Tagged: threat-intel

Domain generation algorithms: how malware finds its C2 without hardcoded domains

How malware generates thousands of pseudo-random rendezvous domains from a shared seed, traced from Kraken and Conficker through Torpig and GameOver Zeus, and how defenders sinkhole and classify them.

malware dns threat-intel

Thu, November 6, 2025 · 20 min read

JA3 and JA4 in threat hunting: fingerprinting malware C2 traffic

How blue teams use TLS fingerprints to catch malware command-and-control: JA3/JA3S, JARM and JA4+, the Cobalt Strike default signatures, and what Chrome's ClientHello randomization broke.

tls threat-intel fingerprinting

Tue, November 4, 2025 · 22 min read

Captcha-gated malware: when threat actors borrow anti-bot tech

Traces the 2024-2025 ClickFix and fake-CAPTCHA wave: how attackers dress malware delivery in Cloudflare and reCAPTCHA UX, push commands through the clipboard, and gate payloads so automated analysis sees nothing.

malware captcha threat-intel

Sun, November 2, 2025 · 21 min read