Yurei: A New Ransomware Threat
New Yurei ransomware shows how flawed open-source threats still cause real harm.
Resources
A lot is happening, and we’re moving at a fast pace. Keep up with it all here.
Building on CISA’s Salt Typhoon YARA Rules: Stairwell finds 637 New Variants
Stairwell expands CISA’s Salt Typhoon YARA rules, uncovering 637 new malware variants.
How to Detect NPM Package Manager Supply-Chain Attacks with YARA
New npm supply-chain YARA rules out—chalk/debug + Shai-Hulud worm. Retrohunt now!
CastleBot: YARA Rule for Core Backdoor
Detecting CastleBot: YARA insights on TAG-150’s modular backdoor.
Are your SVGs Malicious? Hiding malware in your graphics files
SVGs are malware’s newest disguise—Stairwell spots what your filters miss.
A YARA Rule for Threat Hunting DarkCloud Stealer
Threat hunting YARA rule for DarkCloud stealer and related malware variants.
RedDirection: A YARA Rule to Detect its Artifacts
Detect RedDirection’s Chrome/Edge malware with Stairwell’s YARA rule
ToolShell: Revealing Webshell Malware Variants and a New YARA Rule
Detecting ToolShell webshell variants in SharePoint attacks using YARA and Hilbert curves.
Reverse Engineering Malware 101: Getting Started with macOS Reversing
Getting started with macOS malware reversing using open-source tools like Ghidra and Radare2.
Prometei Evolves: Stairwell identifies new variants and publishes 3 new YARA rules
New YARA rules released as Stairwell exposes 53 stealthy Prometei variants.
Detecting TodoSwift
Detect Swift-based macOS malware with our TodoSwift YARA rule and instant file search.
Are These 18 Malicious Browser Extensions on Your Organization’s Devices?
18 verified browser extensions were malware—Stairwell finds them on devices in seconds.
Detecting defendnot: A Tool for Silently Disabling Windows Defender
Stealthy tool disables Windows Defender via WSC API—Stairwell offers YARA rule for detection.
Proactive downgrade protection: Keeping your systems protected from hidden vulnerabilities
Prevent hidden threats with Stairwell’s Downdate downgrade protection system.
What You Need to Know About OpenSSH Vulnerability and New Vulnerable Scenario
Background on the new OpenSSH vulnerability and how Stairwell can help
