[ Set 0x01 // By Nora ]
Analysis
Structured reverse engineering of various malware families. Triage to detection, one sample at a time.
Analysis
Hermit Android Surveillanceware
Two post-disclosure Hermit Android builds from the same operator campaign show a thin dropper, deleted runtime modules, core-brokered Android privileges, and a stage-2 protobuf crypto protocol.
T1407T1406T1512T1517
Analysis
Coruna iOS Exploit Kit
Reverse engeenering of the government-grade iOS exploit kit identified by GTIG in February 2025.
T1190T1059.007T1140T1027