Operation Black Wing: A Qilin Ransomware Affiliate Engagement Against an East African Logistics ProviderIn late 2025 we investigated a ransomware engagement against a financial-logistics company in East Africa, here pseudonymised as NEXUS FREIGHT LTD. The investigation began as a routine "confirm the faApr 28 · 39 min readcxnrvd.hashnode.dev
Technical Blog: Dissecting Mallox Ransomware Deployment via MS-SQL Exploitation and CryptominingSummary Mallox ransomware operators exploit vulnerabilities in MS-SQL and ODBC interfaces to gain initial access. The threat actors deploy malicious batch scripts to execute ransomware and XMRig cryptominers. Advanced fileless execution techniques...Jan 2, 2025 · 4 min readcxnrvd.hashnode.dev
Day 8: ShellCodeA Hacker’s Lesson: Writing Shellcode and Creating a Reverse Shell Glitch, a skilled but mistrusted hacker, was prepping for a tech conference. He was eager to share his shellcode script that remotely accessed his home system. As he worked, he noticed...Dec 24, 2024 · 3 min readcxnrvd.hashnode.dev
Day 7: AWS Log Analysis WalkthroughDay 7's challenge focuses on AWS log analysis, providing hands-on experience in identifying anomalous activities within cloud environments. We dived into the investigation of AWS logs using CloudWatch, CloudTrail, and JQ—three powerful tools that are...Dec 22, 2024 · 4 min readcxnrvd.hashnode.dev
Day 6: SandboxesLearning Objectives Today, we’ll learn how to: Analyze malware behavior using sandbox tools Explore how to use YARA rules to detect malicious patterns Understand various malware evasion techniques Implement an evasion technique to bypass YARA rul...Dec 22, 2024 · 4 min readcxnrvd.hashnode.dev
