---
title: "Nigmaz (@nigmao) | Hashnode"
description: "Nigmaz (@nigmao) writes on Hashnode. Read their latest articles and follow their work."
url: "https://hashnode.com/@nigmao"
---

@nigmao

# Nigmaz

@nigmao · Joined April 2025

### [EtherRAT phát tán qua giả mạo hỗ trợ IT trên Microsoft Teams: Smart contract Ethereum làm cơ chế phân giải C&C](https://bluecyber.hashnode.dev/etherrat-malware-bootcamp2026?utm_source=hashnode&utm_medium=feed)

Threat Intelligence : Bài viết này được phân tích và tổng hợp nhằm chuẩn bị cho bài thuyết trình của công ty mình tại Security Bootcamp 2026 - tổ chức tại TP. Buôn Ma Thuột, tỉnh Đắk Lắk từ ngày 10-12

39 min read · [bluecyber.hashnode.dev](https://bluecyber.hashnode.dev/etherrat-malware-bootcamp2026?utm_source=hashnode&utm_medium=feed)

[Oct 18](https://hashnode.com/posts/etherrat-malware-bootcamp2026/6ad4c30769d6ebd097e05f45)

### [MUSTANG PANDA x PLUGX - Analysis of the January 2026 sample: a multi-layer execution chain](https://bluecyber.hashnode.dev/mustang-panda-x-plugx-analysis-of-the-january-2026-sample-a-multi-layer-execution-chain?utm_source=hashnode&utm_medium=feed)

TL;DR. The malware sample uses the three-file set Avk.exe, Avk.dll, and AVKTray.dat, deployed from an MSI file downloaded by Browser\_Updater.exe. The execution chain starts with DLL sideloading throug

35 min read · [bluecyber.hashnode.dev](https://bluecyber.hashnode.dev/mustang-panda-x-plugx-analysis-of-the-january-2026-sample-a-multi-layer-execution-chain?utm_source=hashnode&utm_medium=feed)

[May 26](https://hashnode.com/posts/mustang-panda-x-plugx-analysis-of-the-january-2026-sample-a-multi-layer-execution-chain/6a1514eb7d85e6a1af2ff42b)

### [APT Earth Baxia - Charon Ransomware: An In-Depth Analysis](https://bluecyber.hashnode.dev/apt-earth-baxia-charon-ransomware-an-in-depth-analysis?utm_source=hashnode&utm_medium=feed)

Charon is a sophisticated ransomware strain associated with the Earth Baxia APT group. This report dissects its TTPs end‑to‑end: DLL sideloading, multi‑layer shellcode staging, process hollowing into svchost.exe, pre‑encryption anti‑recovery/defense‑...

14 min read · [bluecyber.hashnode.dev](https://bluecyber.hashnode.dev/apt-earth-baxia-charon-ransomware-an-in-depth-analysis?utm_source=hashnode&utm_medium=feed)

[Dec 27, 2025](https://hashnode.com/posts/apt-earth-baxia-charon-ransomware-an-in-depth-analysis/694fbb376eb2e3ab8ba47d79)