Analyses and field notes

PINNED INVESTIGATIONS

How Russia’s “Media Land” Kept Routing After Sanctions

In light of drone attacks on German airports and the direct threats... The post How Russia’s “Media Land” Kept Routing After Sanctions appeared first on Synaptic Security Blog .

30 Sep 2026robin

NORTHKOREA THREAT-ACTORS

North Korea’s Hangro Revisited

Sometime around July 2026 a new certificate hierarchy went live on the... The post North Korea’s Hangro Revisited appeared first on Synaptic Security Blog .

20 Sep 2026robin

Wenn der Staat das Licht ausmacht: Warum die IFG-Novelle die deutsche Threat-Intelligence-Arbeit trifft

Ein Kommentar aus der Praxis der Cyber Threat Intelligence PETITION UNTERSCHREIBEN This... The post Wenn der Staat das Licht ausmacht: Warum die IFG-Novelle die deutsche Threat-Intelligence-Arbeit trifft appeared first on Synaptic Security Blog .

08 Jul 2026robin

APT43 MB-0010 THREAT-ACTORS MB-0010

Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery

Actor tracking: APT43 (Kimsuky) / MB-0010 I can’t sleep right now, because it’s... The post Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery appeared first on Synaptic Security Blog .

29 Jun 2026robin

MB-0005 RE THREAT-ACTORS MB-0005

UAC-0184 Tooling Evolution: OneDrive Sideload to Remcos

Malware: HijackLoader / IDATLoader -> Remcos Agent 7.1.0 ProActor tracking: UAC-0184 /... The post UAC-0184 Tooling Evolution: OneDrive Sideload to Remcos appeared first on Synaptic Security Blog .

27 Jun 2026robin

MB-0004 RE THREAT-ACTORS MB-0004

Tracking UAC-0226 Tooling Evolution: From WinRAR ADS to Reflective GIFTEDCROOK Loading

A few months ago, I analyzed a UAC-0226 campaign delivering a GIFTEDCROOK... The post Tracking UAC-0226 Tooling Evolution: From WinRAR ADS to Reflective GIFTEDCROOK Loading appeared first on Synaptic Security Blog .

24 Jun 2026robin

GHOSTSHELL MALWARE MB-0009 MB-0009

GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain

Today, we are taking a look at malware linked to yet another... The post GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain appeared first on Synaptic Security Blog .

22 Jun 2026robin

MALWAREBOX TOOLS

IIM Feed: Attack Pattern Mapping for Adversary Infrastructure (5/7)

Part 5 of 7 of building the Malwarebox EcosystemURL: https://feed.iim.malwarebox.euMalwarebox: https://malwarebox.euIIM: https://iim.malwarebox.euIIM Spec: https://github.com/MalwareboxEU/IIM... The post IIM Feed: Attack Pattern Mapping for Adversary Infrastructure (5/7) appeared first on Synaptic…

26 May 2026robin

MALWARE THREAT-ACTORS UAC-0244 MB-0006

UAC-0244 / UAC-0247: Malware Targeting FPV drone operators

Surprise, surprise – a new UAC article 😁 Actor: UAC-0244 / UAC-0247... The post UAC-0244 / UAC-0247: Malware Targeting FPV drone operators appeared first on Synaptic Security Blog .

21 May 2026robin

MALWARE MB-0005 THREAT-ACTORS MB-0005

UAC-0184: From HTA to a Signed Network Stack

EDIT: The next article in my UAC series is out: https://blog.synapticsystems.de/uac-0247-malware-targeting-fpv-operators/ Actor:... The post UAC-0184: From HTA to a Signed Network Stack appeared first on Synaptic Security Blog .

18 May 2026robin

MALWAREBOX TOOLS

IIMQL – The Query Language for Adversary Infrastructure (4/7)

Part 4 of 7 of building the Malwarebox EcosystemWebsite: https://iimql.malwarebox.euGitHub: https://github.com/MalwareboxEU/IIMQL In the... The post IIMQL – The Query Language for Adversary Infrastructure (4/7) appeared first on Synaptic Security Blog .

06 May 2026robin

MALWAREBOX TOOLS

IIM – The Grammar of Adversary Infrastructure (3/7)

Part 3 of 7 of building the Malwarebox EcosystemOfficial Website: https://iim.malwarebox.euGitHub: https://github.com/MalwareboxEU/IIM... The post IIM – The Grammar of Adversary Infrastructure (3/7) appeared first on Synaptic Security Blog .

03 May 2026robin

MALWARE MB-0004 RE MB-0004

Obfuscation Without Effort: Breaking a UAC-0226 GIFTEDCROOK Stealer

EDIT: I have YARA rules available for this one, if you need... The post Obfuscation Without Effort: Breaking a UAC-0226 GIFTEDCROOK Stealer appeared first on Synaptic Security Blog .

09 Apr 2026robin

GAMAREDON MALWAREBOX MB-0001 MB-0001

Following Gamaredons Infrastructure Rotations using Kraken (1/7)

Part 1 of 7 of building the Malwarebox EcosystemOfficial Website: https://kraken.malwarebox.eu Whitepaper Tracking... The post Following Gamaredons Infrastructure Rotations using Kraken (1/7) appeared first on Synaptic Security Blog .

23 Mar 2026robin

MALWARE MB-0003 MUDDYWATER MB-0003

Observed Telegram Bot Naming Patterns in Recent MuddyWater Malware Activity

I recently took a look at the wave of MuddyWater malware samples... The post Observed Telegram Bot Naming Patterns in Recent MuddyWater Malware Activity appeared first on Synaptic Security Blog .

21 Mar 2026robin

APT28 MALWARE MB-0002 MB-0002

APT28: Geofencing as a Targeting Signal (CVE-2026-21509 Campaign)

EDIT: 04.02.2026: I have YARA Rules available for detection, contact me at... The post APT28: Geofencing as a Targeting Signal (CVE-2026-21509 Campaign) appeared first on Synaptic Security Blog .

03 Feb 2026robin

MALWARE MB-0003 MUDDYWATER MB-0003

RustyStealer: Your Compiler Is Snitching on You

As already mentioned in my last MuddyWater article, I originally planned to... The post RustyStealer: Your Compiler Is Snitching on You appeared first on Synaptic Security Blog .

15 Jan 2026robin

GAMAREDON MALWARE MB-0001 MB-0001

Gamaredon: Now Downloading via Windows Updates Best Friend “BITS”

There’s yet another update in Gamaredons GamaLoad scripts, which pushed me to... The post Gamaredon: Now Downloading via Windows Updates Best Friend “BITS” appeared first on Synaptic Security Blog .

13 Jan 2026robin

MALWARE MB-0003 MUDDYWATER MB-0003

MuddyWater: When Your Build System Becomes an IOC – “Jacob”

EDIT 2026-01-18: I published a follow-up article analyzing the evolution and version... The post MuddyWater: When Your Build System Becomes an IOC – “Jacob” appeared first on Synaptic Security Blog .

10 Jan 2026robin

GAMAREDON GUIDES MB-0001 MB-0001

Defending Against Gamaredon: Practical Controls That Actually Work

EDIT: If you’re interested in how I efficiently track threat actors such... The post Defending Against Gamaredon: Practical Controls That Actually Work appeared first on Synaptic Security Blog .

06 Jan 2026robin

GAMAREDON MALWARE MB-0001 MB-0001

Gamaredon: Same Goal, Fewer Fingerprints

In malware analysis, it is tempting to describe change as innovation.New tricks,... The post Gamaredon: Same Goal, Fewer Fingerprints appeared first on Synaptic Security Blog .

05 Jan 2026robin

GAMAREDON MALWARE MB-0001 MB-0001

GamaWiper Explained: Gamaredon’s “New” Anti-Analysis Weapon

After my recent blog posts covering Gamaredon’s ongoing PterodoGraph campaign targeting Ukraine,... The post GamaWiper Explained: Gamaredon’s “New” Anti-Analysis Weapon appeared first on Synaptic Security Blog .

22 Dec 2025robin

GAMAREDON MB-0001 THREAT-ACTORS MB-0001

Inside Gamaredon 2025: Zero-Click Espionage at Scale

UPDATE 22.12.2025: Gamaredon updated it’s payload delivery infrastructure. You can find more... The post Inside Gamaredon 2025: Zero-Click Espionage at Scale appeared first on Synaptic Security Blog .

22 Nov 2025robin

GAMAREDON MB-0001 THREAT-ACTORS MB-0001

How a Russian Threat Actor Uses a Recent WinRAR Vulnerability in Their Ukraine Operations

If you’re interested in reading more about Gamaredon check out my other... The post How a Russian Threat Actor Uses a Recent WinRAR Vulnerability in Their Ukraine Operations appeared first on Synaptic Security Blog .

13 Nov 2025robin