-
Waski Downloader — Cloudflare Payload, Silent Callbacks
A 19 KB C++ trojan downloader drops a child process, wraps its payload fetch in a valid Cloudflare-fronted TLS session, and produces exactly zero certificate errors in 150 seconds of traffic. Then it requests `/images/full/wav.exe` — an executable named like an audio…
-
Introducing zenv: venv for Zeek
If you’ve worked with Zeek for more than a few months, you’ve probably lived this: one ~/zeek install, one ~/.zkg, and a constant juggling act every time you need to test a package against a different Zeek version, try a dev branch,…
-
Polish “Powiadomienie” JS Campaign — Credential Theft via FTP Exfiltration
A 3.6 MB JavaScript file, hardened with `javascript-obfuscator` — rotated string arrays, index decoders, 53 dead dispatcher functions, a catastrophic backtracking regex trap — ends with a plaintext FTP upload of your saved browser passwords. The entire malicious activity: 3 seconds. Join…
-
The 1.7 MB CAPTCHA — How a Fake Human Verification Check Delivered Two RATs
A fake CAPTCHA — 1.7 MB of React 19 served from a .top domain — tricks a visitor into pressing Win+Rand pasting PowerShell. No browser sandbox escape needed. No exploit. Just social engineering. What follows is a 6-stage infection chain: The full…
-
Hunting Lazy OPSEC: Spotting Default C2 Certificates with DuckDB and Zeek
Threat actors love to reuse tools, and sometimes, they get lazy. Case in point: AsyncRAT and its notorious fork, DcRAT. These remote access trojans often ship with default, self-signed certificates. If the operators don’t bother to swap them out before deploying their…
-
Beyond the Grep: Hunting Malware with Zeek and DuckDB SQL
Hunting through raw Zeek logs just got a massive upgrade. If you’ve spent years in the SOC, you’ve likely built up a library of complex awk chains and grep commands to parse Zeek data. It works, but it’s brittle and hard to…
-
How I Used Gemini To Fix My Terrible Zeek Documentation
I built a Zeek-based Amadey malware detector… and then absolutely did NOT document it. https://github.com/keithjjones/zeek-amadey-detector So instead of fixing my own mess, I made Gemini do it. In this video: If your docs look like ancient hieroglyphics carved during a power outage,…
-
Fix NoMachine’s CAPS LOCK Reversal Bug
I was recently trying to connect to a remote NoMachine host, and the sense of caps lock was reversed compared to my local machine. This happens if your caps was on when you connected to a NoMachine host where the caps was…
-
Keith Jones’ Journey As Expert Digital Forensics Expert To AI Malware Researcher
Had a great time as a guest on the Security Unfiltered Podcast, talking about work-life balance in cybersecurity—especially for parents. We covered how remote work has shifted expectations, the challenge of growing your career while raising a family, and how AI is…
-
Manually Download MacOS Sequoia
Apple’s macOS updates are typically seamless through the App Store, but sometimes, a bug can throw a wrench in the process. I recently encountered this firsthand when updating one of my Macs to macOS Sequoia. No matter what I did, the App…