicious CD ROMs mailed to banks |
| 2009-07-26/a> | Jim Clausing | New Volatility plugins |
| 2009-07-03/a> | Adrien de Beaupre | Happy 4th of July! |
| 2009-07-02/a> | Daniel Wesemann | Getting the EXE out of the RTF |
| 2009-07-02/a> | Bojan Zdrnja | Cold Fusion web sites getting compromised |
| 2009-06-16/a> | John Bambenek | Iran Internet Blackout: Using Twitter for Operational Intelligence |
| 2009-06-16/a> | John Bambenek | URL Shortening Service Cligs Hacked |
| 2009-06-04/a> | Raul Siles | Malware targetting banks ATM's |
| 2009-06-04/a> | Raul Siles | Targeted e-mail attacks asking to verify wire transfer details |
| 2009-06-01/a> | G. N. White | Yet another "Digital Certificate" malware campaign |
| 2009-05-20/a> | Pedro Bueno | Cyber Warfare and Kylin thoughts |
| 2009-05-07/a> | Deborah Hale | Malicious Content on the Web |
| 2009-05-04/a> | Tom Liston | Facebook phishing malware |
| 2009-04-24/a> | Pedro Bueno | Did you check your conference goodies? |
| 2009-03-13/a> | Bojan Zdrnja | When web application security, Microsoft and the AV vendors all fail |
| 2009-02-23/a> | Daniel Wesemann | Turf War |
| 2009-02-23/a> | Daniel Wesemann | And the Oscar goes to... |
| 2009-02-10/a> | Bojan Zdrnja | More tricks from Conficker and VM detection |
| 2009-02-09/a> | Bojan Zdrnja | Some tricks from Conficker's bag |
| 2009-02-04/a> | Daniel Wesemann | Titan Shields up! |
| 2009-01-31/a> | John Bambenek | Google Search Engine's Malware Detection Broken |
| 2009-01-24/a> | Pedro Bueno | Identifying and Removing the iWork09 Trojan |
| 2009-01-18/a> | Daniel Wesemann | 3322. org |
| 2009-01-15/a> | Bojan Zdrnja | Conficker's autorun and social engineering |
| 2009-01-12/a> | William Salusky | Downadup / Conficker - MS08-067 exploit and Windows domain account lockout |
| 2009-01-07/a> | Bojan Zdrnja | An Israeli patriot program or a trojan |
| 2009-01-02/a> | Rick Wanner | Tools on my Christmas list. |
| 2008-12-25/a> | Maarten Van Horenbeeck | Merry Christmas, and beware of digital hitchhikers! |
| 2008-12-25/a> | Maarten Van Horenbeeck | Christmas Ecard Malware |
| 2008-12-17/a> | donald smith | Team CYMRU's Malware Hash Registry |
| 2008-12-05/a> | Daniel Wesemann | Been updatin' your Flash player lately? |
| 2008-12-05/a> | Daniel Wesemann | Baby, baby! |
| 2008-12-04/a> | Bojan Zdrnja | Rogue DHCP servers |
| 2008-11-17/a> | Jim Clausing | Finding stealth injected DLLs |
| 2008-11-16/a> | Maarten Van Horenbeeck | Detection of Trojan control channels |
| 2008-11-12/a> | John Bambenek | Thoughts on Security Intelligence (McColo Corp alleged spam/malware host knocked offline) |
| 2008-11-11/a> | Swa Frantzen | Acrobat continued activity in the wild |
| 2008-11-10/a> | Stephen Hall | Adobe Reader Vulnerability - part 2 |
| 2008-10-07/a> | Kyle Haugsness | Good reading and a malware challenge |
| 2008-09-29/a> | Daniel Wesemann | ASPROX mutant |
| 2008-09-22/a> | Maarten Van Horenbeeck | Data exfiltration and the use of anonymity providers |
| 2008-09-18/a> | Bojan Zdrnja | Monitoring HTTP User-Agent fields |
| 2008-09-07/a> | Lorna Hutcheson | Malware Analysis: Tools are only so good |
| 2008-09-03/a> | Daniel Wesemann | Static analysis of Shellcode |
| 2008-09-03/a> | Daniel Wesemann | Static analysis of Shellcode - Part 2 |
| 2008-09-01/a> | John Bambenek | The Number of Machines Controlled by Botnets Has Jumped 4x in Last 3 Months |
| 2008-08-13/a> | Adrien de Beaupre | CNN switched to MSNBC |
| 2008-08-05/a> | Daniel Wesemann | The news update you never asked for |
| 2008-07-20/a> | Kevin Liston | Malware Intelligence: Making it Actionable |
| 2008-07-15/a> | Maarten Van Horenbeeck | Extracting scripts and data from suspect PDF files |
| 2008-07-14/a> | Daniel Wesemann | Obfuscated JavaScript Redux |
| 2008-07-07/a> | Pedro Bueno | Bad url classification |
| 2008-06-18/a> | Marcus Sachs | Olympics Part II |
| 2008-06-14/a> | Lorna Hutcheson | Malware Detection - Take the Blinders Off |
| 2008-06-10/a> | Swa Frantzen | Ransomware keybreaking |
| 2008-06-01/a> | Mark Hofman | Free Yahoo email account! Sign me up, Ok well maybe not. |
| 2008-05-28/a> | Adrien de Beaupre | Another example of malicious SWF |
| 2008-05-27/a> | Adrien de Beaupre | Malicious swf files? |
| 2008-05-26/a> | Marcus Sachs | Predictable Response |
| 2008-05-14/a> | Bojan Zdrnja | War of the worlds? |
| 2008-05-02/a> | Adrien de Beaupre | Hi, remember me?... |
| 2008-04-30/a> | Bojan Zdrnja | (Minor) evolution in Mac DNS changer malware |
| 2008-04-24/a> | Maarten Van Horenbeeck | Targeted attacks using malicious PDF files |
| 2008-04-16/a> | Bojan Zdrnja | The 10.000 web sites infection mystery solved |
| 2008-04-15/a> | Johannes Ullrich | SRI Malware Threat Center |
| 2008-04-14/a> | John Bambenek | A Federal Subpoena or Just Some More Spam & Malware? |
| 2008-04-07/a> | John Bambenek | HP USB Keys Shipped with Malware for your Proliant Server |
| 2008-04-07/a> | John Bambenek | Got Kraken? |
| 2008-04-07/a> | John Bambenek | Kraken Technical Details: UPDATED x3 |
| 2008-04-06/a> | Daniel Wesemann | Advanced obfuscated JavaScript analysis |
| 2008-04-04/a> | Daniel Wesemann | nmidahena |
| 2008-04-03/a> | Bojan Zdrnja | VB detection: is it so difficult? |
| 2008-04-02/a> | Adrien de Beaupre | When is a DMG file not a DMG file |
| 2008-03-27/a> | Maarten Van Horenbeeck | Guarding the guardians: a story of PGP key ring theft |
| 2006-08-31/a> | Swa Frantzen | NT botnet submitted |
| 2000-01-02/a> | Deborah Hale | 2010 A Look Back - 2011 A Look Ahead |
APPLE |
| 2025-03-31/a> | Johannes Ullrich | Apple Patches Everything: March 31st 2025 Edition |
| 2025-03-11/a> | Johannes Ullrich | Apple Fixes Exploited WebKit Vulnerability in iOS, MacOS, visionOS and Safari |
| 2024-12-11/a> | Johannes Ullrich | Apple Updates Everything (iOS, iPadOS, macOS, watchOS, tvOS, visionOS) |
| 2024-07-30/a> | Johannes Ullrich | Apple Patches Everything. July 2024 Edition |
| 2024-03-05/a> | Johannes Ullrich | Apple Releases iOS/iPadOS Updates with Zero Day Fixes. |
| 2024-01-22/a> | Johannes Ullrich | Apple Updates Everything - New 0 Day in WebKit |
| 2023-12-11/a> | Johannes Ullrich | Apple Patches Everything |
| 2023-10-25/a> | Johannes Ullrich | Apple Patches Everything. Releases iOS 17.1, MacOS 14.1 and updates for older versions fixing exploited vulnerability |
| 2023-10-23/a> | Johannes Ullrich | How an AppleTV may take down your (#IPv6) network |
| 2023-04-07/a> | Johannes Ullrich | Apple Patching Two 0-Day Vulnerabilities in iOS and macOS |
| 2023-03-27/a> | Johannes Ullrich | Apple Updates Everything (including Studio Display) |
| 2023-01-24/a> | Johannes Ullrich | Apple Updates (almost) Everything: Patch Overview |
| 2022-08-17/a> | Johannes Ullrich | Apple Patches Two Exploited Vulnerabilities |
| 2022-07-26/a> | Xavier Mertens | How is Your macOS Security Posture? |
| 2022-07-20/a> | Johannes Ullrich | Apple Patches Everything Day |
| 2022-05-16/a> | Johannes Ullrich | Apple Patches Everything |
| 2022-03-31/a> | Johannes Ullrich | Apple Patches Actively Exploited Vulnerability in macOS, iOS and iPadOS, |
| 2022-03-14/a> | Johannes Ullrich | Apple Updates Everything: MacOS 12.3, XCode 13.3, tvOS 15.4, watchOS 8.5, iPadOS 15.4 and more |
| 2022-01-27/a> | Johannes Ullrich | Apple Patches Everything |
| 2021-10-28/a> | Yee Ching Tok | Multiple Apple Patches for October 2021 |
| 2021-09-21/a> | Johannes Ullrich | A First Look at Apple's iOS 15 "Private Relay" feature. |
| 2021-05-04/a> | Rick Wanner | Important Apple Updates |
| 2018-10-08/a> | Guy Bruneau | Apple Security Updates |
| 2018-01-23/a> | Johannes Ullrich | Apple Updates Everything, Again |
| 2017-11-28/a> | Xavier Mertens | Apple High Sierra Uses a Passwordless Root Account |
| 2017-04-18/a> | Johannes Ullrich | Yet Another Apple Phish and Some DNS Lessons Learned From It |
| 2016-09-13/a> | Rob VandenBrink | Apple iOS 10 and 10.0.1 Released |
| 2016-09-02/a> | Johannes Ullrich | Apple Patches "Trident" Vulnerabilities in OS X / Safari |
| 2016-08-25/a> | Xavier Mertens | Out-of-Band iOS Patch Fixes 0-Day Vulnerabilities |
| 2016-08-11/a> | Pasquale Stirparo | Looking for the insider: Forensic Artifacts on iOS Messaging App |
| 2015-09-21/a> | Xavier Mertens | Detecting XCodeGhost Activity |
| 2014-10-17/a> | Johannes Ullrich | Apple Updates (not just Yosemite) |
| 2014-09-18/a> | Johannes Ullrich | Apple Releases OS X 10.9.5 / Safari 6.2 and 7.1 with several security fixes http://support.apple.com/kb/HT1222 |
| 2014-08-13/a> | Johannes Ullrich | Updates for Apple Safari |
| 2014-07-11/a> | Rob VandenBrink | Apple pushes OS X update to block out of date Flash versions - http://support.apple.com/kb/HT5655 |
| 2014-07-01/a> | Johannes Ullrich | Apple Releases Patches for All Products |
| 2014-05-07/a> | Johannes Ullrich | De-Clouding your Life: Things that should not go into the cloud. |
| 2014-04-22/a> | Johannes Ullrich | Apple Patches for OS X, iOS and Apple TV. |
| 2014-04-02/a> | Kevin Shortt | Apple Security Update for Safari 6.1.3/7.0.3: http://support.apple.com/kb/HT6181 |
| 2014-03-27/a> | Alex Stanford | Apple Credential Phishing via appleidconfirm.net |
| 2014-03-10/a> | Basil Alawi S.Taher | Apple iOS 7.1 |
| 2014-02-25/a> | Alex Stanford | Apple releases OS X 10.9.2 patching SSL vulnerability and updates Safari |
| 2014-02-21/a> | Jim Clausing | Apple updates iOS and Apple TV |
| 2014-01-24/a> | Chris Mohan | Security Update for OS X for CVE-2014-1252 http://support.apple.com/kb/HT6117 |
| 2013-12-17/a> | Adrien de Beaupre | Apple security updates Mac OS X and Safari |
| 2013-11-14/a> | Johannes Ullrich | iOS 7.0.4 released. Fixes issue with unauthorized in App purchases http://lists.apple.com/archives/security-announce/2013/Nov/msg00000.html |
| 2013-10-09/a> | Johannes Ullrich | Other Patch Tuesday Updates (Adobe, Apple) |
| 2013-09-18/a> | Rob VandenBrink | Apple IOS 7 - Brace for Impact! |
| 2013-09-13/a> | Rob VandenBrink | Update for Safari to version 5.1.10 is out - http://support.apple.com/kb/HT5921 |
| 2013-07-22/a> | Johannes Ullrich | Apple Developer Site Breach |
| 2013-07-03/a> | Kevin Shortt | Apple Security Update 2013-003 |
| 2013-06-05/a> | Johannes Ullrich | Apple releases OS 10.8.4 |
| 2013-05-22/a> | Adrien de Beaupre | Apple QuickTime 7.7.4 for Windows updated, MANY security vulnerabilities: http://support.apple.com/kb/HT1222 |
| 2013-04-17/a> | Richard Porter | Apple iTunes Services Outage |
| 2013-03-23/a> | Guy Bruneau | Apple ID Two-step Verification Now Available in some Countries |
| 2013-03-14/a> | Richard Porter | Apple Security Updates: http://support.apple.com/kb/HT1222 |
| 2013-02-20/a> | Johannes Ullrich | Update Palooza |
| 2013-02-19/a> | Johannes Ullrich | Oracle Updates Java (Java 7 Update 15, Java 6 update 41) |
| 2013-02-05/a> | Russ McRee | Apple Security Update: OS X Server v.2.2.1 now available http://support.apple.com/kb/HT5644 |
| 2013-01-28/a> | Johannes Ullrich | iOS 6.1 Released |
| 2012-09-20/a> | Russ McRee | Apple and Cisco Security Advisories 19 SEP 2012 |
| 2012-08-22/a> | Adrien de Beaupre | Apple Remote Desktop update fixes no encryption issue |
| 2012-08-22/a> | Adrien de Beaupre | Phishing/spam via SMS |
| 2012-07-25/a> | Johannes Ullrich | Apple OS X 10.8 (Mountain Lion) released |
| 2012-07-25/a> | Johannes Ullrich | Apple Releases Safari 6 |
| 2012-06-12/a> | Scott Fendley | Apple iTunes Security Update |
| 2012-06-01/a> | Johannes Ullrich | Apple Releases iOS Security Specs |
| 2012-05-25/a> | Guy Bruneau | Apple PGP Product Security key update - https://www.apple.com/support/security/pgp/ |
| 2012-05-10/a> | Kevin Shortt | Safari 5.1.7 - an interesting feature |
| 2012-04-14/a> | Rick Wanner | Flashback Trojan Removal Tool Released |
| 2012-03-12/a> | Johannes Ullrich | Apple Released Safari 5.1.4 |
| 2012-03-08/a> | Johannes Ullrich | Apple Patches |
| 2012-02-27/a> | Johannes Ullrich | Odd Vanishing Signatures in OS X XProtect |
| 2012-02-22/a> | Johannes Ullrich | How to test OS X Mountain Lion's Gatekeeper in Lion |
| 2012-02-20/a> | Johannes Ullrich | The Ultimate OS X Hardening Guide Collection |
| 2012-02-04/a> | Scott Fendley | Apple Security Advisory 2012-001 v1.1 |
| 2011-11-14/a> | Stephen Hall | Apple update summary |
| 2011-11-11/a> | Rick Wanner | APPLE-SA-2011-11-10-2 Time Capsule and AirPort Base Station (802.11n) Firmware 7.6 update |
| 2011-11-08/a> | Swa Frantzen | Apple Black Tuesday |
| 2011-11-03/a> | Richard Porter | An Apple, Inc. Sandbox to play in. |
| 2011-10-11/a> | Swa Frantzen | Apple iTunes 10.5 |
| 2011-09-09/a> | Guy Bruneau | Apple Certificate Trust Policy Update |
| 2011-07-29/a> | Richard Porter | Apple Lion talking on TCP 5223 |
| 2011-07-25/a> | Johannes Ullrich | iOS 4.3.5 released fixing an SSL certificate verification flaw. http://support.apple.com/kb/HT1222 |
| 2011-07-25/a> | Johannes Ullrich | Apple released patch for iWork security issue http://support.apple.com/kb/HT1222 |
| 2011-07-21/a> | Mark Hofman | Lion Released |
| 2011-07-21/a> | Johannes Ullrich | Lion: What is new in Security |
| 2011-07-15/a> | Deborah Hale | Apple Software Updates |
| 2011-07-10/a> | Raul Siles | Jailbreakme Takes Advantage of 0-day PDF Vuln in Apple iOS Devices |
| 2011-06-28/a> | Johannes Ullrich | Update: Java update for OS X fixes security issues http://support.apple.com/kb/HT1222 |
| 2011-06-23/a> | Jim Clausing | Apple Security Updates 2011-004 |
| 2011-06-17/a> | Richard Porter | When do you stop owning Technology? |
| 2011-06-15/a> | Pedro Bueno | Hit by MacDefender, Apple Web Security (name your Mac FakeAV here)... |
| 2011-05-31/a> | Johannes Ullrich | Apple Improving OS X Anti-Malware Feature |
| 2011-05-25/a> | Daniel Wesemann | Apple advisory on "MacDefender" malware |
| 2011-04-14/a> | Johannes Ullrich | Apple Security Patches for OS X and iOS |
| 2011-03-21/a> | Kevin Shortt | APPLE-SA-2011-03-21-1 Mac OS X v10.6.7 and Security Update 2011-001 |
| 2011-03-12/a> | Chris Mohan | Apple releases iTunes 10.2.1 - http://support.apple.com/kb/DL1103 |
| 2011-03-10/a> | Bojan Zdrnja | iOS 4.3 released, numerous security vulnerabilities patched |
| 2011-03-09/a> | Jim Clausing | Apple updates Java |
| 2011-02-25/a> | Johannes Ullrich | Thunderbolt Security Speculations |
| 2011-01-06/a> | Johannes Ullrich | OS X 10.6.6 released. Probably some security content but Apple hasn't released details yet. |
| 2010-12-12/a> | Raul Siles | Apple Quickime 7.6.9 was released a few days ago (just in case you missed it): http://support.apple.com/kb/HT1222. Update all your web browser plugins! |
| 2010-11-11/a> | Johannes Ullrich | OS X 10.6.5 released with security patches. Careful: issues with PGP WDE! (see PGP support forums) |
| 2010-08-30/a> | Adrien de Beaupre | Apple QuickTime potential vulnerability/backdoor |
| 2010-08-10/a> | Daniel Wesemann | New Apple security updates for iPad/Pod/Phone. See http://support.apple.com/kb/ht1222 |
| 2010-07-05/a> | Manuel Humberto Santander Pelaez | Apple ITunes account security compromised |
| 2010-06-15/a> | Manuel Humberto Santander Pelaez | Apple releases advisory for Mac OS X - Multiple vulnerabilities discovered |
| 2010-06-08/a> | Mark Hofman | Safari 5.0 is available for all platforms. Addresses some security issues, more here http://support.apple.com/kb/HT4196 |
| 2010-04-02/a> | Guy Bruneau | Apple QuickTime and iTunes Security Update |
| 2010-03-29/a> | Adrien de Beaupre | APPLE-SA-2010-03-29-1 Security Update 2010-002 / Mac OS X v10.6.3 |
| 2010-03-11/a> | Mark Hofman | A new version of Safari is out. Looks like for Mac and Windows. Plenty of security fixes (mostly for Windows Safari users http://support.apple.com/kb/HT4070 ) |
| 2010-02-03/a> | Rob VandenBrink | APPLE-SA-2010-02-02-1 iPhone OS 3.1.3 and iPhone OS 3.1.3 for iPod touch |
| 2010-01-27/a> | Raul Siles | Active SEO poisoning attacks for hot topics |
| 2010-01-19/a> | Jim Clausing | Apple Security Update 2010-001 |
| 2009-12-03/a> | Mark Hofman | Apple released some Java updates today APPLE-SA-2009-12-03-1 & 2 (for 10.5 and 10.6). Fixes a number of security issues so updating is a good idea. |
| 2009-09-12/a> | Jim Clausing | Apple Updates |
| 2009-08-11/a> | Swa Frantzen | Safari 4.0.3 |
| 2009-08-05/a> | donald smith | Security Update 2009-003 / Mac OS X v10.5.8 |
| 2009-06-09/a> | Swa Frantzen | Safari 4.0 released - contains security fixes |
| 2009-05-22/a> | Mark Hofman | Patching and Apple - Java issue |
| 2009-05-12/a> | Swa Frantzen | Apple patches and updates |
| 2009-01-24/a> | Pedro Bueno | Identifying and Removing the iWork09 Trojan |
| 2009-01-21/a> | Raul Siles | Vulnerabilities on Cisco and Apple products |
| 2008-11-10/a> | Stephen Hall | Apple breathing iLife into 10.4 |
| 2008-09-16/a> | Joel Esler | Apple Updates you may have missed in the past week |
| 2008-09-10/a> | Adrien de Beaupre | Apple updates iPod Touch + Bonjour for Windows |
| 2008-09-09/a> | Swa Frantzen | Apple updates iTunes+QuickTime |
| 2008-08-01/a> | Swa Frantzen | Apple's Security Update 2008-005: DNS workaround finally included |
| 2008-07-01/a> | Joel Esler | Apple Posts 10.5.4, Security Update 2008-004, Time Machine + Apple Base Station Upgrades, and Safari upgrade for 10.4.11 |
| 2008-06-10/a> | Swa Frantzen | Upgrade to QuickTime 7.5 |
| 2008-05-29/a> | Joel Esler | Apple Update 10.5.3 and Apple Security Update 2008-003 |
| 2008-04-20/a> | Joel Esler | Software Update -- Did Apple Do Enough? |
| 2008-04-17/a> | Chris Carboni | Safari 3.1.1 Released |
| 2008-03-20/a> | Joel Esler | APPLE-SA-2008-03-19 AirPort Extreme Base Station Firmware 7.3.1 |
| 2007-01-03/a> | Toby Kohlenberg | VLC Media Player udp URL handler Format String Vulnerability |
| 2006-11-29/a> | Toby Kohlenberg | New Vulnerability Announcement and patches from Apple |
| 2006-09-21/a> | Johannes Ullrich | Apple updates Airport Drivers |
| 2006-09-12/a> | Swa Frantzen | Apple Quicktime 7.1.3 released |
