And here is the second part of the Cleartext Password Series: dfir.ch/posts/fantas...

In a recent ISC SANS Diary, Xavier Mertens 🇧🇪 discussed a malicious ZIP archive that led to Remcos, a pretty common RAT. As Xavier noted, "Most of the files used in this infection path remain undetected by most AVs." [1]

I created two blog posts based on my Fantastic Cleartext Passwords talk, which I presented last year at BSides Munich, and I released the first part (Linux) today. The second part (Windows) will be released next week.

Dumping LSASS to a file named lsass.dmp is not exactly stealthy tradecraft anymore. However, I was reading the analysis of the BravoX ransomware group from my colleague Florian Scheiber, and he writes:

We recently analyzed an interesting piece of malware that utilizes the legitimate JavaScript runtime, Deno. The malware was used as a first-stage implant after the user was tricked into downloading and running the malware. Read the full article here: labs.infoguard.ch/posts/anatom...

Anatomy of a Deno-Based Proxy & RAT - InfoGuard Labs

Analysis of a Deno-based malware intrusion that began with mailbombing and a fake Microsoft Teams IT-support call, leading a victim to execute a malicious archive. The payload is a modular JavaScript ...

labs.infoguard.ch

One of our pentesters was tasked with assessing a customer's perimeter and found an exposed FTP server. They queried the server's FQDN on a specialized service and (surprisingly?) found leaked login credentials.

People who have been following me long enough should know by now how much I love these nitty-gritty details of forensics, the little breadcrumbs that give you critical clues about your ongoing case.

On a recent Linux-based Incident Response case, we found a dropped GSocket binary as a persistence mechanism [1]. The threat actor planted the dropped binaries under user-space directories to blend in, masquerading as legitimate system processes: ./.config/dbus/php-fpm ./.config/htop/defunct

Here’s another IG Labs post. After my teammate Evgen published his research on ViperTunnel last week, my other teammate, @schnee_FLO_cke, published a blog post today on BravoX, a ransomware-as-a-service (RaaS) provider. Well done - such a great team! :) labs.infoguard.ch/posts/bravox...

BravoX - The new Kids on the Block - InfoGuard Labs

This article provides an overview of BravoX, a new ransomware player whose operations combine familiar tactics with a few distinctive twists, offering insight into their techniques, tooling, and notab...

labs.infoguard.ch

In the Metasploit Wrap-Up from last week, a new Python Site-Specific Hook Persistence module was released. [1] I wrote a detailed blog about this persistence, which I think is pretty cool. [2] If you have never heard of this technique, you might want to read up on it.

To quote my teammate Evgen Blohm (@ChaplinSec): "Shadow IT at its best." He responded to an intrusion involving (successful) brute-force attempts from an unknown IP range. Yup, not just an unknown IP address or device, from an unknown IP range (Yikes). The customer later informed us:

My teammate Asger Deleuran Strunk worked on a case where the TA tried to dump LSASS with procdump on a server, resulting in Defender blocking the attempt:

This was an interesting alert, raised by an EDR: **** Uncommon creation or access operation of sensitive shadow copy by a high-risk process The process HoboCopy.exe created or accessed a sensitive Shadow Copy volume path.

I recently thought about the different pop-ups I receive every day on my Mac, AND how malware does the same to trick people into entering their password.. and I wondered if I could tell a legitimate prompt from a malicious one. I found a good article, depicting exactly this topic:

As last time, the TA brought infected files into the compromised network, helping spread the infection. The file and registry paths have not changed in our case and are still the same as in my old X post.

Companies frequently approach us to discuss their security posture, playbooks, architecture, etc., but I wonder how many of them also regularly check basic configuration settings? An example from a recent case:

During a recent engagement, we reviewed the collected AutoRuns data from all endpoints on the network. In that dataset, we identified the following scheduled task: Name: 523135538 Command Line: C:\programdata\cp49s\pythonw.exe

My team colleague, Yann Malherbe, worked on a case where the attacker used Everything [1] (locate files and folders by name instantly) to search for password files on the beachhead.

The picture below depicts a (malicious) Inbox Rule. I slightly modified this Inbox Rule to protect our customer, but the gist is that it filters incoming mail from a specific bank employee, moves it to the RSS Folder, and marks it as read.

For a new project, I started to dig into older threat reports, like for example, "The ProjectSauron APT" from 2016. [1] The interesting thing about these old reports is that you see techniques mentioned before that are still used 10 years later.

We are familiar with eMClient and axios, so let me introduce Trufflehog, the new kid on the block. Trufflehog made headlines during the recent "Shai-Hulud" campaign, in which threat actors used it to search for passwords and sensitive information. [1] According to the Trufflehog GitHub page:

I was playing around with bincrypter from THC (The Hackers Choice) [1]. The interesting points, as you can see in the screenshot below, are that the binary is encrypted, obfuscated, and 100% in memory. No temporary files, etc.

Look at my tweet from February 2022. As simple as putting NG into the country field. Guess what I found in this week's Business E-Mail Compromise? Successful logins from NG. Oh well..

Reading a report from a recent Incident Response case from my teammate, Asger Strunk. "It was observed that an unknown hostname “DESKTOP-LDIG48N” from the VPN DHCP IP address 192.168.128.149 made multiple failed login attempts using the username “admin” against various hosts within the network."

I was reading an older report from CrowdStrike the other day: "CrowdStrike was able to reconstruct the PowerShell script from the PowerShell Operational event log as the script’s execution was logged automatically due to the use of specific keywords." [1]

A customer sent malware over. The file magic was CART.. What's that? Turns out, something pretty cool. "This is where CaRT (which stands for Compressed and RC4 Transport) comes in. CaRT is used to store and transfer malware, as well as its metadata.

I analyzed and recreated (a simpler version) of a PHP backdoor we detected in a recent Incident Response engagement. I used the backdoor to install an RMM agent on the compromised machine; the installed EDR did not raise a single alert.

I love reading Incident Response reports from my colleagues. This one here from Matthieu Chatelan: "Note that over 1700 lines (of risky sign-ins) were generated for this user account over the last 3 months.

Craig Rowland never disappoints 🥇 He is showing us cool tricks for finding inconsistencies in the output from different Linux commands, pointing to an active Kernel rootkit.

This is wild. From a recent IR engagement led by my teammate Florian Scheiber: "The investigation showed that the attacker first compromised the Administrator’s personal Gmail account, redacted@gmail.com. Those credentials appeared in a combolist leaked on 2 June 2025.