#GDATATechBlog
LightNews LightNews
struppigel.bsky.social
Blog: "Bad advice and myths around malware prevention"

If you ever heard or said "visiting websites can't infect you", "PDFs aren't malicious" or "exploits are rare and always targeted" this article might be for you.

blog.gdatasoftware.com/2026/07/3846...
#GDATATechBlog #GDATA
Bad Advice and Myths Around Malware Prevention
Bad advice about malware prevention creates false confidence. Nuanced advice matters! Learn why websites, old exploits, and PDF files can still pose risks.
blog.gdatasoftware.com
August 19, 2026 at 4:22 AM
struppigel.bsky.social
I wrote an article about SugarSMP Minecraft scams, Spark stealer, extortion and hacked accounts.

After a brief contact to the threat actor, we talked to two victims and followed the trail.

Analysis in collaboration with @rifteyy
#GDATATechblog #GDATA
blog.gdatasoftware.com/2026/03/3839...
Minecraft: SugarSMP's Dark Tale of Scams, Malware & Extortion
Some Minecraft players were looking for safe haven away from griefers, but found an elaborate web of malware, deception and extortion.
blog.gdatasoftware.com
March 17, 2026 at 9:26 AM
struppigel.bsky.social
New blog: Browser Hijacking techniques -- when malware has different preferences than you

www.gdatasoftware.com/blog/2025/11...

#GDATA #GDATATechblog #BrowserHijacking
Browser Hijacking: Three Technique Studies
If you are searching for technical information on how browser hijacking works, there does not seem to be much out there apart from generic removal instructions. This might be an educational gap we sho...
www.gdatasoftware.com
December 15, 2025 at 6:52 AM
struppigel.bsky.social
Steam game BlockBlasters downloads malware
written by Arvin Tan

#GDATATechblog @GDATA #GDATA
www.gdatasoftware.com/blog/2025/09...
Infected Steam game downloads malware disguised as patch
A 2D platformer game called BlockBlasters has recently started showing signs of malicious activity after a patch release on August 30. While the user is playing the game, various bits of information a...
www.gdatasoftware.com
September 22, 2025 at 9:04 AM
struppigel.bsky.social
Our technical deep-dive about AppSuite PDF Editor backdoor is out 📝👇

www.gdatasoftware.com/blog/2025/08...
#GDATA #GDATATechblog #AppSuite
Backdoor in "AppSuite PDF Editor": A Detailed Technical Analysis
Some threat actors are bold enough to submit their own malware as false positive to antivirus companies and demand removal of the detection. This is exactly what happened with AppSuite PDF Editor.
www.gdatasoftware.com
August 28, 2025 at 5:08 PM
struppigel.bsky.social
🔍New Blog: JustAskJacky -- AI brings back classical trojan horse malware

www.gdatasoftware.com/blog/2025/08...

#GDATA #GDATATechblog
JustAskJacky: AI brings back real trojan horse malware
Despite what some might make you believe, late Trojan Horses were a rare breed in the malware zoo. But thanks to AI and LLMs, they are back..
www.gdatasoftware.com
August 14, 2025 at 4:05 AM
struppigel.bsky.social
A colleague and me wrote an article about EvilConwi -- signed ConnectWise remote access software being abused as malware
#GDATATechblog
www.gdatasoftware.com/blog/2025/06...
Threat Actors abuse signed ConnectWise application as malware builder
Since March 2025, there has been a noticeable increase in infections and fake applications using validly signed ConnectWise samples. We reveal how bad signing practices allow threat actors to abuse th...
www.gdatasoftware.com
June 23, 2025 at 9:57 AM
struppigel.bsky.social
I wrote how to use knowledge about .NET structures and streams for writing .NET Yara signatures.

E.g. IL code patterns, method signature definitions, GUIDs, compressed length

#GDATATechblog #100DaysOfYara
www.gdatasoftware.com/blog/2025/04...
100 Days of YARA: How to write .NET code signatures
If you write YARA signatures for .NET assemblies only relying on strings, you are seriously missing out. Learn what you can do to level up your YARA rules.
www.gdatasoftware.com
April 8, 2025 at 1:25 PM