Latest
Tag: individual-certificate
Spyder, rebuilt: a Patchwork downloader that plays dead in sandboxes
Two builds of a lab-shy downloader reporting to cloudwindowapps[.]com turn out to be a new version of Spyder, a tool linked to the Patchwork espionage group. Their encrypted…
A signed “update check” that only tells the truth to victims
A three-day Microsoft Trusted Signing certificate, a 10 MB padded binary and a lab check that shows analysts a harmless "No update found." box while real victims get…
The captcha that can’t be passed: a signed “Installer.exe” that plants a remote-control updater
A signed Installer.exe shows a slide-to-verify captcha that always fails, while silently installing an updater that downloads and runs whatever a Cloudflare R2 manifest lists. The manifest was…
A signed “video editor” that fakes its own failure and leaves two back doors behind
A signed fake video-editor installer shows a robot check and a fake driver error while installing two separate back doors: a SYSTEM service and a Node.js program that…
About
Rogue Authority LLC — cybersecurity consulting and open-source tooling for the security community.
View Projects