Click here to download all references as Bib-File.•
| 2025-10-21
⋅
HarfangLab
⋅
RudePanda owns IIS servers like it's 2003 TOLLBOOTH |
| 2025-08-20
⋅
HarfangLab
⋅
UAC-0057 keeps applying pressure on Ukraine and Poland PicassoLoader |
| 2025-06-16
⋅
HarfangLab
⋅
SadFuture: Mapping XDSpy latest evolution XDSpy |
| 2025-04-16
⋅
HarfangLab
⋅
Inside Gamaredon’s PteroLNK: Dead Drop Resolvers and evasive Infrastructure Pteranodon |
| 2025-02-10
⋅
HarfangLab
⋅
Further insights into Ivanti CSA 4.6 vulnerabilities exploitation Godzilla Webshell Behinder |
| 2024-10-11
⋅
HarfangLab
⋅
HijackLoader evolution: abusing genuine signing certificates HijackLoader |
| 2024-09-04
⋅
HarfangLab
⋅
Unpacking the unpleasant FIN7 gift: PackXOR r77 xmrig |
| 2024-08-14
⋅
HarfangLab
⋅
Cyclops: a likely replacement for BellaCiao BellaCiao Cyclops |
| 2024-07-25
⋅
HarfangLab
⋅
Mid-year Doppelgänger information operations in Europe and the US |
| 2024-06-28
⋅
HarfangLab
⋅
Supposed Grasshopper: operators impersonate Israeli government and private companies to deploy open-source malware donut_injector Sliver |
| 2024-05-28
⋅
HarfangLab
⋅
AllaSenha: AllaKore variant leverages Azure cloud C2 to steal banking details in Latin America AllaKore AllaSenha |
| 2024-04-22
⋅
HarfangLab
⋅
MuddyWater campaign abusing Atera Agents |
| 2024-04-16
⋅
HarfangLab
⋅
Analysis of the APT31 Indictment RAWDOOR APT31 |
| 2024-04-03
⋅
HarfangLab
⋅
Raspberry Robin and its new anti-emulation trick Raspberry Robin |
| 2024-03-01
⋅
HarfangLab
⋅
A Comprehensive Analysis of i-SOON’s Commercial Offering ShadowPad Winnti |
| 2024-01-29
⋅
HarfangLab
⋅
Compromised Routers Are Still Leveraged as Malicious Infrastructure to Target Government Organizations in Europe and the Caucasus MASEPIE OCEANMAP |
| 2024-01-15
⋅
HarfangLab
⋅
An Introduction to Reverse Engineering .NET AOT Applications DUCKTAIL |
| 2023-09-28
⋅
HarfangLab
⋅
Loader Galore - TaskLoader at the start of a Pay-per-Install Infection Chain CustomerLoader Fabookie LgoogLoader SmokeLoader |