Latest
Tag: sandbox-evasion
Spyder, rebuilt: a Patchwork downloader that plays dead in sandboxes
Two builds of a lab-shy downloader reporting to cloudwindowapps[.]com turn out to be a new version of Spyder, a tool linked to the Patchwork espionage group. Their encrypted…
A signed “update check” that only tells the truth to victims
A three-day Microsoft Trusted Signing certificate, a 10 MB padded binary and a lab check that shows analysts a harmless "No update found." box while real victims get…
The PDF Viewer That Makes Sandboxes Wait It Out
A signed "PDF viewer" that guesses its own key 3.7 billion times to outlast sandboxes, then hides a DHT-and-DGA backdoor inside Windows Explorer.
About
Rogue Authority LLC — cybersecurity consulting and open-source tooling for the security community.
View Projects