By Ivan Kwiatkowski ·
knock-outd: an undetected port-knocking backdoor in the wild
An undetected Linux launcher uses libpcap to bind to the nerwork interface, and waits for three packets before executing a missing companion.
Read article →VirLabs Blog
Research and updates.
Technical findings and notes from our malware research.
Subscribe via RSS →
By Ivan Kwiatkowski ·
CLOSEDQUORUM's paint is still wet
CLOSEDQUORUM offers a glimpse of LLM-directed malware in the making, complete with hardcoded decisions, broken injection and a decision loop that only decides once. Autonomy remains a work in progress.
Read article →
By Ivan Kwiatkowski ·
Tracing SIXZUT and JITTERLY in the wild
VirLabs links additional JITTERLY samples to a populated SIXZUT configuration and artifacts reported in HestiaCP compromises. The findings complement Acronis and GreyNoise research into related activity around 981666.xyz.
Read article →