Hiding Data in Plain Sight: Building and Catching Network Covert ChannelsEvery layer of the network stack has fields and behaviors that exist for one narrow purpose — a padding byte, a subdomain label, a TTL counter — and almost none of them are checked for whether their cOct 22 · 8 min readviriviola.hashnode.dev
How EDR Actually Detects an AttackAn attacker does something malicious. Somewhere downstream of that action, a SOC analyst sees an alert. The interesting part isn't that this happens — it's everything that has to occur in between. ThiSep 21 · 10 min readviriviola.hashnode.dev
Renting the Infection: Inside Emotet's Rise from Banking Trojan to Malware Platform 2014Year Emotet first appeared1.6M+Infected computers identified (Apr 2020 – Jan 2021)~1,000%Increase in loader downloads during July–Aug 2020 resurgenceJan 2021International law enforcement takedown Sep 9 · 16 min readviriviola.hashnode.dev
Raspberry Robin: From USB Worm to Access-Broker InfrastructureRaspberry Robin started as a curiosity: a USB-borne worm with no obvious objective, first flagged by Red Canary in May 2022 and traced by Microsoft to activity as early as September 2021. Four years oAug 6 · 10 min readviriviola.hashnode.dev
QakBot: The Botnet That Refused to DieBased on FBI/DOJ Operation Duck Hunt documentation · CISA Advisory AA23-242A · August 2023 ![](file:///C:/Users/Alka/AppData/Local/Temp/msohtmlclip1/01/clip_image001.gif align="center") 700,000+InfectJul 22 · 13 min readviriviola.hashnode.dev
