Vidar 3.9 versus 3.8: configuration and exfiltration changes

October 21, 2026

Inside Remus: protected startup, encrypted tasking, and six collection and execution paths

October 7, 2026

CLOSEDQUORUM: Model-Driven Tasking and Command-Level Execution

October 2, 2026

Amatera 4.1.5-alpha: from protected strings to configuration-driven collection

September 20, 2026

Gridtide: from Google Sheets tasking to Linux execution

September 12, 2026 29 minute read

SleepWalker: Passive Tasking and a 23-Command Interpreter

September 1, 2026 21 minute read

C2Looper: Reconstructing a GitHub C2 Backdoor, Command by Command

August 21, 2026 16 minute read

Remus Stealer: C2 Protocol Analysis, Cryptography, and Detection

April 18, 2026 18 minute read

Disclaimer: This blog and all associated research are part of my personal independent study. All hardware, software, and infrastructure are personally owned ...

VECT 2.0 Ransomware: Deep Dive into a C++ Windows Encryptor

March 27, 2026 29 minute read

VECT 2.0 Ransomware — Deep Dive Analysis

Interlock Ransomware: Deep Dive into a C-Based FreeBSD Encryptor

March 25, 2026 27 minute read

Interlock Ransomware: Deep Dive into a C-Based FreeBSD Encryptor