Slam screen locker. What are you?
Slam screen locker. What are you? ☹️ Next up is fast malware analysis, conducted on one Sunday evening. An interesting sample flew into our networks, generating…
Methods of masking the virtual environment
Methods for Masking a Virtual Environment 😷 During malware analysis, you may encounter samples that will not function fully in a virtual environment. This is be…
TLS on the network: what to do
TLS on the network: what to do 🤷♂️ You are a powerful network traffic analysis engine. You work for the benefit of the information security system, grinding th…
By the way, about Offzone
By the way, about Offzone 🙂 We promised to publish the latest version of the presentation from the talk about ExCobalt's maneuvers in the channel — here it is 🤝…
!!r^d**n**c
!!р^д**н**c 🤔 A characteristic example of how threat actors use current events to distribute malicious programs is a malicious document we discovered. It contai…
In early 2024, our team identified the use of Cobint malware in customer infrastructures
In early 2024, our team identified the use of the Cobint malware in customers' infrastructures 🥷 This malware is actively used by the (Ex)Cobalt group in attack…
Ad-hoc network research, or How to find new, previously undiscovered activity of a known group in 15 minutes
🔎 Quick-and-dirty network research, or How to find a new, previously undiscovered activity of a known group in 15 minutes While analyzing external expertise on…
Rapid decryption of data from an NSIS script
Rapid decryption of data from an NSIS script 🗄 When there's no time to identify the encryption algorithm and implement a decryption algorithm, a debugger comes…