The Curious Engineer

All blogs / Security

SentinelLABS

sentinelone.com/labs

Get the Latest Cybersecurity Research, Threat Intelligence, and AI Security Insights from SentinelLABS.

SecurityReverse engineeringAI / ML

’19’20’21’22’23’24’25’26
Posts
278 from 25 Apr 2019 to 28 Oct 2026
Posting
weekly (29 in the last year)
Kind
company blog
Feed
https://www.sentinelone.com/labs/feed/

2026 24

  1. LABScon26 Replay | Keynote: A Sober Analysis of AI Impact
  2. Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
  3. Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face
  4. The Model Is the Malware | What Four Agentic Intrusions Tell Defenders
  5. Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis?
  6. Iran War Cyber Threat Landscape | A Midyear Assessment on What Matters
  7. One Target, Two Flags | Rival Espionage Actors Converge On Pakistani Law Enforcement | SentinelOne
  8. Context Engineering | Compaction & Agent Memory for Automated Malware Analysis
  9. macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox
  10. LABScon25 Replay | Keynote: Steps to an Ecology of Cyber
  11. LABScon25 Replay | Gamaredon x Turla: Unveiling a 2025 Espionage Alliance Targeting Ukraine
  12. LABScon25 Replay | Breach Alpha: Trading on Cyber Fallout
  13. PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale | SentinelOne
  14. LABScon25 Replay | Please Connect to the Foreign Entity to Enhance Your User Experience | SentinelOne
  15. fast16 | Mystery Shadow Brokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet | SentinelOne
  16. LABScon25 Replay | Are Your Chinese Cameras Spying For You Or On You? | SentinelOne
  17. Building an Adversarial Consensus Engine | Multi-Agent LLMs for Automated Malware Analysis | SentinelOne
  18. LABScon25 Replay | Your Apps May Be Gone, But the Hackers Made $9 Billion and They’re Still Here | SentinelOne
  19. From Narrative to Knowledge Graph | LLM-Driven Information Extraction in Cyber Threat Intelligence | SentinelOne
  20. Silent Brothers | Ollama Hosts Form Anonymous AI Network Beyond Platform Guardrails | SentinelOne
  21. LABScon25 Replay | How to Bug Hotel Rooms v2.0 | SentinelOne
  22. LLMs in the SOC (Part 1) | Why Benchmarks Fail Security Operations Teams | SentinelOne
  23. LABScon25 Replay | Hacktivism and War: A Clarifying Discussion | SentinelOne
  24. Inside the LLM | Understanding AI & the Mechanics of Modern Attacks | SentinelOne

2025 26

  1. LLMs & Ransomware | An Operational Accelerator, Not a Revolution | SentinelOne
  2. Malicious Apprentice | How Two Hackers Went From Cisco Academy to Cisco CVEs | SentinelOne
  3. LABScon25 Replay | Simulation Meets Reality: How China’s Cyber Ranges Fuel Cyber Operations | SentinelOne
  4. Threat Hunting Power Up | Enhance Campaign Discovery With Validin and Synapse | SentinelOne
  5. LABScon25 Replay | LLM-Enabled Malware In the Wild | SentinelOne
  6. PhantomCaptcha | Multi-Stage WebSocket RAT Targets Ukraine in Single-Day Spearphishing Operation | SentinelOne
  7. LABScon25 Replay | Auto-Poking The Bear: Analytical Tradecraft In The AI Age | SentinelOne
  8. Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware | SentinelOne
  9. Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms | SentinelOne
  10. Smart Contract Scams | Ethereum Drainers Pose as Trading Bots to Steal Crypto | SentinelOne
  11. Ghost in the Zip | New PXA Stealer and Its Telegram-Powered Ecosystem | SentinelOne
  12. China’s Covert Capabilities | Silk Spun From Hafnium | SentinelOne
  13. macOS NimDoor | DPRK Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware | SentinelOne
  14. Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets | SentinelOne
  15. FreeDrain Unmasked | Uncovering an Industrial-Scale Crypto Theft Network | SentinelOne
  16. Top Tier Target | What It Takes to Defend a Cybersecurity Company from Today’s Adversaries | SentinelOne
  17. AkiraBot | AI-Powered Bot Bypasses CAPTCHAs, Spams Websites At Scale | SentinelOne
  18. LABScon24 Replay | A Walking Red Flag (With Yellow Stars) | SentinelOne
  19. LABScon24 Replay | Kryptina RaaS: From Unsellable Cast-off to Enterprise Ransomware | SentinelOne
  20. LABScon24 Replay | Resilience and Protection in the Windows Ecosystem | SentinelOne
  21. LABScon24 Replay | Farmyard Gossip: The Foreign Footprint in US Agriculture | SentinelOne
  22. Ghostwriter | New Campaign Targets Ukrainian Government and Belarusian Opposition | SentinelOne
  23. Censorship as a Service | Leak Reveals Public-Private Collaboration to Monitor Chinese Cyberspace | SentinelOne
  24. X Phishing | Campaign Targeting High Profile Accounts Returns, Promoting Crypto Scams | SentinelOne
  25. LABScon24 Replay | Follow the Money: Uncovering the Incorporation and the CCP’s Ownership of Chinese Firms Investing in the USA | SentinelOne
  26. LABScon24 Replay | The Real AI Race: Disinformation in the Taiwanese Election | SentinelOne

2024 31

  1. LABScon24 Replay | The Ransomware Trust Paradox | SentinelOne
  2. LABScon24 Replay | Let Them Eat Cake: “Secure by Upgrade” Software is a National Security Threat | SentinelOne
  3. Operation Digital Eye | Chinese APT Compromises Critical Digital Infrastructure via Visual Studio Code Tunnels | SentinelOne
  4. LABScon24 Replay | PKfail: Supply-Chain Failures in Secure Boot Key Management | SentinelOne
  5. LABScon24 Replay | A 30-Year Journey from Compilation Student to Decompilation Pioneer | SentinelOne
  6. CyberVolk | A Deep Dive into the Hacktivists, Tools and Ransomware Fueling Pro-Russian Cyber Attacks | SentinelOne
  7. DPRK IT Workers | A Network of Active Front Companies and Their Links to China | SentinelOne
  8. BlueNoroff Hidden Risk | Threat Actor Targets Macs with Fake Crypto News and Novel Persistence | SentinelOne
  9. Cloud Malware | A Threat Hunter’s Guide to Analysis, Techniques and Delivery | SentinelOne
  10. China’s Influence Ops | Twisting Tales of Volt Typhoon at Home and Abroad | SentinelOne
  11. Kryptina RaaS | From Unsellable Cast-Off to Enterprise Ransomware | SentinelOne
  12. LABScon23 Replay | They Spilled Oil in My Health-Boosting Smoothie | SentinelOne
  13. Exploring the VirusTotal Dataset | An Analyst’s Guide to Effective Threat Research | SentinelOne
  14. LABScon23 Replay | Black Magic – Influence Operations in the Open and At-Scale in Hungary | SentinelOne
  15. Xeon Sender | SMS Spam Shipping Multi-Tool Targeting SaaS Credentials | SentinelOne
  16. FIN7 Reboot | Cybercrime Gang Enhances Ops with New EDR Bypasses and Automated Attacks | SentinelOne
  17. NullBulge | Threat Actor Masquerades as Hacktivist Group Rebelling Against AI | SentinelOne
  18. CapraTube Remix | Transparent Tribe’s Android Spyware Targeting Gamers, Weapons Enthusiasts | SentinelOne
  19. ChamelGang & Friends | Cyberespionage Groups Attacking Critical Infrastructure with Ransomware | SentinelOne
  20. LABScon23 Replay | macOS Components Used in North Korean Crypto-Heists | SentinelOne
  21. LABScon23 Replay | From Vulkan to Ryazan – Investigative Reporting from the Frontlines of Infosec | SentinelOne
  22. LABScon23 Replay | Meet the Iranian Company Powering Russia’s Drone War on Ukraine | SentinelOne
  23. AcidPour | New Embedded Wiper Variant of AcidRain Appears in Ukraine | SentinelOne
  24. Doppelgänger | Russia-Aligned Influence Operation Targets Germany | SentinelOne
  25. Unmasking I-Soon | The Leak That Revealed China’s Cyber Operations | SentinelOne
  26. LABScon Replay | Chasing Shadows | The Rise of a Prolific Espionage Actor | SentinelOne
  27. SNS Sender | Active Campaigns Unleash Messaging Spam Through the Cloud | SentinelOne
  28. China’s Cyber Revenge | Why the PRC Fails to Back Its Claims of Western Espionage | SentinelOne
  29. ScarCruft | Attackers Gather Strategic Intelligence and Target Cybersecurity Professionals | SentinelOne
  30. LABScon Replay | Send Lawyers, ‘Garchs, and Money | SentinelOne
  31. Exploring FBot | Python-Based Malware Targeting Cloud and Payment Services | SentinelOne

2023 43

  1. LABScon Replay | Spectre Strikes Again: Introducing the Firmware Edition | SentinelOne
  2. LABSCon Replay | Intellexa and Cytrox: From Fixer-Upper to Intel Agency Grade Spyware | SentinelOne
  3. Gaza Cybergang | Unified Front Targeting Hamas Opposition | SentinelOne
  4. Sandman APT | China-Based Adversaries Embrace Lua | SentinelOne
  5. LABScon Replay | The Cyber Arm of China’s Soft Power: Reshaping a Continent | SentinelOne
  6. Decoding the Past, Securing the Future | Enhancing Cyber Defense with Historical Threat Intelligence | SentinelOne
  7. Elephant Hunting | Inside an Indian Hack-For-Hire Group | SentinelOne
  8. Predator AI | ChatGPT-Powered Infostealer Takes Aim at Cloud Platforms | SentinelOne
  9. Arid Viper | APT’s Nest of SpyC23 Malware Continues to Target Android Devices | SentinelOne
  10. 11 Ways to Tweak radare2 for Faster and Easier macOS Malware Analysis | SentinelOne
  11. The Israel-Hamas War | Cyber Domain State-Sponsored Activity of Interest | SentinelOne
  12. Sandman APT | A Mystery Group Targeting Telcos with a LuaJIT Toolkit | SentinelOne
  13. Cyber Soft Power | China’s Continental Takeover | SentinelOne
  14. CapraTube | Transparent Tribe’s CapraRAT Mimics YouTube to Hijack Android Phones | SentinelOne
  15. Bloated Binaries | How to Detect and Analyze Large macOS Malware Files | SentinelOne
  16. Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector | SentinelOne
  17. Comrades in Arms? | North Korea Compromises Sanctioned Russian Missile Engineering Company | SentinelOne
  18. JumpCloud Intrusion | Attacker Infrastructure Links Compromise to North Korean APT Activity | SentinelOne
  19. Cloudy With a Chance of Credentials | AWS-Targeting Cred Stealer Expands to Azure, GCP | SentinelOne
  20. LABScon Replay | Quiver – Using Cutting Edge ML to Detect Interesting Command Lines for Hunters | SentinelOne
  21. Automating String Decryption and Other Reverse Engineering Tasks in radare2 With r2pipe | SentinelOne
  22. LABScon Replay | Star-Gazing: Using a Full Galaxy of YARA Methods to Pursue an Apex Actor | SentinelOne
  23. Kimsuky Strikes Again | New Social Engineering Campaign Aims to Steal Credentials and Gather Strategic Intelligence | SentinelOne
  24. Radare2 Power Ups | Delivering Faster macOS Malware Analysis With r2 Customization | SentinelOne
  25. Operation Magalenha | Long-Running Campaign Pursues Portuguese Credentials and PII | SentinelOne
  26. Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit | SentinelOne
  27. LABScon Replay | Does This Look Infected 2 (APT41) | SentinelOne
  28. LABScon Replay | Malshare: 10 Years of Running a Public Malware Repository | SentinelOne
  29. Hypervisor Ransomware | Multiple Threat Actor Groups Hop on Leaked Babuk Code to Build ESXi Lockers | SentinelOne
  30. Kimsuky Evolves Reconnaissance Capabilities in New Global Campaign | SentinelOne
  31. Transparent Tribe (APT36) | Pakistan-Aligned Threat Actor Expands Interest in Indian Education Sector | SentinelOne
  32. Dissecting AlienFox | The Cloud Spammer’s Swiss Army Knife | SentinelOne
  33. The Life and Times of SysInternals | How One Developer Changed the Face of Malware Analysis | SentinelOne
  34. Operation Tainted Love | Chinese APTs Target Telcos in New Attacks | SentinelOne
  35. Winter Vivern | Uncovering a Wave of Global Espionage | SentinelOne
  36. IceFire Ransomware Returns | Now Targeting Linux Enterprise Networks | SentinelOne
  37. WIP26 Espionage | Threat Actors Abuse Cloud Infrastructure in Targeted Telco Attacks | SentinelOne
  38. Cl0p Ransomware Targets Linux Systems with Flawed Encryption | Decryptor Available | SentinelOne
  39. MalVirt | .NET Virtualization Thrives in Malvertising Attacks | SentinelOne
  40. DragonSpark | Attacks Evade Detection with SparkRAT and Golang Source Code Interpretation | SentinelOne
  41. NoName057(16) – The Pro-Russian Hacktivist Group Targeting NATO | SentinelOne
  42. LABScon Replay | Blasting Event-Driven Cornucopia: WMI-based User-Space Attacks Blind SIEMs and EDRs | SentinelOne
  43. LABScon Replay | InkySquid: The Missing Arsenal | SentinelOne

2022 44

  1. LABScon Replay: Exploits in Early Boot Phases (Pre-EFI)
  2. Custom-Branded Ransomware: The Vice Society Group and the Threat of Outsourced Development | SentinelOne
  3. 11 Problems ChatGPT Can Solve For Reverse Engineers and Malware Analysts | SentinelOne
  4. LABScon Replay | Is CNVD ≥ CVE? A Look at Chinese Vulnerability Discovery and Disclosure | SentinelOne
  5. Driving Through Defenses | Targeted Attacks Leverage Signed Malicious Microsoft Drivers | SentinelOne
  6. The Mystery of Metador | Unpicking Mafalda’s Anti-Analysis Techniques | SentinelOne
  7. LABScon Replay | The Mystery of Metador | SentinelOne
  8. Unveiling Satellite Communication Threats - LABScon Replay
  9. LABScon Replay | Are Digital Technologies Eroding the Principle of Distinction in War? | SentinelOne
  10. SocGholish Diversifies and Expands Its Malware Staging Infrastructure to Counter Defenders | SentinelOne
  11. Black Basta Ransomware | Attacks Deploy Custom EDR Evasion Tools Tied to FIN7 Threat Actor | SentinelOne
  12. WIP19 Espionage | New Chinese APT Targets IT Service Providers and Telcos With Signed Malware | SentinelOne
  13. Void Balaur | The Sprawling Infrastructure of a Careless Mercenary | SentinelOne
  14. The Metador Enigma: Unveiling an Unattributed Threat
  15. Crimeware Trends | Ransomware Developers Turn to Intermittent Encryption to Evade Detection | SentinelOne
  16. PyPI Phishing Campaign | JuiceLedger Threat Actor Pivots From Fake Apps to Supply Chain Attacks | SentinelOne
  17. Who Needs Macros? | Threat Actors Pivot to Abusing Explorer and Other LOLBins via Windows Shortcuts | SentinelOne
  18. LockBit 3.0 Update | Unpicking the Ransomware’s Latest Anti-Analysis and Evasion Techniques | SentinelOne
  19. Inside Malicious Windows Apps for Malware Deployment | SentinelOne
  20. Targets of Interest | Russian Organizations Increasingly Under Attack By Chinese APTs | SentinelOne
  21. Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years | SentinelOne
  22. Use of Obfuscated Beacons in ‘pymafka’ Supply Chain Attack Signals a New Trend in macOS Attack TTPs | SentinelOne
  23. CrateDepression | Rust Supply-Chain Attack Infects Cloud CI Pipelines with Go Malware | SentinelOne
  24. Putting Things in Context | Timelining Threat Campaigns | SentinelOne
  25. Vulnerabilities in Avast And AVG Put Millions At Risk | SentinelOne
  26. Moshen Dragon’s Triad-and-Error Approach | Abusing Security Software to Sideload PlugX and ShadowPad | SentinelOne
  27. LockBit Ransomware Side-loads Cobalt Strike Beacon with Legitimate VMware Utility | SentinelOne
  28. Nokoyawa Ransomware | New Karma/Nemty Variant Wears Thin Disguise | SentinelOne
  29. Inside the Black Box | How We Fuzzed Microsoft Defender for IoT and Found Multiple Vulnerabilities | SentinelOne
  30. AcidRain | A Modem Wiper Rains Down on Europe | SentinelOne
  31. IoT Security Exposed: Unveiling Azure Defender Flaws
  32. Chinese Threat Actor Scarab Targeting Ukraine | SentinelOne
  33. The Art and Science of macOS Malware Hunting with radare2 | Leveraging Xrefs, YARA and Zignatures | SentinelOne
  34. Another Brick in the Wall: Uncovering SMM Vulnerabilities in HP Firmware | SentinelOne
  35. Zen and the Art of SMM Bug Hunting | Finding, Mitigating and Detecting UEFI Vulnerabilities | SentinelOne
  36. HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine | SentinelOne
  37. Sanctions Be Damned | From Dridex to Macaw, The Evolution of Evil Corp | SentinelOne
  38. Log4j2 In The Wild | Iranian-Aligned Threat Actor “TunnelVision” Actively Exploiting VMware Horizon | SentinelOne
  39. ModifiedElephant APT and a Decade of Fabricating Evidence | SentinelOne
  40. Firefox JIT Use-After-Frees | Exploiting CVE-2020-26950 | SentinelOne
  41. BlackCat Ransomware | Highly-Configurable, Rust-Driven RaaS On The Prowl For Victims | SentinelOne
  42. Wading Through Muddy Waters | Recent Activity of an Iranian State-Sponsored Threat Actor | SentinelOne
  43. CVE-2021-45608 | NetUSB RCE Flaw in Millions of End User Routers | SentinelOne
  44. A Threat Hunter’s Guide to the Mac’s Most Prevalent Adware Infections 2022 | SentinelOne

2021 45

  1. New Rook Ransomware Feeds Off the Code of Babuk | SentinelOne
  2. USB Over Ethernet | Multiple Vulnerabilities in AWS and Other Major Cloud Services | SentinelOne
  3. GSOh No! Hunting for Vulnerabilities in VirtualBox Network Offloads | SentinelOne
  4. Infect If Needed | A Deeper Dive Into Targeted Backdoor macOS.Macma | SentinelOne
  5. CVE-2021-43267: Remote Linux Kernel Heap Overflow | TIPC Module Allows Arbitrary Code Execution | SentinelOne
  6. Spook Ransomware | Prometheus Derivative Names Those That Pay, Shames Those That Don’t | SentinelOne
  7. AlphaGolang | A Step-by-Step Go Malware Reversing Methodology for IDA Pro | SentinelOne
  8. Karma Ransomware | An Emerging Threat With A Hint of Nemty Pedigree | SentinelOne
  9. Techniques for String Decryption in macOS Malware with Radare2 | SentinelOne
  10. New Version Of Apostle Ransomware Reemerges In Targeted Attack On Higher Education | SentinelOne
  11. Defeating macOS Malware Anti-Analysis Tricks with Radare2 | SentinelOne
  12. CVE-2021-3437 | HP OMEN Gaming Hub Privilege Escalation Bug Hits Millions of Gaming Devices | SentinelOne
  13. Hide and Seek | New Zloader Infection Chain Comes With Improved Stealth and Evasion Mechanisms | SentinelOne
  14. EGoManiac | An Unscrupulous Turkish-Nexus Threat Actor | SentinelOne
  15. 6 Pro Tricks for Rapid macOS Malware Triage with Radare2 - SentinelLabs
  16. Hive Attacks | Analysis of the Human-Operated Ransomware Targeting Healthcare - SentinelLabs
  17. ShadowPad | A Masterpiece of Privately Sold Malware in Chinese Espionage - SentinelLabs
  18. Massive New AdLoad Campaign Goes Entirely Undetected By Apple's XProtect - SentinelLabs
  19. Hotcobalt - New Cobalt Strike DoS Vulnerability That Lets You Halt Operations - SentinelLabs
  20. MeteorExpress | Mysterious Wiper Paralyzes Iranian Trains with Epic Troll - SentinelLABS
  21. CVE-2021-3438: 16 Years In Hiding - Millions of Printers Worldwide Vulnerable - SentinelLabs
  22. Conti Unpacked | Understanding Ransomware Development As a Response to Detection - SentinelLabs
  23. Bypassing macOS TCC User Privacy Protections By Accident and Design - SentinelLabs
  24. Evasive Maneuvers | Massive IcedID Campaign Aims For Stealth with Benign Macros - SentinelLabs
  25. Gootloader: ‘Initial Access as a Service’ Platform Expands Its Search for High Value Targets - SentinelLabs
  26. ThunderCats Hack the FSB | Your Taxes Didn’t Pay For This Op - SentinelLabs
  27. NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks - SentinelLabs
  28. From Wiper to Ransomware | The Evolution of Agrius - SentinelLabs
  29. Caught in the Cloud | How a Monero Cryptominer Exploits Docker Containers - SentinelLabs
  30. CVE-2021-21551- Hundreds Of Millions Of Dell Computers At Risk Due to Multiple BIOS Driver Privilege Escalation Flaws - SentinelLabs
  31. Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol - SentinelLabs
  32. A Deep Dive into Zebrocy’s Dropper Docs - SentinelLabs
  33. Adventures From UEFI Land: the Hunt For the S3 Boot Script - SentinelLabs
  34. Avaddon RaaS | Breaks Public Decryptor, Continues On Rampage - SentinelLabs
  35. Keep Malware Off Your Disk With SentinelOne's IDA Pro Memory Loader Plugin - SentinelLabs
  36. New macOS Malware XcodeSpy Targets Xcode Developers with EggShell Backdoor - SentinelLabs
  37. Top 15 Essential Malware Analysis Tools - SentinelLabs
  38. HelloKitty Ransomware Lacks Stealth, But Still Strikes Home - SentinelLabs
  39. A Guide to Ghidra Scripting Development for Malware Researchers - SentinelLabs
  40. 20 Common Tools & Techniques Used by macOS Threat Actors & Malware - SentinelLabs
  41. CVE-2021-24092: 12 Years in Hiding - A Privilege Escalation Vulnerability in Windows Defender - SentinelLabs
  42. Zeoticus 2.0 | Ransomware With No C2 Required - SentinelLabs
  43. FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts - SentinelLabs
  44. Greyware’s Anatomy: The “Potentially Unwanted” are Upping Their Game - SentinelLabs
  45. Building a Custom Malware Analysis Lab Environment - SentinelLabs

2020 44

  1. SolarWinds | Understanding & Detecting the SUPERNOVA Webshell Trojan - SentinelLabs
  2. SolarWinds SUNBURST Backdoor: Inside the APT Campaign - SentinelLabs
  3. Introducing SentinelOne's Ghidra Plugin for VirusTotal - SentinelLabs
  4. APT32 Multi-stage macOS Trojan Innovates on Crimeware Scripting Technique - SentinelLabs
  5. Egregor RaaS Continues the Chaos with Cobalt Strike and Rclone - SentinelLabs
  6. Ranzy Ransomware | Better Encryption Among New Features of ThunderX Derivative - SentinelLabs
  7. Resourceful macOS Malware Hides in Named Fork - SentinelLabs
  8. Moving From Dynamic Emulation of UEFI Modules To Coverage-Guided Fuzzing of UEFI Firmware - SentinelLabs
  9. Anchor Project for Trickbot Adds ICMP - SentinelLabs
  10. Misusing msvsmon and the Windows Remote Debugger - SentinelLabs
  11. An Inside Look at How Ryuk Evolved Its Encryption and Evasion Techniques - SentinelLabs
  12. Purple Fox EK | New CVEs, Steganography, and Virtualization Added to Attack Flow - SentinelLabs
  13. Leveraging LD_AUDIT to Beat the Traditional Linux Library Preloading Technique - SentinelLabs
  14. Moving From Manual Reverse Engineering of UEFI Modules To Dynamic Emulation of UEFI Firmware - SentinelLabs
  15. The FONIX RaaS | New Low-Key Threat with Unnecessary Complexities - SentinelLabs
  16. Threat Intel | Cyber Attacks Leveraging the COVID-19/CoronaVirus Pandemic - SentinelLabs
  17. Multi-Platform SMAUG RaaS Aims To See Off Competitors - SentinelLabs
  18. Case Study: Why You Shouldn’t Trust NTDLL from Kernel Image Load Callbacks - SentinelLabs
  19. Case Study: Catching a Human-Operated Maze Ransomware Attack In Action - SentinelLabs
  20. Agent Tesla | Old RAT Uses New Tricks to Stay on Top - SentinelLabs
  21. Hacking Smart Devices for Fun and Profit - SentinelLabs
  22. Moving From Common-Sense Knowledge About UEFI To Actually Dumping UEFI Firmware - SentinelLabs
  23. WastedLocker Ransomware: Abusing ADS and NTFS File Attributes - SentinelLabs
  24. Enter the Maze: Demystifying an Affiliate Involved in Maze (SNOW) - SentinelLabs
  25. Breaking EvilQuest | Reversing A Custom macOS Ransomware File Encryption Routine - SentinelLabs
  26. Living Off Windows Land - A New Native File "downldr" - SentinelLabs
  27. Thanos Ransomware | RIPlace, Bootlocker and More Added to Feature Set - SentinelLabs
  28. Inside a TrickBot Cobalt Strike Attack Server - SentinelLabs
  29. A Click from the Backyard | Analysis of CVE-2020-9332, a Vulnerable USB Redirection Software - SentinelLabs
  30. Valak Malware and the Connection to Gozi Loader ConfCrew - SentinelLabs
  31. NetWalker Ransomware: No Respite, No English Required - SentinelLabs
  32. Sarwent Malware Continues to Evolve With Updated Command Functions - SentinelLabs
  33. Deep Dive Into TrickBot Executor Module "mexec": Reversing the Dropper Variant - SentinelLabs
  34. The Anatomy of an APT Attack and CobaltStrike Beacon’s Encoded Configuration - SentinelLabs
  35. Meet NEMTY Successor, Nefilim/Nephilim Ransomware - SentinelLabs
  36. IcedID Botnet | The Iceman Goes Phishing for US Tax Returns - SentinelLabs
  37. Maze Ransomware Update: Extorting and Exposing Victims - SentinelLabs
  38. Deep Dive Into TrickBot Executor Module "mexec": Hidden "Anchor" Bot Nexus Operations - SentinelLabs
  39. Breaking TA505's Crypter with an SMT Solver - SentinelLabs
  40. Revealing the Trick | A Deep Dive into TrickLoader Obfuscation - SentinelLabs
  41. DPRK Hidden Cobra Update: North Korean Malicious Cyber Activity - SentinelLabs
  42. Pro-Russian CyberSpy Gamaredon Intensifies Ukrainian Security Targeting - SentinelLabs
  43. New Snake Ransomware Adds Itself to the Increasing Collection of Golang Crimeware - SentinelLabs
  44. Top-Tier Russian Organized Cybercrime Group Unveils Fileless Stealthy “PowerTrick” Backdoor for High-Value Targets - SentinelLabs

2019 21

  1. Anchor Project | The Deadly Planeswalker: How The TrickBot Group United High-Tech Crimeware & APT - SentinelLabs
  2. Privilege Escalation | macOS Malware & The Path to Root Part 1 - SentinelLabs
  3. How AdLoad macOS Malware Continues to Adapt & Evade - SentinelLabs
  4. How TrickBot Malware Hooking Engine Targets Windows 10 Browsers - SentinelLabs
  5. Writing Malware Traffic Decrypters for ISFB/Ursnif - SentinelLabs
  6. Writing Malware Configuration Extractors for ISFB/Ursnif - SentinelLabs
  7. Deep Insight into “FIN7” Malware Chain: From Office Macro Malware to Lightweight JS Loader - SentinelLabs
  8. Info Stealers | How Malware Hacks Private User Data - SentinelLabs
  9. Detecting macOS.GMERA Malware Through Behavioral Inspection - SentinelLabs
  10. Trickbot Update: Brief Analysis of a Recent Trickbot Payload - SentinelLabs
  11. FIN6 “FrameworkPOS”: Point-of-Sale Malware Analysis & Internals - SentinelLabs
  12. RIG Exploit Kit Chain Internals - SentinelLabs
  13. Gootkit Banking Trojan | Part 3: Retrieving the Final Payload - SentinelLabs
  14. macOS Incident Response | Part 3: System Manipulation - SentinelLabs
  15. Gootkit Banking Trojan | Part 2: Persistence & Other Capabilities - SentinelLabs
  16. macOS Incident Response | Part 2: User Data, Activity and Behavior - SentinelLabs
  17. macOS Incident Response | Part 1: Collecting Device, File & System Data - SentinelLabs
  18. Gootkit Banking Trojan | Deep Dive into Anti-Analysis Features - SentinelLabs
  19. Cybercrime: Groups Behind "Banload" Banking Malware Implement New Techniques - SentinelLabs
  20. RobinHood Ransomware “CoolMaker” Functions Not So Cool - SentinelLabs
  21. Lazarus APT Targets Mac Users with Poisoned Word Document - SentinelLabs