Skip to content
Nouman Ahmed

Research index

Research

Write-ups from real investigations — malware pulled apart, the infrastructure behind it mapped, and the detections that came out of it. Indicators are included, so you can check the work.

1 report publishedRSS feed

Lead report

TLP:CLEARTLP:CLEAR — Disclosure is not limited. This material may be shared publicly without restriction.

Halfmast Loader: Eleven Days Inside an Exposed Staging Directory

A world-readable build server, 1,184 logged check-ins, and a TLS certificate that has outlived three hosting providers.

Threat Research
  • Asia
9 minutes to read
  • Loader
  • Command & Control
  • Exposed Directory
  • Detection Engineering