analyzereversedisclose
> Independent analysis of 0-days, n-days, and malware — written for operators and the people who write the advisories.
The newest published write-ups. Drafts stay off this list.
Pulled beacon.exe off a client’s already-compromised Windows server. The filename begged for Sliver. The pclntab and the C2 URLs said otherwise: a privately built Go implant with HTTPS plus framed TCP, AES-256-GCM, and a full post-ex menu. Not Sliver. Not Cobalt. Not stock Adaptix.
I opened plugandpwn.com with a Rubber Ducky on the desk and a stupid hope in my heart. Ten minutes later the hope was gone. Different USB device. Different primitive. Different trust boundary. Here is the teaching cut.
PDFs I actually reopen. Shelf notes in my voice, then the book.
Alex Matrosov, Eugene Rodionov, and Sergey Bratus
The book I hand people when they ask why the kernel still believes the firmware. Boot path, UEFI, and the malware that lives underneath the OS you thought you were analyzing.
Michael Sikorski and Andrew Honig
The lab book everyone claims they finished. Static, dynamic, packing, and the first time a sample lies to you on purpose.
Four lanes. Same standard: enough technical depth to be useful, without turning the site into a drop.
Fresh findings, coordinated when they need to be, written when they are ready.
What the advisory left out — leftover packages, composition, and still-live primitives.
Loaders, C2, host fitness, persistence. Behavioral tells a SOC can actually use.
Composition, vendor logic, and the ugly leftovers that do not fit a tidy label.