Research & Write-ups
Posts
Hunting EtherHiding at Scale: An On-Chain Campaign Tracker
EtherHiding hides a malware campaign's C2 pointer inside a smart contract, read back with a stealthy eth_call. I built a tracker that seeds contracts from urlscan, reads them with eth_call, derives every other contract an operator ever deployed from the deployer nonce, and reconstructs the full C2-rotation history by bisecting block height. Run for a few weeks it mapped 381 contracts across 63 wallet clusters, and the clusters line up with named campaigns like UNC5142/CLEARSHORT.
TeleShim: Static Analysis of an ASUS-Masquerading Sideloader with Telegram C2
Beginner-friendly Malcat walkthrough of a 32-bit sideloader that pretends to be a task-scheduler helper for ASUS, hides its config as base64 wrapped in a circular XOR, and uses api.telegram.org as its command channel. Covers the summary view, section entropy, exports, strings, anomalies, config decryption, and the getUpdates/sendMessage/sendDocument flow — all statically, without ever executing the sample.
Reversing a Big-Endian MIPS Mirai Variant: A Beginner’s Static-Analysis Walkthrough
Beginner-friendly walkthrough of a MIPS Mirai/CondiBot variant called ohshit.mips: decoding the single-byte XOR strings, mapping a 21-slot function pointer table that turns out to be mostly unrelated to the C2 attack vocabulary, and tracing how genddos.st ends up as a DNS amplification payload instead of a C2 domain.
Spotify Playlists as Malware Infrastructure: An Analysis of 41 Samples
How 41 malware samples ended up in the Spotify contacted-URL logs on VirusTotal — and why one of them was hiding its configuration in a playlist name.
Monitoring Stealer Exfiltration at Scale: Turning Telegram Bot Tokens into Threat Intelligence
A stealer needs somewhere to send the loot. Renting a VPS and standing up a panel is the textbook answer; embedding a Telegram bot token is the lazy one. It costs nothing, the transport is TLS, …
Extending SubCrawl: Rebuilt MISP Storage and Real-Time Teams Alerting
SubCrawl from HP Threat Research is a fine bit of engineering: it crawls open directories, fingerprints what it finds against YARA and ClamAV, tags it against URLhaus and hands the results off to a …
Volt Typhoon: Constructed Intelligence or Defeated Adversary?
In July 2025, NSA leadership told a New York audience that Volt Typhoon had failed to establish quiet, persistent access inside US critical infrastructure. Twelve months earlier the same agency was …
Deobfuscating a Zero-Detection PowerShell Loader, Step by Step
A colleague dropped a PowerShell script on my desk that looked like a keyboard cat had been let loose on a text editor. Randomised variable names, integers being divided by two and cast to [char], …