Research Archive
Browse entries by research type, time, topic, and threat domain. This page behaves more like an archive than a feed.
A macOS stealer can copy Telegram Desktop's tdata directory and Telegram for macOS's local session files to another machine, restoring the logged-in state without triggering phone verification, SMS codes, or 2FA. An honest account of the discovery and the cognitive shift from 'this shouldn't happen' to 'but it does.'
After nearly a month of forensic investigation into multiple cryptocurrency exchange breaches, I and 23pds confirmed the attacker as Lazarus Group. This article discloses the complete set of IOCs and TTPs, including social engineering entry, PyYAML RCE backdoor deployment, and lateral movement to wallet servers.
In May 2024, a malicious Chrome extension disguised as an Aggr trading tool was found stealing users' cookies from all websites. The attacker embedded malicious code inside a jQuery file, exfiltrating cookie data to a Russian-language server and using wash trading to steal users' crypto assets. The hacker began plotting 3 years ago, deployed the attack 4 months ago, and leveraged KOLs for promotion.
On August 18, 2022, Celer Network cBridge suffered a BGP Hijacking attack. The attacker hijacked the underlying Internet routing protocol to redirect cross-chain users to a malicious frontend. Through certificate analysis, AS routing tracing, and BGP Trace records, the SlowMist security team confirmed this was a targeted BGP hijacking attack against Celer Network.
On August 3, 2022, a large-scale theft occurred on the Solana blockchain. Slow Mist Security Team analysis found that Slope Wallet Android >= 2.2.0 sent user mnemonic phrases and private keys to the o7e.slope.finance server via Sentry services, causing the mnemonic phrases of approximately 30% of victim addresses to be leaked.