Newsletter 2026-02-19
Another week, another round.
Credential exfiltration through an Outlook add-in. They’re leveraging an “abandoned” project to infiltrate 4,000 systems.
I find SpecterOps’ article about their new tool V8-forensics pretty interesting. It can help debug exploits by extracting JavaScript artifacts from Chrome’s memory after it crashes.
Apparently more and more providers are already filtering Telnet in their networks. But the sheer volume of Telnet connections running over the internet alone is pretty alarming to me.
Alexandre Borges has written another very comprehensive article on exploiting minifilter drivers. I’m not through all 250 pages yet, but from my perspective it’s a solid guide.
Google and Intel teamed up to take a look at Intel Trust Domain Extensions (TDX). The result is a pretty interesting report.
In this article, ransomware is reversed to get the encryption key. The author uses Rust to write their own emulator with Unicorn Engine and Binary Ninja.
Two really nice follow-ups to the ErrFix analysis from two weeks ago. This time the algorithm used and the binary file get a closer look.
- https://ctrlaltintel.com/threat%20research/Aeternum-Part-1/
- https://ctrlaltintel.com/threat%20research/Aeternum-Part-2/
And since we’re on the topic of malware analysis, here’s an Android backdoor that hooks into the Zygote start process to steal data from the respective applications.
Read you next time.