Mustang Panda targets India's government and energy sectors with ZOHOMURK and MINIRECON
Acronis Threat Research Unit (TRU) has been tracking two concurrent campaigns orchestrated by Mustang Panda targeting Indian government entities, delivering new malware implants and abusing Zoho WorkDrive, a legitimate cloud storage platform commonly used in the Indian government sector.

https://www.acronis.com/en/tru/posts/mustang-panda-targets-indias-government-and-energy-sectors/


🎖@malwr

CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)
Well, well, well - once again, the cat has dragged us in and spat us out.

Today, we find ourselves questioning the reality we sit within. Must it be so predictable, and why us? “But watchTowr, what do you mean?”

Well, if you’re here, you likely fit into one of

https://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451/


🎖@malwr

Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool

Discover how Iranian-nexus threat cluster TAG-182 uses MarkiRAT malware and fake VPN/media apps to conduct cyber surveillance operations against domestic targets.

https://www.recordedfuture.com/research/nexus-tag182-disseminates-markirat

https://assets.recordedfuture.com/insikt-report-pdfs/2026/cta-ir-2026-0701.pdf


🎖@malwr

Context Engineering | Compaction & Agent Memory for Automated Malware Analysis

Compaction cut input tokens 86% across long-running agent evals with no quality loss. Context discipline matters as much as model selection.

https://www.sentinelone.com/labs/context-engineering-compaction-agent-memory-for-automated-malware-analysis/


🎖@malwr

Reverse Engineering Warframe’s Anti-Cheat System
Warframe is the hit MMO game by Digital Extremes which is adored by many, being a curious Reverse Engineer I thought why not have a go at…

https://medium.com/@ssushruth2003/reverse-engineering-warframes-anti-cheat-system-aae5e6272a4b


🎖@malwr

Win x64 Shellcode – Part 2: TEB, PEB and List of Loaded Modules
In the previous part, we explained why shellcode cannot use statically written addresses of Windows API functions. The solution lies in the structures that Windows maintains directly in the memory of each process. Today we will look at them closely.
Prerequisites Before reading this part, it is advisable to read and understand the previous part. At the same time, it is highly advisable to have at least a basic understanding of what virtual memory and a pointer are.

https://proteqtum.com/posts/02-win-x64-shellcode-teb-peb_en/


🎖@malwr

How I broke Rhysida ransomware encryption
Rhysida derives every per-file AES key from a PRNG seeded with the encryption timestamp. Recover the timestamp and you regenerate every key. A reverse-engineering walkthrough and a minimal decryptor.

https://sigreturn.com/blog/rhysida-analysis-decryption/


🎖@malwr