Non-profit threat research built to help everyone defending against the dark arts. https://malbearlabs.com/ Wed, 09 Sep 2026 11:37:17 -0400 Wed, 09 Sep 2026 11:37:17 -0400 Jekyll v4.4.1 <p><a href="https://malbearlabs.com/posts/shadow-hvnc-and-shadow-loader-the-kit-that-protects-its-license-better-than-its-customers"><img src="https://malbearlabs.com/images/medium/shadow-hvnc-and-shadow-loader-the-kit-that-protects-its-license-better-than-its-customers/01.png" alt="Shadow HVNC and Shadow Loader: The Kit That Protects Its License Better Than Its Customers" /></a></p><p>Ransomware gets the headlines because it&apos;s loud: it kicks the door wide open, encrypts everything, and leaves a &quot;love&quot; note, and the bill for the week or...</p><p><a href="https://malbearlabs.com/posts/shadow-hvnc-and-shadow-loader-the-kit-that-protects-its-license-better-than-its-customers">Read the full write-up on malbearlabs.com →</a></p> Mon, 17 Aug 2026 20:08:37 -0400 https://malbearlabs.com/posts/shadow-hvnc-and-shadow-loader-the-kit-that-protects-its-license-better-than-its-customers https://malbearlabs.com/posts/shadow-hvnc-and-shadow-loader-the-kit-that-protects-its-license-better-than-its-customers Cybercrime Threat Intelligence Malware Analysis Malware Go <p><a href="https://malbearlabs.com/posts/weyhro-c2-because-ransomware-wasnt-paying-the-bills-anymore"><img src="https://malbearlabs.com/images/medium/weyhro-c2-because-ransomware-wasnt-paying-the-bills-anymore/01.png" alt="Weyhro C2: Because Ransomware Wasn’t Paying the Bills Anymore" /></a></p><p>A teardown of Weyhro C2, a new command-and-control framework advertised on a cybercrime forum as an &quot;advanced pentesting toolkit.&quot;</p><p><a href="https://malbearlabs.com/posts/weyhro-c2-because-ransomware-wasnt-paying-the-bills-anymore">Read the full write-up on malbearlabs.com →</a></p> Fri, 05 Dec 2025 01:37:12 -0500 https://malbearlabs.com/posts/weyhro-c2-because-ransomware-wasnt-paying-the-bills-anymore https://malbearlabs.com/posts/weyhro-c2-because-ransomware-wasnt-paying-the-bills-anymore Cybersecurity Malware Cybercrime Threat Intelligence <p><a href="https://malbearlabs.com/posts/autopsy-of-a-failed-stealer-stealc-v2"><img src="https://malbearlabs.com/images/medium/autopsy-of-a-failed-stealer-stealc-v2/01.png" alt="Autopsy of a Failed Stealer: StealC v2" /></a></p><p>StealC is one of the well-known stealers written in C++ that has been active since 2022. In April 2025 after the release of the StealC v2 version, the...</p><p><a href="https://malbearlabs.com/posts/autopsy-of-a-failed-stealer-stealc-v2">Read the full write-up on malbearlabs.com →</a></p> Thu, 10 Apr 2025 17:29:33 -0400 https://malbearlabs.com/posts/autopsy-of-a-failed-stealer-stealc-v2 https://malbearlabs.com/posts/autopsy-of-a-failed-stealer-stealc-v2 Reverse Engineering Malware Stealer Cybersecurity <p><a href="https://malbearlabs.com/posts/the-wagmi-manual-copy-paste-and-profit"><img src="https://malbearlabs.com/images/medium/the-wagmi-manual-copy-paste-and-profit/01.png" alt="The Wagmi Manual: Copy, Paste, and Profit" /></a></p><p>First promoted as the “Triple Culture” Team and later rebranded as the Wagmi Team, this traffer group has been operating since at least, early 2023. One...</p><p><a href="https://malbearlabs.com/posts/the-wagmi-manual-copy-paste-and-profit">Read the full write-up on malbearlabs.com →</a></p> Sat, 05 Apr 2025 14:56:43 -0400 https://malbearlabs.com/posts/the-wagmi-manual-copy-paste-and-profit https://malbearlabs.com/posts/the-wagmi-manual-copy-paste-and-profit Cybercrime Scam Crypto Malware <p><a href="https://malbearlabs.com/posts/advancing-through-the-cyberfront-legionloader-commander"><img src="https://malbearlabs.com/images/medium/advancing-through-the-cyberfront-legionloader-commander/01.png" alt="Advancing Through the Cyberfront, LegionLoader Commander" /></a></p><p>LegionLoader is a downloader malware written in C/C++ that first appeared in the wild in 2019. It is also known by other names, including Satacom and...</p><p><a href="https://malbearlabs.com/posts/advancing-through-the-cyberfront-legionloader-commander">Read the full write-up on malbearlabs.com →</a></p> Mon, 30 Dec 2024 13:06:29 -0500 https://malbearlabs.com/posts/advancing-through-the-cyberfront-legionloader-commander https://malbearlabs.com/posts/advancing-through-the-cyberfront-legionloader-commander Reverse Engineering Cybersecurity Malware Analysis Malware <p><a href="https://malbearlabs.com/posts/hearts-stolen-wallets-emptied-insights-into-cryptolove-traffers-team"><img src="https://malbearlabs.com/images/medium/hearts-stolen-wallets-emptied-insights-into-cryptolove-traffers-team/01.png" alt="Hearts Stolen, Wallets Emptied: Insights into CryptoLove Traffer’s Team" /></a></p><p>This blog was written in collaboration with @g0njxa ❤ Together, we will explore the CryptoLove traffer’s team and look into their methods of operation.</p><p><a href="https://malbearlabs.com/posts/hearts-stolen-wallets-emptied-insights-into-cryptolove-traffers-team">Read the full write-up on malbearlabs.com →</a></p> Wed, 27 Nov 2024 17:10:17 -0500 https://malbearlabs.com/posts/hearts-stolen-wallets-emptied-insights-into-cryptolove-traffers-team https://malbearlabs.com/posts/hearts-stolen-wallets-emptied-insights-into-cryptolove-traffers-team Malware Cybercrime Malware Analysis Cybersecurity <p><a href="https://malbearlabs.com/posts/who-ordered-the-smokedham-backdoor-delicacies-in-the-wild"><img src="https://malbearlabs.com/images/medium/who-ordered-the-smokedham-backdoor-delicacies-in-the-wild/01.png" alt="Who Ordered the SMOKEDHAM? Backdoor Delicacies in the Wild" /></a></p><p>The SMOKEDHAM backdoor has been active since 2019 and has been observed being distributed by the threat actor Mandiant identifies as UNC2465. This...</p><p><a href="https://malbearlabs.com/posts/who-ordered-the-smokedham-backdoor-delicacies-in-the-wild">Read the full write-up on malbearlabs.com →</a></p> Fri, 22 Nov 2024 15:42:28 -0500 https://malbearlabs.com/posts/who-ordered-the-smokedham-backdoor-delicacies-in-the-wild https://malbearlabs.com/posts/who-ordered-the-smokedham-backdoor-delicacies-in-the-wild Malware Cybercrime Cybersecurity Malware Analysis <p><a href="https://malbearlabs.com/posts/the-abuse-of-itarian-rmm-by-dolphin-loader"><img src="https://malbearlabs.com/images/DolphinLoader/dolphin_header.jpg" alt="The Abuse of ITarian RMM by Dolphin Loader" /></a></p><p>Looking into the abuse of ITarian RMM and introducing Dolphin Loader</p><p><a href="https://malbearlabs.com/posts/the-abuse-of-itarian-rmm-by-dolphin-loader">Read the full write-up on malbearlabs.com →</a></p> Fri, 16 Aug 2024 00:01:35 -0400 https://malbearlabs.com/posts/the-abuse-of-itarian-rmm-by-dolphin-loader https://malbearlabs.com/posts/the-abuse-of-itarian-rmm-by-dolphin-loader Malware Analysis Loader Dolphin Loader AutoIt <p><a href="https://malbearlabs.com/posts/the-glorysprout-stealer-or-a-failed-clone-of-taurus-stealer"><img src="https://malbearlabs.com/images/GlorySprout/beansprout.jpeg" alt="The GlorySprout or a Failed Clone of Taurus Stealer" /></a></p><p>GlorySprout malware analysis</p><p><a href="https://malbearlabs.com/posts/the-glorysprout-stealer-or-a-failed-clone-of-taurus-stealer">Read the full write-up on malbearlabs.com →</a></p> Sat, 16 Mar 2024 08:01:35 -0400 https://malbearlabs.com/posts/the-glorysprout-stealer-or-a-failed-clone-of-taurus-stealer https://malbearlabs.com/posts/the-glorysprout-stealer-or-a-failed-clone-of-taurus-stealer Malware Analysis Stealer GlorySprout C++ <p><a href="https://malbearlabs.com/posts/atomic-stealer-amos"><img src="https://malbearlabs.com/images/AtomicStealer/atomic-stealer-badass1.JPG" alt="From Russia With Code: Disarming Atomic Stealer" /></a></p><p>Technical Analysis of Atomic Stealer</p><p><a href="https://malbearlabs.com/posts/atomic-stealer-amos">Read the full write-up on malbearlabs.com →</a></p> Mon, 15 Jan 2024 16:02:35 -0500 https://malbearlabs.com/posts/atomic-stealer-amos https://malbearlabs.com/posts/atomic-stealer-amos Malware Analysis Stealer Atomic Stealer macOS Go