Based on overwhelming fan feedback, we've adjusted Mystery Boxes to use Roman Numerals. It's unclear why literally every single fan suggested this independently of each other, but far be it from us to deny the people what they want.

#mysteryboxes #roguerobin #indiegamedev #aprilfools

Lets see what malware families reference their protocols in any of those fields

DNS:
Invisimole Loaders (v cool intrusion set)
RogueRobin Backdoor (DarkHydrus)
RDAT

fams that hit on PowerShell:
Syskit
IPsec
JSSLoader
GhostShell
WHISPERGATE
SHARPSTAGE
Owowa
SaintBot
TortoiseShell
DarkNeuron
RogueRobin
Sakabota

https://github.com/g-les/100DaysofYARA/blob/main/100_days_of_yara.yar

Day 81 #100DaysofYARA - looking across dotnet assembly and module names to try and find obvious malign intent.

I see 100% overlap across these between the names

Backdoor/Dropper Karkoff
Dropper DarkNeuron
DNS RogueRobin
SSL JSSLoader
stager...