malware Dissecting the Infection Chain: Technical Analysis of the Kimsuky JavaScript Dropper This blog analyzes a Kimsuky sample, how the dropper downloads additional stages, and network traffic observed within the infection chain.
threat intelligence NPM Compromise: The Wrath of the Shai-Hulud Supply Chain Attack A walkthrough of two major NPM supply chain compromises in September 2025: the Shai-Hulud worm and cryptocurrency wallet hijacking.
threat intelligence Thorium 101: Inside CISA’s Open Source Malware Analysis Platform CISA’s new open-source malware analysis tool Thorium is designed for customization, safety, and real-world security team workflows. This post introduces its core features and how to get started.
threat intelligence Unpacking KiwiStealer: Diving into BITTER APT’s Malware for File Exfiltration Learn about KiwiStealer capabilities and malware analysis of how it exfiltrates data via HTTP POST requests.
threat intelligence Albabat 2.0.0 Decoded: A Config-Driven Design This blog analyzes Albabat ransomware, exploring its config file, executed ransomware commands, and ransom note.
malware Rilide - An Information Stealing Browser Extension Learn about the information stealing browser extension Rilide, its delivery methods, and intrusion chain.
threat intelligence Compromised Browser Extensions - A Growing Threat Vector Learn how threat actors leverage browser extensions as an attack vector, including examples for Cyberhaven and GraphQL Network Inspector.
threat intelligence Featured Assemblyline 101 - Open Source Malware Triage Learn how to install and use Assemblyline, the open-source malware triage tool. This 101 includes an overview, deployment walkthrough, example use case, and resources.
threat intelligence Cronus: Ransomware Threatening Bodily Harm This technical research analyzes Cronus Ransomware. We examine how the ransomware encrypts files, establishes persistence, and deviates from other ransom notes.
malware Latrodectus Loader This research examines the distribution mechanisms, C2 traffic patterns, and functionality of Latrodectus loader.
threat intelligence Balada Injector Dive into how Balada exploits vulnerabilities within WordPress plugins. This research blog analyzes how Balada injects malicious code and the functionality of the scripts used in the campaign.
threat intelligence PikaBot Rising Dive into the distribution methods and capabilities of Pikabot, a loader that has been growing in prevalence since early 2023.
threat intelligence Analyzing DarkGate Loaders This blog examines three different loader types used in recent DarkGate infections.
threat intelligence Analyzing Agniane Stealer Agniane is an emerging infostealer identified in August 2023. Dive into how Agniane collects data, evades analysis, and expands operations in this blog.
malware Identifying Mystic Stealer Control Panels Learn how to research and identify control panels for Mystic Stealer, an information stealer that appeared on underground markets in April 2023.
malware Akira Ransomware Akira is an emergent ransomware group that has been active since April 2023, targeting small to medium organizations. Here's what you need to know.
malware Should You Pay Hacker Ransom? If you haven’t heard by now, Uber paid hackers [https://www.bloomberg.com/news/articles/2017-11-21/uber-concealed-cyberattack-that-exposed-57-million-people-s-data] $100,000 in ransom last year in exchange for deleting the stolen personal information of 57 million victims. Hackers have also been know to demand ransom for DDoS attacks [https://www.bleepingcomputer.
