Lightnews — Scholar-powered news

it's malware @itsmalware.bsky.social · Sep 2

🎥 I’ll also have companion videos dropping on TikTok and YouTube coming soon.
#threatintelligence #cybersecurity #purpleteam

1

it's malware @itsmalware.bsky.social · Sep 2

🔹 Deven Chhajed on SoupDealer, a stealthy Java-based loader built to outmaneuver EDR.

Their work shows how much impactful research happens outside vendor reports — and why we need to pay attention.

📖 Read the full digest and past issues on my Substack & Medium via linktr.ee/itsmalware.

1

it's malware @itsmalware.bsky.social · Sep 2

This week’s Threat Intelligence Digest highlights the work of independent researchers pushing the conversation forward:
🔹 Karthikeyan Nagaraj on how adversaries abuse SQLite databases to persist and exfiltrate data.
🔹 Aj on the hidden risks of malware lurking in smart home devices.

1

it's malware @itsmalware.bsky.social · Aug 26

📖 You can find my Substack and Medium write-ups here: linktr.ee/itsmalware

🎥 By the end of the week, I’ll also be publishing companion videos on TikTok and YouTube.

#threatintelligence #dprk #threathunting

it's malware @itsmalware.bsky.social · Aug 26

From Belarus-linked Ghostwriter activity against Ukraine and Poland, to Scaly Wolf’s modular backdoors, and a DPRK operation using GitHub as covert C2, the reporting shows how state-backed actors keep innovating just enough to stay ahead while leaning on repeatable tradecraft.

1

it's malware @itsmalware.bsky.social · Aug 26

Week 14 is live!
This week I dropped the Threat Intelligence Digest and a deep dive into one of the most interesting campaigns we’ve tracked lately.

1

it's malware @itsmalware.bsky.social · Aug 19

Weekly Threat Intelligence Update:
I’ve been under the weather and had to pause this week’s review (Week 16). Thank you all for the continued support and engagement over the past weeks—it truly means a lot. Regular updates will hopefully resume next week.

it's malware @itsmalware.bsky.social · Aug 13

You can find the new releases on the Notion Marketplace, and check my Linktree for past write-ups, previous templates, and other resources.
linktr.ee/itsmalware

it's malware @itsmalware.bsky.social · Aug 13

We're also getting close to releasing the entire Threat-Intelligence Program Template, which will tie all of these tools together into a complete, end-to-end workflow.

1

it's malware @itsmalware.bsky.social · Aug 13

This week, we released two new templates to support the intelligence lifecycle - now available on the Notion Marketplace.
Both are built for operational environments, not theory, and designed to integrate directly with your existing RFI/PIR workflows.

1

it's malware @itsmalware.bsky.social · Aug 4

We’re aiming to drop more templates next week, for analysts without a big team or enterprise tooling.
Prefer reading? Watching? Skimming?
You can now get the digest on Medium, Substack, or YouTube!
linktr.ee/itsmalware
If this helped, share it. A lot of us are out here flying solo.

it's malware @itsmalware.bsky.social · Aug 4

To hiring managers: There’s no excuse for paying someone with a TS/SCI and niche tradecraft under $100K in the DC area. Period. When I’m able to build a team, I won’t cut wages to “match the market.”

1

it's malware @itsmalware.bsky.social · Aug 4

To cybersecurity media: if you’re referencing analyst-driven work, attribution should be obvious and upfront. If your readers have to dig, reverse-search, or guess the source, you’re skirting dangerously close to plagiarism. Respect the work. Credit the original.

1

it's malware @itsmalware.bsky.social · Aug 4

This week’s digest covers:
• Silver Fox abusing Google Translate to deliver Winos RAT
• Storm-2603 evolving from ToolShell exploits to DNS-backdoored ransomware
• LockBit affiliates continuing their DLL sideloading campaigns
• Plague, a stealthy PAM-based Linux backdoor with zero VirusTotal hits

1