Operational malware analysis — deep dives into incidents, implants, and intrusion sets.https://threatunpacked.com/https://threatunpacked.com/2026/07/07/dragonforce-ransomware-deep-re/https://threatunpacked.com/2026/07/07/dragonforce-ransomware-deep-re/Full technical analysis of DragonForce's Windows x86 encryptor: MinGW C++ with Salsa20 multi-mode encryption, BYOVD kernel driver EDR bypass (rentdrv2.sys + truesight.sys), WMI shadow copy deletion, Restart Manager file handle killing, IOCP network scanning, and COM-based scheduled task persistence.Tue, 07 Jul 2026 12:00:00 GMThttps://threatunpacked.com/2026/07/06/ransomhub-go-ransomware-deep-re/https://threatunpacked.com/2026/07/06/ransomhub-go-ransomware-deep-re/Full technical analysis of RansomHub's Go-based Windows encryptor: garble package obfuscation, X25519+ChaCha20 encryption scheme, built-in SMB lateral movement using go-smb, IOCP parallel file encryption, and service recovery disruption.Mon, 06 Jul 2026 12:00:00 GMThttps://threatunpacked.com/2026/07/05/safepay-ransomware-lockbit-fork-deep-re/https://threatunpacked.com/2026/07/05/safepay-ransomware-lockbit-fork-deep-re/Assembly-level analysis of SafePay ransomware — a LockBit 3.0 derivative with a custom CRC-32 import resolver, triple-XOR string obfuscation, IOCP-driven parallel encryption, and NT-layer privilege escalation. Full API inventory recovered by cracking 130+ export hashes.Sun, 05 Jul 2026 12:00:00 GMThttps://threatunpacked.com/2026/07/04/wealthgaf-asyncbotnet-forex-rat/https://threatunpacked.com/2026/07/04/wealthgaf-asyncbotnet-forex-rat/A 2,253-byte ZIP posing as API documentation for a fake forex CRM delivers a four-stage chain: LNK trojan with conhost --headless hiding, a compiled AutoIt downloader, a PNG/ZIP polyglot Python bundle, and a previously undocumented Socket.IO RAT named ASYNCBOTNET that monitors 14 crypto wallets and 12 exchanges. A single TLS certificate ties WealthGAF to a 13-brand fake forex platform cluster, all sharing the same Kubernetes C2 origin.Sat, 04 Jul 2026 18:00:00 GMThttps://threatunpacked.com/2026/07/04/serpentine-cloud-cloudflare-tunnel-asyncrat/https://threatunpacked.com/2026/07/04/serpentine-cloud-cloudflare-tunnel-asyncrat/A WsgiDAV opendir tip from @smica83 leads to a live SERPENTINE#CLOUD staging server on a Cloudflare Tunnel. Three BAT files, two delivery paths, four Python runtimes, an Early Bird APC DLL, and a naming convention that traces the campaign back to December 2022.Sat, 04 Jul 2026 12:00:00 GMThttps://threatunpacked.com/2026/07/02/semob-gdf-kill-chain/https://threatunpacked.com/2026/07/02/semob-gdf-kill-chain/File timestamps preserved inside a 9.1GB archive found on a Chinese threat actor's staging server let us reconstruct a complete intrusion: WordPress web shell to DirtyPipe container escape, socat tunnelling, fscan credential spray across 164 government machines, and 754MB of internal GitLab source code — all in eight weeks.Thu, 02 Jul 2026 22:00:00 GMThttps://threatunpacked.com/2026/07/02/behinder-alibaba-brazil-staging/https://threatunpacked.com/2026/07/02/behinder-alibaba-brazil-staging/A Shodan hit on an Alibaba Cloud Singapore IP leads to a 9.1GB archive that turns out to be an attacker's working directory from inside a compromised Brazilian government server — containing a DirtyPipe exploit, fscan lateral movement results across the GDF internal network, 164 confirmed credential compromises, and 754MB of exfiltrated GitLab source code.Thu, 02 Jul 2026 20:00:00 GMThttps://threatunpacked.com/2026/07/02/megadumper-trumvps-five-year-staging-server/https://threatunpacked.com/2026/07/02/megadumper-trumvps-five-year-staging-server/A Shodan scan for Singapore open directories surfaces a TRUMVPS server that has been quietly hosting the same .NET credential stealer — under the same filename — since 2021. The current build has zero detections.Thu, 02 Jul 2026 18:00:00 GMThttps://threatunpacked.com/2026/07/02/nakaz-mo-ukraine-lnk-ps1-downloader/https://threatunpacked.com/2026/07/02/nakaz-mo-ukraine-lnk-ps1-downloader/A ZIP archive impersonating wartime asset disclosure paperwork delivers a two-stage LNK→PowerShell downloader to Ukrainian targets — with a geo-fenced C2 that returns 403 to every sandbox that tries to fetch the payload.Thu, 02 Jul 2026 14:00:00 GMThttps://threatunpacked.com/2026/07/02/sea-underground-2026-govti-v4-tempix-botnet/https://threatunpacked.com/2026/07/02/sea-underground-2026-govti-v4-tempix-botnet/How a mass Next.js exploitation campaign named after the President is quietly backdooring AWS Singapore, DigitalOcean, and anything else it can reachThu, 02 Jul 2026 12:00:00 GMThttps://threatunpacked.com/2026/07/01/chm-nuitka-python-pakistan-military-apt/https://threatunpacked.com/2026/07/01/chm-nuitka-python-pakistan-military-apt/A CHM file themed around restricted Pakistani defense exhibitions drops a Nuitka-compiled Python backdoor named after the country's annual military budget document. The C2 routes through a G-Core CDN edge node shared with Microsoft Windows Update traffic — designed to disappear into network telemetry.Wed, 01 Jul 2026 14:00:00 GMThttps://threatunpacked.com/2026/07/01/fud-url-webdav-netsupport-rat/https://threatunpacked.com/2026/07/01/fud-url-webdav-netsupport-rat/A Windows URL shortcut disguised as a PDF had 1/75 detections at submission time. It used the WebDAV-over-HTTP UNC trick to silently execute an EXE off a Hong Kong opendir. Two stages later: a silent NetSupport Manager install beaconing to a 16-day-old C2 domain while Telegram told the operator their new victim was live.Wed, 01 Jul 2026 12:00:00 GMThttps://threatunpacked.com/2026/07/01/silverfox-rar-z-extension-industrial-lure/https://threatunpacked.com/2026/07/01/silverfox-rar-z-extension-industrial-lure/A RAR renamed .z to bypass filters drops a Silverfox InnoSetup installer with a spreader payload. Three lures in one campaign: industrial safety training, a Chinese company seal, and an HR recruitment form. The C2 IP hosted Chinese gambling sites from late 2023 into early 2024.Wed, 01 Jul 2026 12:00:00 GMThttps://threatunpacked.com/2026/06/30/chopi-rat-vishing-opendir-pivot/https://threatunpacked.com/2026/06/30/chopi-rat-vishing-opendir-pivot/A WsgiDAV opendir gave me staging payloads and a leaked debug log. AES config RE confirmed all six C2 IPs and the full encrypted capability set. PE build timestamp forensics revealed two back-to-back build sessions; the operator's dropper cluster leaked their build-system path on VirusTotal. Neo4j graph of 70 nodes across 3 cloud providers. YARA rules included.Tue, 30 Jun 2026 12:00:00 GMThttps://threatunpacked.com/2026/06/30/paper-dat-dpapi-host-locked-shadowpad/https://threatunpacked.com/2026/06/30/paper-dat-dpapi-host-locked-shadowpad/VirusTotal called it PlugX. It broke down into an RC4 layer I could crack offline, a ScatterBrain-flavoured shellcode stub, and then a wall: the real implant is sealed with machine-scoped DPAPI, so it only decrypts on the one victim it was built for. Here's everything up to that wall, why the wall is the whole point, and why I think this is closer to ShadowPad than PlugX.Tue, 30 Jun 2026 12:00:00 GMThttps://threatunpacked.com/2026/06/27/unpacking-canon-dat-plugx-c2-infrastructure/https://threatunpacked.com/2026/06/27/unpacking-canon-dat-plugx-c2-infrastructure/A single XOR'd Canon.dat turned into a campaign map: reversing the CanonStager loader, writing a memory-based config extractor, pulling the related samples, and walking nine builds out to their CloudFlare-fronted C2 origins.Sat, 27 Jun 2026 12:00:00 GMThttps://threatunpacked.com/2026/03/12/building-a-scalable-windows-driver-vulnerability-analyzer-part-3-from-one-driver-to-1775/https://threatunpacked.com/2026/03/12/building-a-scalable-windows-driver-vulnerability-analyzer-part-3-from-one-driver-to-1775/In Part 1, I built a pipeline to ingest and classify tens of gigabytes of Windows drivers. In Part 2, I ran it at scale and found the initial results underwhelming. IOCTLance found bugs, but understanding what those bugs meant required more context than symbolic execution alone cThu, 12 Mar 2026 05:13:44 GMThttps://threatunpacked.com/2026/02/04/building-a-scalable-windows-driver-vulnerability-analyzer-part-2/https://threatunpacked.com/2026/02/04/building-a-scalable-windows-driver-vulnerability-analyzer-part-2/In [Part 1], I built a pipeline to churn through gigabytes of drivers. I started with a massive raw dataset of 58.5 GB of drivers. However, feeding this volume into a static analyzer is inefficient. I aggressively filtered the set: This left me with a curated dataset of 28,000 unWed, 04 Feb 2026 04:13:27 GMThttps://threatunpacked.com/2026/01/21/building-a-scalable-windows-driver-vulnerability-analyzer-part-1/https://threatunpacked.com/2026/01/21/building-a-scalable-windows-driver-vulnerability-analyzer-part-1/Background As I spent more time looking at kernel drivers, that interest gradually grew. Finding my first CVE in a Windows driver pushed me to pay closer attention to this area. Around the same time, I started reading more practical write-ups on driver work, including a post by eWed, 21 Jan 2026 01:03:59 GMThttps://threatunpacked.com/2026/01/07/why-this-blog-exists/https://threatunpacked.com/2026/01/07/why-this-blog-exists/Most malware analysis content focuses on what a sample does. This blog focuses on why it matters during an incident. Through case studies, technical deep dives, and operational reflections, I write about: Clarity matters, assumptions are dangerous, and systems fail in ways their Wed, 07 Jan 2026 22:31:00 GMThttps://threatunpacked.com/2025/10/07/reversing-a-microsoft-signed-rootkit-the-netfilter-driver/https://threatunpacked.com/2025/10/07/reversing-a-microsoft-signed-rootkit-the-netfilter-driver/A detailed technical analysis of Netfilter.sys, a malicious kernel driver that was legitimately signed by Microsoft through attestation signing. This post explores how the rootkit harnesses the Windows Filtering Platform for stealthy IP redirection, the C2 communication mechanismTue, 07 Oct 2025 08:14:24 GMT