Latest
Tag: microsoft-trusted-signing
Spyder, rebuilt: a Patchwork downloader that plays dead in sandboxes
Two builds of a lab-shy downloader reporting to cloudwindowapps[.]com turn out to be a new version of Spyder, a tool linked to the Patchwork espionage group. Their encrypted…
A signed “update check” that only tells the truth to victims
A three-day Microsoft Trusted Signing certificate, a 10 MB padded binary and a lab check that shows analysts a harmless "No update found." box while real victims get…
A signed loader, a Cobalt Strike Beacon, and C2 traffic dressed up as CrowdStrike
A three-day Microsoft Trusted Signing certificate, a ChaCha20 shellcode loader with side-door syscalls, and a Cobalt Strike Beacon whose traffic impersonates CrowdStrike Falcon.
The PDF Viewer That Makes Sandboxes Wait It Out
A signed "PDF viewer" that guesses its own key 3.7 billion times to outlast sandboxes, then hides a DHT-and-DGA backdoor inside Windows Explorer.
About
Rogue Authority LLC — cybersecurity consulting and open-source tooling for the security community.
View Projects