During the course of an investigation into a fraud case, I had the opportunity to analyse the infrastructure and client-side code of BasisDev, a fraudulent cryptocurrency investment platform. This ...

So I was at work one day going over our internal CTI based on IoCs we’ve collected from incidents, and reviewing those against some public write ups, as we know DPRK intrusion sets like Dangerous P...

Overview Trafalgar, 1805. The British Royal Navy, under Admiral Horatio Nelson, destroyed the combined Franco-Spanish fleet in the waters off southern Spain. Nelson died on the deck of HMS Victory...

Overview Recently I’ve been looking to improve my threat actor infrastructure tracking capabilities, and dust off my IOC pivoting skills—given I’ve spent considerable time lately building infrastr...

Overview So, its been a few weeks since I’ve done any analysis given we’ve just come off the christmas break. Before then, I was neck deep into North Korean malware. Coming off the back of Christma...

Overview In the last blog, I covered a campaign that was being conducted by a cybercriminal using the Phenedrome stealer, which hasn’t been seen in a while. In the last blog, I covered the fake An...

Overview A few days ago, I was scrolling X (formally Twitter) where I follow other people in the cyber community, and came across a post about a threat actor impersonating the AnyDesk website to s...

What is RC4? RC4 is a very commonly used stream cipher. Rather than encrypting data in fixed blocks (like AES), it generates a keystream - a pseudorandom stream of bytes - and XORs that against yo...

Overview AsyncRAT is a remote access trojan (RAT) built to remotely monitor and control other computers through a secure, encrypted connection. The name “AsyncRAT” comes from its core functionalit...

In malware development, payload placement refers to where and how the malicious code (the payload) is embedded or hidden within a system to execute harmful functions without detection. Use cases fo...