Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2026-07-15 ⋅ Expel ⋅ AARON WALTON
Introducing CylindricalCanine: The GoldenEyeDog subgroup responsible for the April DigiCert incident
Ghost RAT
2026-04-22 ⋅ Expel ⋅ Marcus Hutchins
Inside Lazarus: How North Korea uses AI to industrialize attacks on developers
BeaverTail OtterCookie InvisibleFerret HexagonalRodent
2026-01-15 ⋅ Expel ⋅ AARON WALTON
Planned failure: Gootloader’s malformed ZIP actually works perfectly
GootLoader
2025-10-31 ⋅ Expel ⋅ AARON WALTON
Certified OysterLoader: Tracking Rhysida ransomware gang activity via code-signing certificates
Broomstick
2025-09-11 ⋅ Expel ⋅ AARON WALTON, Cert Central
The history of AppSuite: the certs of the BaoLoader developer
BaoLoader
2025-03-18 ⋅ Expel ⋅ AARON WALTON
Code-signing certificate abuse in the Black Basta chat leaks (and how to fight back)
Black Basta Black Basta
2022-08-25 ⋅ Expel ⋅ Andrew Jerry, Kyle Pellett
MORE_EGGS and Some LinkedIn Resumé Spearphishing
More_eggs
2022-04-05 ⋅ Expel ⋅ Brian Bahtiarian, Britton Manahan, David Blanton, Kyle Pellett
Incident report: From CLI to console, chasing an attacker in AWS
2021-11-26 ⋅ Twitter (@jhencinski) ⋅ Jon Hencinski
Twitter Thread on weelky MDR recap from expel.io
GootKit Squirrelwaffle
2021-07-22 ⋅ Expel ⋅ Evan Reichard, Kyle Pellett, Ryan Gott, Tyler Fornes
Incident report: Spotting SocGholish WordPress injection
FAKEUPDATES
2020-12-10 ⋅ Reuters ⋅ Anthony Deutsch, Toby Sterling
Dutch expel two Russian diplomats for suspected espionage