NNigmazinbluecyber.hashnode.dev·May 26 · 35 min readMUSTANG PANDA x PLUGX - Analysis of the January 2026 sample: a multi-layer execution chainTL;DR. The malware sample uses the three-file set Avk.exe, Avk.dll, and AVKTray.dat, deployed from an MSI file downloaded by Browser_Updater.exe. The execution chain starts with DLL sideloading throug00
NNigmazinbluecyber.hashnode.dev·Dec 27, 2025 · 14 min readAPT Earth Baxia - Charon Ransomware: An In-Depth AnalysisCharon is a sophisticated ransomware strain associated with the Earth Baxia APT group. This report dissects its TTPs end‑to‑end: DLL sideloading, multi‑layer shellcode staging, process hollowing into svchost.exe, pre‑encryption anti‑recovery/defense‑...00
