Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool

Discover how Iranian-nexus threat cluster TAG-182 uses MarkiRAT malware and fake VPN/media apps to conduct cyber surveillance operations against domestic targets.

https://www.recordedfuture.com/research/nexus-tag182-disseminates-markirat

https://assets.recordedfuture.com/insikt-report-pdfs/2026/cta-ir-2026-0701.pdf


🎖@malwr

Context Engineering | Compaction & Agent Memory for Automated Malware Analysis

Compaction cut input tokens 86% across long-running agent evals with no quality loss. Context discipline matters as much as model selection.

https://www.sentinelone.com/labs/context-engineering-compaction-agent-memory-for-automated-malware-analysis/


🎖@malwr

Reverse Engineering Warframe’s Anti-Cheat System
Warframe is the hit MMO game by Digital Extremes which is adored by many, being a curious Reverse Engineer I thought why not have a go at…

https://medium.com/@ssushruth2003/reverse-engineering-warframes-anti-cheat-system-aae5e6272a4b


🎖@malwr

Win x64 Shellcode – Part 2: TEB, PEB and List of Loaded Modules
In the previous part, we explained why shellcode cannot use statically written addresses of Windows API functions. The solution lies in the structures that Windows maintains directly in the memory of each process. Today we will look at them closely.
Prerequisites Before reading this part, it is advisable to read and understand the previous part. At the same time, it is highly advisable to have at least a basic understanding of what virtual memory and a pointer are.

https://proteqtum.com/posts/02-win-x64-shellcode-teb-peb_en/


🎖@malwr

How I broke Rhysida ransomware encryption
Rhysida derives every per-file AES key from a PRNG seeded with the encryption timestamp. Recover the timestamp and you regenerate every key. A reverse-engineering walkthrough and a minimal decryptor.

https://sigreturn.com/blog/rhysida-analysis-decryption/


🎖@malwr

Don’t eat the ChocoPoCs! Vulnerability researchers were targeted by trojanised exploits
A suspicious contribution request led YesWeHack and Sekoia researchers to uncover sophisticated malware targeting the vulnerability research supply chain.

https://www.yeswehack.com/news/chocopocs-vulnerability-researchers-trojanised-exploits?utm_source=reddit&utm_medium=social&utm_campaign=chocopocs-vulnerability-researchers


🎖@malwr

Accelerating EDR Evasion with LLM-Driven Analysis
SpecterOps reverse engineered Cortex XDR with LLMs to extract YARA rules, ML models, and behavioral detections.

https://specterops.io/blog/2026/06/29/llm-powered-edr-analysis/


🎖@malwr

The Gentlemen RaaS: rapid growth and a new ransomware variant
Kaspersky researchers analyze incidents related to The Gentlemen RaaS group, disclose their tools and TTPs, and find a new ransomware variant.

https://securelist.com/the-gentlemen-raas/120447/


🎖@malwr