New on ThreatCat.ch! 🐈
We unpack a multi-stage malware loader, tracing its execution from a malicious Windows shortcut through several .NET stages to a Cobalt Strike Beacon.
Read our technical analysis:
threatcat.ch/blog/unpacki...
#MalwareAnalysis #ThreatResearch
We unpack a multi-stage malware loader, tracing its execution from a malicious Windows shortcut through several .NET stages to a Cobalt Strike Beacon.
Read our technical analysis:
threatcat.ch/blog/unpacki...
#MalwareAnalysis #ThreatResearch
November 10, 2026 at 11:18 AM
New on ThreatCat.ch! 🐈
We unpack a multi-stage malware loader, tracing its execution from a malicious Windows shortcut through several .NET stages to a Cobalt Strike Beacon.
Read our technical analysis:
threatcat.ch/blog/unpacki...
#MalwareAnalysis #ThreatResearch
We unpack a multi-stage malware loader, tracing its execution from a malicious Windows shortcut through several .NET stages to a Cobalt Strike Beacon.
Read our technical analysis:
threatcat.ch/blog/unpacki...
#MalwareAnalysis #ThreatResearch
Fed Aether a nasty piece of obfuscated JavaScript today and got a clean, human-readable logic flow in seconds.
Anyone else using it to tear apart packed binaries or scripted malware? #reverseengineering #malwareanalysis
Anyone else using it to tear apart packed binaries or scripted malware? #reverseengineering #malwareanalysis
November 9, 2026 at 7:00 PM
Fed Aether a nasty piece of obfuscated JavaScript today and got a clean, human-readable logic flow in seconds.
Anyone else using it to tear apart packed binaries or scripted malware? #reverseengineering #malwareanalysis
Anyone else using it to tear apart packed binaries or scripted malware? #reverseengineering #malwareanalysis
Fed Aether a mangled JS snippet and asked it to isolate the encoding logic for the telemetry beacon. It mapped the Xor shift in seconds.
Anyone else running obfuscated payloads through it? #reverseengineering #malwareanalysis
Anyone else running obfuscated payloads through it? #reverseengineering #malwareanalysis
November 10, 2026 at 5:00 AM
Fed Aether a mangled JS snippet and asked it to isolate the encoding logic for the telemetry beacon. It mapped the Xor shift in seconds.
Anyone else running obfuscated payloads through it? #reverseengineering #malwareanalysis
Anyone else running obfuscated payloads through it? #reverseengineering #malwareanalysis
When knocking a binary by hand, do you start with patterns in the .data section or go straight to the IAT for some quick wins? What's the first thing you look for in IDA or Ghidra? #rev #malwareanalysis
November 10, 2026 at 3:00 AM
When knocking a binary by hand, do you start with patterns in the .data section or go straight to the IAT for some quick wins? What's the first thing you look for in IDA or Ghidra? #rev #malwareanalysis
When you’re auditing a binary with no symbols, do you even bother with static analysis anymore? Or do you jump straight into the debugger to trace the logic and deal with the anti-debug checks? #reverseengineering #malwareanalysis
November 8, 2026 at 9:00 PM
When you’re auditing a binary with no symbols, do you even bother with static analysis anymore? Or do you jump straight into the debugger to trace the logic and deal with the anti-debug checks? #reverseengineering #malwareanalysis
Threw a 400kb wall of obfuscated JS at Aether today; it mapped the control flow and identified the key logic branches in seconds. Anyone else breaking down custom VM dispatchers right now? #reverseengineering #malwareanalysis
November 8, 2026 at 3:00 AM
Threw a 400kb wall of obfuscated JS at Aether today; it mapped the control flow and identified the key logic branches in seconds. Anyone else breaking down custom VM dispatchers right now? #reverseengineering #malwareanalysis
Fed Aether a garbled JScript entry from a packed binary and had it write a clean Python deobfuscator on the first try. We've saved hours of manual regex hell.
What's the worst obfuscation you've had to reverse lately? #MalwareAnalysis #ReverseEngineering
What's the worst obfuscation you've had to reverse lately? #MalwareAnalysis #ReverseEngineering
November 8, 2026 at 11:00 PM
Fed Aether a garbled JScript entry from a packed binary and had it write a clean Python deobfuscator on the first try. We've saved hours of manual regex hell.
What's the worst obfuscation you've had to reverse lately? #MalwareAnalysis #ReverseEngineering
What's the worst obfuscation you've had to reverse lately? #MalwareAnalysis #ReverseEngineering
@sentinelone.com
SentinelOne released VerifiedIDA, an open-source IDA Pro harness that keeps LLM-generated reverse engineering annotations tied to verifiable evidence, using ComRAT as a case...
-
IOCs: (None identified)
-
#AISecurity #MalwareAnalysis #ThreatIntel #ThreatIntelligence
SentinelOne released VerifiedIDA, an open-source IDA Pro harness that keeps LLM-generated reverse engineering annotations tied to verifiable evidence, using ComRAT as a case...
-
IOCs: (None identified)
-
#AISecurity #MalwareAnalysis #ThreatIntel #ThreatIntelligence
Link
www.sentinelone.com
November 4, 2026 at 5:14 PM
@sentinelone.com
SentinelOne released VerifiedIDA, an open-source IDA Pro harness that keeps LLM-generated reverse engineering annotations tied to verifiable evidence, using ComRAT as a case...
-
IOCs: (None identified)
-
#AISecurity #MalwareAnalysis #ThreatIntel #ThreatIntelligence
SentinelOne released VerifiedIDA, an open-source IDA Pro harness that keeps LLM-generated reverse engineering annotations tied to verifiable evidence, using ComRAT as a case...
-
IOCs: (None identified)
-
#AISecurity #MalwareAnalysis #ThreatIntel #ThreatIntelligence
Fed Aether a proprietary obfuscated binary and it mapped out the license check logic in minutes. I'm catching issues that would've taken a week of manual tracing.
Anyone else using it for reverse engineering today? #ReverseEngineering #MalwareAnalysis
Anyone else using it for reverse engineering today? #ReverseEngineering #MalwareAnalysis
November 6, 2026 at 11:01 AM
Fed Aether a proprietary obfuscated binary and it mapped out the license check logic in minutes. I'm catching issues that would've taken a week of manual tracing.
Anyone else using it for reverse engineering today? #ReverseEngineering #MalwareAnalysis
Anyone else using it for reverse engineering today? #ReverseEngineering #MalwareAnalysis
Most buffer overflow guides stop at "too much data." We go from vulnerable C code to RIP control on 64-bit Linux. Learn exactly how memory corruption works and why modern mitigations make your life harder.
#infosec #malwareanalysis
https://aethersky.ai/learn/buffer-overflow-walkthrough-2026
#infosec #malwareanalysis
https://aethersky.ai/learn/buffer-overflow-walkthrough-2026
November 9, 2026 at 4:00 PM
Most buffer overflow guides stop at "too much data." We go from vulnerable C code to RIP control on 64-bit Linux. Learn exactly how memory corruption works and why modern mitigations make your life harder.
#infosec #malwareanalysis
https://aethersky.ai/learn/buffer-overflow-walkthrough-2026
#infosec #malwareanalysis
https://aethersky.ai/learn/buffer-overflow-walkthrough-2026
What's your go-to tool for carving binaries when the symbol table is stripped? You still trusting strings and grep, or are you leaning on Ghidra's decompiler for the heavy lifting? #ReverseEngineering #MalwareAnalysis
November 4, 2026 at 7:00 AM
What's your go-to tool for carving binaries when the symbol table is stripped? You still trusting strings and grep, or are you leaning on Ghidra's decompiler for the heavy lifting? #ReverseEngineering #MalwareAnalysis
Fed Aether a heap of obfuscated JavaScript and had it reconstruct the original logic flow in minutes. Now I'm hunting for similar patterns across the rest of the binary.
Anyone else mapping out custom packing routines today? #reverseengineering #malwareanalysis
Anyone else mapping out custom packing routines today? #reverseengineering #malwareanalysis
November 4, 2026 at 9:00 AM
Fed Aether a heap of obfuscated JavaScript and had it reconstruct the original logic flow in minutes. Now I'm hunting for similar patterns across the rest of the binary.
Anyone else mapping out custom packing routines today? #reverseengineering #malwareanalysis
Anyone else mapping out custom packing routines today? #reverseengineering #malwareanalysis
Which C or C++ toolchain feature saves you the most time during complex RE? If you're digging into a stripped binary, do you lean on advanced Ghidra scripts or a strict idapython workflow? #reverseengineering #malwareanalysis
November 3, 2026 at 9:00 PM
Which C or C++ toolchain feature saves you the most time during complex RE? If you're digging into a stripped binary, do you lean on advanced Ghidra scripts or a strict idapython workflow? #reverseengineering #malwareanalysis
When you're auditing a binary and the symbol table is stripped, what's your move for reconstructing the C++ class hierarchy? Are you relying on a specific script or manually tracing vtable pointers in the disassembly? #reverseengineering #malwareanalysis
November 3, 2026 at 1:00 AM
When you're auditing a binary and the symbol table is stripped, what's your move for reconstructing the C++ class hierarchy? Are you relying on a specific script or manually tracing vtable pointers in the disassembly? #reverseengineering #malwareanalysis
Fed Aether a mess of obfuscated JavaScript and got a clean, commented POC for analyzing the heap layout of a 64-bit process. It stripped the VM junk and exposed the underlying logic in seconds.
Who else is hitting this with RE? #reverseengineering #malwareanalysis
Who else is hitting this with RE? #reverseengineering #malwareanalysis
November 3, 2026 at 1:00 PM
Fed Aether a mess of obfuscated JavaScript and got a clean, commented POC for analyzing the heap layout of a 64-bit process. It stripped the VM junk and exposed the underlying logic in seconds.
Who else is hitting this with RE? #reverseengineering #malwareanalysis
Who else is hitting this with RE? #reverseengineering #malwareanalysis
Fed Aether a scrambled JavaScript heap to automate the deobfuscation of a custom VM. Now I have readable opcodes and a clear control flow graph.
Who else is reverse-engineering packed JS this week? #malwareanalysis #RE
Who else is reverse-engineering packed JS this week? #malwareanalysis #RE
November 2, 2026 at 5:00 PM
Fed Aether a scrambled JavaScript heap to automate the deobfuscation of a custom VM. Now I have readable opcodes and a clear control flow graph.
Who else is reverse-engineering packed JS this week? #malwareanalysis #RE
Who else is reverse-engineering packed JS this week? #malwareanalysis #RE
Pluto Research exposes Hugging Face malware. This Hugging Face malware campaign drops cryptominers and backdoors on self-hosted AI servers.
#HuggingFace #AISecurity #Cryptomining #PlutoResearch #SupplyChainAttack #MalwareAnalysis #InfoSec
#HuggingFace #AISecurity #Cryptomining #PlutoResearch #SupplyChainAttack #MalwareAnalysis #InfoSec
Hugging Face Malware Campaign Infects AI GPU Servers
At a Glance Malware Family Hugging Face malware campaign (peakminer cryptominer, /tmp/.cch/svc.py watchdog, reconnecting reverse shells, and container escape tools) Threat Actor Unattributed; suspected financially motivated Chinese-speaking operator or group Target / Victims Self-hosted AI infrastructure (Xinference and GPUStack), shared GPU notebooks, research clusters (over 32,000 downloads across 31 campaign and 13 linked repositories) Delivery Vector
securityonline.info
November 3, 2026 at 7:05 AM
Pluto Research exposes Hugging Face malware. This Hugging Face malware campaign drops cryptominers and backdoors on self-hosted AI servers.
#HuggingFace #AISecurity #Cryptomining #PlutoResearch #SupplyChainAttack #MalwareAnalysis #InfoSec
#HuggingFace #AISecurity #Cryptomining #PlutoResearch #SupplyChainAttack #MalwareAnalysis #InfoSec
Wrote a custom Python script to deobfuscate a packed binary today; Aether nailed the logic for a XOR-based routine that usually trips up smaller models. Which obfuscation patterns are you currently fighting? #ReverseEngineering #MalwareAnalysis
November 2, 2026 at 7:00 AM
Wrote a custom Python script to deobfuscate a packed binary today; Aether nailed the logic for a XOR-based routine that usually trips up smaller models. Which obfuscation patterns are you currently fighting? #ReverseEngineering #MalwareAnalysis
When you're auditing an obfuscated binary, which anti-debug trick is the biggest pain to automate away? Are we still stuck with manual patches, or have you found a reliable script for the weird ones? #ReverseEngineering #MalwareAnalysis
November 2, 2026 at 5:00 AM
When you're auditing an obfuscated binary, which anti-debug trick is the biggest pain to automate away? Are we still stuck with manual patches, or have you found a reliable script for the weird ones? #ReverseEngineering #MalwareAnalysis
Fortinet exposes the PapRAT malware campaign. See how the BITTER PapRAT malware uses three infection chains and Rust to spy on South Asian targets.
#PapRAT #BITTER #Cyberespionage #FortiGuard #MalwareAnalysis #InfoSec #RustMalware
#PapRAT #BITTER #Cyberespionage #FortiGuard #MalwareAnalysis #InfoSec #RustMalware
BITTER PapRAT Malware Targets South Asian Organizations
At a Glance Malware Family PapRAT malware (C++ and Rust remote access trojans) and WmRAT secondary implant Threat Actor Confirmed campaign attribution to BITTER (also tracked as TA397); suspected South Asian state-aligned cyberespionage group Target / Victims Government, energy, and engineering organizations across South Asia (regional focus confirmed by C2 telemetry and summit lures) Delivery Vector
securityonline.info
November 4, 2026 at 7:10 AM
Fortinet exposes the PapRAT malware campaign. See how the BITTER PapRAT malware uses three infection chains and Rust to spy on South Asian targets.
#PapRAT #BITTER #Cyberespionage #FortiGuard #MalwareAnalysis #InfoSec #RustMalware
#PapRAT #BITTER #Cyberespionage #FortiGuard #MalwareAnalysis #InfoSec #RustMalware
Piped a proprietary binary into Aether to map out its control flow and isolate a custom XOR loop for manual deobfuscation. Identified the key in seconds.
Who else is reverse engineering binary blobs in its VM right now? #RE #MalwareAnalysis
Who else is reverse engineering binary blobs in its VM right now? #RE #MalwareAnalysis
November 1, 2026 at 9:00 PM
Piped a proprietary binary into Aether to map out its control flow and isolate a custom XOR loop for manual deobfuscation. Identified the key in seconds.
Who else is reverse engineering binary blobs in its VM right now? #RE #MalwareAnalysis
Who else is reverse engineering binary blobs in its VM right now? #RE #MalwareAnalysis
Fed Aether a piece of obfuscated JavaScript today and it stripped the packing to reveal the own-crypter logic right away.
Anyone else reverse-engineered a custom loader this week? #malwareanalysis #reverseengineering
Anyone else reverse-engineered a custom loader this week? #malwareanalysis #reverseengineering
November 1, 2026 at 11:00 AM
Fed Aether a piece of obfuscated JavaScript today and it stripped the packing to reveal the own-crypter logic right away.
Anyone else reverse-engineered a custom loader this week? #malwareanalysis #reverseengineering
Anyone else reverse-engineered a custom loader this week? #malwareanalysis #reverseengineering
Mainstream LLMs trigger canned refusals the moment you ask about exploit dev or malware analysis. Stop fighting the filter and see how Aether handles actual reverse-engineering without the lecturing.
#infosec #malwareanalysis
https://aethersky.ai/learn/why-chatgpt-refuses-reverse-engineering
#infosec #malwareanalysis
https://aethersky.ai/learn/why-chatgpt-refuses-reverse-engineering
November 2, 2026 at 12:00 AM
Mainstream LLMs trigger canned refusals the moment you ask about exploit dev or malware analysis. Stop fighting the filter and see how Aether handles actual reverse-engineering without the lecturing.
#infosec #malwareanalysis
https://aethersky.ai/learn/why-chatgpt-refuses-reverse-engineering
#infosec #malwareanalysis
https://aethersky.ai/learn/why-chatgpt-refuses-reverse-engineering
Feeding Aether a tangled mess of obfuscated JavaScript returned a clean, mapped logic flow I can actually use. Anyone else here mapping telemetry signals or rebuilding dead binaries? #reverseengineering #malwareanalysis
October 31, 2026 at 3:00 PM
Feeding Aether a tangled mess of obfuscated JavaScript returned a clean, mapped logic flow I can actually use. Anyone else here mapping telemetry signals or rebuilding dead binaries? #reverseengineering #malwareanalysis
Cisco Talos uncovers the NIK C2 framework. This Windows NIK C2 framework abuses OpenAI APIs to analyze stolen victim data and deploy screen lockers.
#NIKC2 #CiscoTalos #AISecurity #MalwareAnalysis #Infostealer #Cybersecurity #InfoSec
#NIKC2 #CiscoTalos #AISecurity #MalwareAnalysis #Infostealer #Cybersecurity #InfoSec
NIK C2 Framework Integrates OpenAI API to Analyze Stolen Data in Live Attacks
At a Glance Malware Family NIK C2 framework (Go-based 64-bit Windows implant, OpenAI API client, and screen-locking ransomware) Threat Actor Unattributed operator group (internal project labeled nik_panel; intent unconfirmed) Target / Victims Windows endpoints holding cryptocurrency wallets, browser logins, and OpenAI developer keys (active server observed in the wild) Delivery Vector
securityonline.info
November 2, 2026 at 8:21 AM
Cisco Talos uncovers the NIK C2 framework. This Windows NIK C2 framework abuses OpenAI APIs to analyze stolen victim data and deploy screen lockers.
#NIKC2 #CiscoTalos #AISecurity #MalwareAnalysis #Infostealer #Cybersecurity #InfoSec
#NIKC2 #CiscoTalos #AISecurity #MalwareAnalysis #Infostealer #Cybersecurity #InfoSec