Loading story…
A threat-hunting pipeline uses TLSH fuzzy hashes in Velociraptor to identify executables resembling known malware despite changes that defeat exact hash matching. The Windows.EventLogs.SysmonProcessEnriched artifact enriches Sysmon Event ID 1 process-creation telemetry with Authenticode and TLSH data, while filesystem globbing can calculate TLSH values for files discovered on endpoints.
The collected telemetry is sent to Bifract, which compares hashes against Magonia Research's CelesTLSH known-malicious database. Example matches included fatedier/frp and a file closely resembling Mythic C2; neither fuzzy-hash result alone establishes maliciousness. Analysts should prioritize matches that also exhibit corroborating indicators, particularly an untrusted Authenticode signature, before escalating or alerting.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Signal Sleuth described a threat-hunting pipeline that enriches Sysmon process-creation telemetry and filesystem scans with TLSH and Authenticode data, then compares hashes in Bifract against Magonia Research's CelesTLSH known-malicious database. Example hunting results included an exact TLSH match to fatedier/frp and a distance-32 match to Mythic C2, both requiring investigation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
signalsleuth.io
Open sourceblog.ecapuano.com
Open sourcedocs.velociraptor.app
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. government and private-sector reporting tied a malware family used in intrusions against energy and other critical infrastructure organizations to the Russian-linked **Energetic Bear/Dragonfly** activity set. A CERT/CC reverse-engineering review of a YARA rule published in **CISA Alert `TA17-293A`** found the signature was not a simple string match but a Windows **API hashing** routine used for manual symbol resolution, allowing the malware to locate `kernel32.dll` through the TEB/PEB and resolve functions such as `VirtualProtect` while hindering static analysis. Using FLARE tooling alongside CERT/CC's own API hashing and UberFLIRT analysis, researchers identified the hashing method as **`sll1Add`**, built refined YARA detections, and found **37 related malware exemplars** in CERT's MASS repository across 32-bit and 64-bit variants. The samples shared consistent `kernel32.dll` hashes, with additional `ws2_32.dll` and `wininet.dll` hashes indicating networking capability; analysts also recovered **29 unique IP:port indicators** from 33 samples and reconstructed HTTP POST traffic from four others carrying headers including `X-mode: push` and `X-mode: pop`. A later update linked the tooling to Symantec's **Trojan.Heriplor** from Dragonfly reporting, strengthening the association with Energetic Bear and indicating the malware remained in active use.
Aug 15, 2026
Recent DFIR reporting detailed how investigators can reconstruct attacker activity from Windows and Unix artifacts while avoiding common misreads of legitimate security tooling. Securelist published deep analyses of **UserAssist** and **AmCache**, showing how `shell32.dll` updates GUI execution records, how session statistics and undocumented bytes can reveal usage patterns, and why AmCache can identify executables, drivers, shortcuts, and installed applications even after deletion, despite limits such as SHA-1 hashing only the first `31,457,280` bytes of large files. Separate research showed that **Zsh session files** can preserve command evidence even when `.zsh_history` is deleted, and that binaries wrapped with **shc** or **AutoIT** often remain recoverable or observable through runtime artifacts rather than being truly opaque. Incident write-ups and field notes also showed how attackers and defenders alike can complicate investigations. Analysts documented a typosquatted npm package, **`peritter`**, that dropped `OneDrive.exe` into Startup and stole Chrome credentials; an intrusion in which phishing, Slack installation, RDP access, and Google Drive traffic were tied to document staging and exfiltration; and broader cases in Brazilian educational institutions involving ransomware, valid-account abuse, AnyDesk, PsExec, and insider-planted malware. Other reports warned that legitimate tools and platform features can masquerade as threats or hide them: **NSSM** was used to run payloads such as `ngrok` as Windows services, Azure Batch was abused for cryptomining, RMM cleanup scripts attempted to conceal remote access software, and Microsoft Defender for Endpoint activity including **device discovery** and **Defender XDR deception accounts** generated telemetry that could be mistaken for attacker reconnaissance or privileged account misuse unless investigators validated the underlying configuration and scripts.
Aug 10, 2026
A series of DFIR case studies documented how attackers are increasingly relying on living-off-the-land techniques, uncommon runtimes, and legitimate administration tools to maintain access while evading detection. On Windows, investigators dissected a PHP backdoor that used `php-win.exe`, a scheduled task named **ClockLauncher**, and a **ClockSystemService** service to fetch and execute second-stage code invisibly; a separate intrusion used mailbombing and Microsoft Teams vishing to deliver a modular **Deno**-based RAT and proxy that persisted via the `HKCU\Run` key and communicated over WebSocket infrastructure hosted behind CloudFront. Another investigation traced a malicious `.lnk` file to a WebDAV-hosted **Remcos** payload cached under `TfsStore\Tfs_DAV`, while repeated compromises of a vulnerable **Kentico CMS** server led to webshell deployment, SEO spam, PowerShell-based payload retrieval, and installation of a malicious IIS module, **HTTPCacheLog**, that accepted commands through HTTP cookies. On Linux and cloud infrastructure, researchers showed how attackers abused both commodity malware and stealthier post-exploitation tooling. TeamTNT-linked activity used **tmate** as a covert backdoor on Linux servers, often without normal login traces, while analysis of the **REPTILE 2.0** rootkit loader showed it bypassing `insmod` by decrypting an embedded kernel module and loading it directly with the `init_module` syscall. A separate **Sysrv** botnet infection established cron persistence, masqueraded as `kthreaddk`, and included exploitation and brute-force features for propagation. In AWS, an extortion actor deleted S3 buckets and supplied a fake Linux “recovery” binary that merely simulated restoration rather than recovering cloud data. Across the investigations, defenders were urged to hunt for recurring artifacts such as scheduled tasks, Run keys, suspicious services, unusual binaries in user-writable paths, outbound SSH or WebSocket traffic, and syscall-level module loading, using telemetry and tools including **Velociraptor**, AutoRuns, Sysmon, and CloudTrail.
Aug 1, 2026