Malware

Kimsuky's Phishing and Payload Tactics

Main area: Threat Intel · 18-page PDF · 3,376 words · 17 min read

My 2024 Rapid7 research with Natalie Zargarov and Anna Širokova on Kimsuky’s social engineering, delivery methods and payloads.

• Threat Intel
• Kimsuky
• Phishing
• Malware

Report at Rapid7 (PDF) ↗ (opens in a new tab) · Read illustrated overview

How To Hunt For UEFI Malware

Main area: Threat Hunting · 1,403 words · 7 min read

UEFI malware hunting with Velociraptor, including firmware visibility, collection approaches, and artifacts for field investigation.

• DFIR
• Velociraptor
• Malware
• Threat Hunting

Published at Rapid7 ↗ (opens in a new tab)

Automating Qakbot decode at scale

Main area: Malware Analysis · 1,237 words · 6 min read

Extract Qakbot configuration data and automate decoding at scale with Velociraptor. Covers payload unpacking, decryption and campaign indicators.

• Malware
• Velociraptor
• DFIR