MetaStealer Part 2, Google Cookie Refresher Madness and Stealer Drama
MetaStealer Part 2 Malware Analysis
Pure Logs Stealer Fails to Impress
Pure Logs Stealer malware analysis
MetaStealer - Redline's Doppelgänger
MetaStealer malware analysis
Unleashing the Viper : A Technical Analysis of WhiteSnake Stealer
WhiteSnake Stealer malware analysis
From Russia With Code: Disarming Atomic Stealer
Technical Analysis of Atomic Stealer
The Abuse of ITarian RMM by Dolphin Loader
Looking into the abuse of ITarian RMM and introducing Dolphin Loader
The GlorySprout or a Failed Clone of Taurus Stealer
GlorySprout malware analysis
Meduza Stealer or The Return of The Infamous Aurora Stealer
Meduza Stealer malware analysis
The Wagmi Manual: Copy, Paste, and Profit
First promoted as the “Triple Culture” Team and later rebranded as the Wagmi Team, this traffer group has been operating since at least, early 2023. One...
Shadow HVNC and Shadow Loader: The Kit That Protects Its License Better Than Its Customers
Ransomware gets the headlines because it's loud: it kicks the door wide open, encrypts everything, and leaves a "love" note, and the bill for the week or...
Weyhro C2: Because Ransomware Wasn’t Paying the Bills Anymore
A teardown of Weyhro C2, a new command-and-control framework advertised on a cybercrime forum as an "advanced pentesting toolkit."
The Wagmi Manual: Copy, Paste, and Profit
First promoted as the “Triple Culture” Team and later rebranded as the Wagmi Team, this traffer group has been operating since at least, early 2023. One...
Hearts Stolen, Wallets Emptied: Insights into CryptoLove Traffer’s Team
This blog was written in collaboration with @g0njxa ❤ Together, we will explore the CryptoLove traffer’s team and look into their methods of operation.
Who Ordered the SMOKEDHAM? Backdoor Delicacies in the Wild
The SMOKEDHAM backdoor has been active since 2019 and has been observed being distributed by the threat actor Mandiant identifies as UNC2465. This...
Weyhro C2: Because Ransomware Wasn’t Paying the Bills Anymore
A teardown of Weyhro C2, a new command-and-control framework advertised on a cybercrime forum as an "advanced pentesting toolkit."
Autopsy of a Failed Stealer: StealC v2
StealC is one of the well-known stealers written in C++ that has been active since 2022. In April 2025 after the release of the StealC v2 version, the...
Advancing Through the Cyberfront, LegionLoader Commander
LegionLoader is a downloader malware written in C/C++ that first appeared in the wild in 2019. It is also known by other names, including Satacom and...
Hearts Stolen, Wallets Emptied: Insights into CryptoLove Traffer’s Team
This blog was written in collaboration with @g0njxa ❤ Together, we will explore the CryptoLove traffer’s team and look into their methods of operation.
Who Ordered the SMOKEDHAM? Backdoor Delicacies in the Wild
The SMOKEDHAM backdoor has been active since 2019 and has been observed being distributed by the threat actor Mandiant identifies as UNC2465. This...
The Abuse of ITarian RMM by Dolphin Loader
Looking into the abuse of ITarian RMM and introducing Dolphin Loader
The GlorySprout or a Failed Clone of Taurus Stealer
GlorySprout malware analysis
Shadow HVNC and Shadow Loader: The Kit That Protects Its License Better Than Its Customers
Ransomware gets the headlines because it's loud: it kicks the door wide open, encrypts everything, and leaves a "love" note, and the bill for the week or...
From Russia With Code: Disarming Atomic Stealer
Technical Analysis of Atomic Stealer
The Abuse of ITarian RMM by Dolphin Loader
Looking into the abuse of ITarian RMM and introducing Dolphin Loader
Shadow HVNC and Shadow Loader: The Kit That Protects Its License Better Than Its Customers
Ransomware gets the headlines because it's loud: it kicks the door wide open, encrypts everything, and leaves a "love" note, and the bill for the week or...
Weyhro C2: Because Ransomware Wasn’t Paying the Bills Anymore
A teardown of Weyhro C2, a new command-and-control framework advertised on a cybercrime forum as an "advanced pentesting toolkit."
Autopsy of a Failed Stealer: StealC v2
StealC is one of the well-known stealers written in C++ that has been active since 2022. In April 2025 after the release of the StealC v2 version, the...
The Wagmi Manual: Copy, Paste, and Profit
First promoted as the “Triple Culture” Team and later rebranded as the Wagmi Team, this traffer group has been operating since at least, early 2023. One...
Advancing Through the Cyberfront, LegionLoader Commander
LegionLoader is a downloader malware written in C/C++ that first appeared in the wild in 2019. It is also known by other names, including Satacom and...
Hearts Stolen, Wallets Emptied: Insights into CryptoLove Traffer’s Team
This blog was written in collaboration with @g0njxa ❤ Together, we will explore the CryptoLove traffer’s team and look into their methods of operation.
Who Ordered the SMOKEDHAM? Backdoor Delicacies in the Wild
The SMOKEDHAM backdoor has been active since 2019 and has been observed being distributed by the threat actor Mandiant identifies as UNC2465. This...
Shadow HVNC and Shadow Loader: The Kit That Protects Its License Better Than Its Customers
Ransomware gets the headlines because it's loud: it kicks the door wide open, encrypts everything, and leaves a "love" note, and the bill for the week or...
Advancing Through the Cyberfront, LegionLoader Commander
LegionLoader is a downloader malware written in C/C++ that first appeared in the wild in 2019. It is also known by other names, including Satacom and...
Hearts Stolen, Wallets Emptied: Insights into CryptoLove Traffer’s Team
This blog was written in collaboration with @g0njxa ❤ Together, we will explore the CryptoLove traffer’s team and look into their methods of operation.
Who Ordered the SMOKEDHAM? Backdoor Delicacies in the Wild
The SMOKEDHAM backdoor has been active since 2019 and has been observed being distributed by the threat actor Mandiant identifies as UNC2465. This...
The Abuse of ITarian RMM by Dolphin Loader
Looking into the abuse of ITarian RMM and introducing Dolphin Loader
The GlorySprout or a Failed Clone of Taurus Stealer
GlorySprout malware analysis
From Russia With Code: Disarming Atomic Stealer
Technical Analysis of Atomic Stealer
MetaStealer Part 2, Google Cookie Refresher Madness and Stealer Drama
MetaStealer Part 2 Malware Analysis
Pure Logs Stealer Fails to Impress
Pure Logs Stealer malware analysis
MetaStealer - Redline's Doppelgänger
MetaStealer malware analysis
Unleashing the Viper : A Technical Analysis of WhiteSnake Stealer
WhiteSnake Stealer malware analysis
Meduza Stealer or The Return of The Infamous Aurora Stealer
Meduza Stealer malware analysis
Meduza Stealer or The Return of The Infamous Aurora Stealer
Meduza Stealer malware analysis
MetaStealer Part 2, Google Cookie Refresher Madness and Stealer Drama
MetaStealer Part 2 Malware Analysis
MetaStealer - Redline's Doppelgänger
MetaStealer malware analysis
Pure Logs Stealer Fails to Impress
Pure Logs Stealer malware analysis
Autopsy of a Failed Stealer: StealC v2
StealC is one of the well-known stealers written in C++ that has been active since 2022. In April 2025 after the release of the StealC v2 version, the...
Advancing Through the Cyberfront, LegionLoader Commander
LegionLoader is a downloader malware written in C/C++ that first appeared in the wild in 2019. It is also known by other names, including Satacom and...
The Wagmi Manual: Copy, Paste, and Profit
First promoted as the “Triple Culture” Team and later rebranded as the Wagmi Team, this traffer group has been operating since at least, early 2023. One...
Autopsy of a Failed Stealer: StealC v2
StealC is one of the well-known stealers written in C++ that has been active since 2022. In April 2025 after the release of the StealC v2 version, the...
The GlorySprout or a Failed Clone of Taurus Stealer
GlorySprout malware analysis
From Russia With Code: Disarming Atomic Stealer
Technical Analysis of Atomic Stealer
MetaStealer Part 2, Google Cookie Refresher Madness and Stealer Drama
MetaStealer Part 2 Malware Analysis
Pure Logs Stealer Fails to Impress
Pure Logs Stealer malware analysis
MetaStealer - Redline's Doppelgänger
MetaStealer malware analysis
Unleashing the Viper : A Technical Analysis of WhiteSnake Stealer
WhiteSnake Stealer malware analysis
Meduza Stealer or The Return of The Infamous Aurora Stealer
Meduza Stealer malware analysis
Shadow HVNC and Shadow Loader: The Kit That Protects Its License Better Than Its Customers
Ransomware gets the headlines because it's loud: it kicks the door wide open, encrypts everything, and leaves a "love" note, and the bill for the week or...
Weyhro C2: Because Ransomware Wasn’t Paying the Bills Anymore
A teardown of Weyhro C2, a new command-and-control framework advertised on a cybercrime forum as an "advanced pentesting toolkit."
Unleashing the Viper : A Technical Analysis of WhiteSnake Stealer
WhiteSnake Stealer malware analysis
From Russia With Code: Disarming Atomic Stealer
Technical Analysis of Atomic Stealer