Dutch Authorities Dismantle Botnet Linked to 17 Million Infected Devices

Dutch authorities have announced the takedown of a botnet that enslaved millions of infected devices, including computers, tablets, smartphones, and IoT devices, to carry out malicious attacks.

The bot network, per the Dutch Politie and the National Cyber Security Center (NCSC), consisted of at least 17 million infected devices. More than 200 servers located in the Netherlands acted as the

The Hacker News – ​Read More

Quantum computing looms, and your security is nowhere near ready

Quantum is coming soon to an enterprise near you. But that shift brings significant security concerns.

Latest news – ​Read More

This hidden FaceTime feature is incredibly useful – and surprised my own family

If someone missed your FaceTime call, try leaving them a video message. Here’s how.

Latest news – ​Read More

Malware Analysis: Is It About Tools or Mindset?

Malware Analysis: Is It About Tools or Mindset?

Malware over the past decades has become one of the most critical threats to various sectors and entities, ranging from normal endpoint devices to critical infrastructure and other organizations. Even most, if not all, of the final stages of each compromise rely on malware. Computer security researchers and malware analysts have developed different toolkits to understand malware samples and dissect them in order to understand their intent, functionalities, capabilities, stealth mechanisms, malware infrastructure, and more.

But the main question is: is malware analysis just about tools and premium kits for dissecting and inspecting malware? This is the mistake that most junior and even some other analysts fall into.

First, we need to understand what a tool or software actually is. In basic terms and definition, a tool or software is something programmed to make human daily tasks easier. For example, Microsoft Office Writer allows writing hundreds of pages that were once limited to classic paper, now with different page setup sizes for writing various articles and documents.

What lies behind the tool is the external or internal set of data used to parse and understand the structure. You can imagine that ransomware does not know what an extension is unless the malware author has already configured it to recognize it or inserted it into a list of extension datasets. Without those pre-hardcoded or configured lists of extensions, ransomware does not actually know what or which files to encrypt.

Tools work with the same mechanism and follow the same approach, only with different configurations.

Malware analysis, by nature, is a challenging and complex field to adapt to. Most tools were developed years ago; some are outdated, while others are still being updated and improved. However, we should not forget that most of them work based on signature detection to recognize things such as packers.

For example, if a packer is unknown, or if a malware author reverse-engineers the packer and modifies section names such as UPX1 or UPX0 into random names, the tools may be unable to recognize which packer was used to pack the malware sample.

That is where mindset plays a critical role in the analysis stage, because in malware analysis, most, if not all, tools are fundamentally the same.

Examples include: Pestudio, Detect It Easy, Strings, HxD, IDA, Ghidra, Process Hacker, Autoruns, Procmon, API Monitor, x64dbg, and so on.

In general terms, these tools are effective and sufficient to understand malware behavior, functionalities, and capabilities. But the most important aspect is how to use those tools and what exactly you need from them.

Nowadays, you may not see malware of interest like in past decades that attracted security firms and the industry to analyze and publish long PDF reports for the community. Malware has mostly become a business today, such as MaaS (Malware as a Service).

In addition, it is now quite rare to see malware with an interesting initial delivery vector.

Last but not least, one trap that many analysts fall into is becoming bored during malware analysis, and I do not blame them at all. This is because what is common nowadays are infostealers, weaponized Office documents exploiting CVE-2017-0199 or CVE-2017-11882, or PDF documents asking users to click a link to update their software.

Until this point, everything is fine.

What is not fine is when analysts do not have clear goals before analyzing malware. There are several questions an analyst should ask before even touching the malware sample:

1- Why should I analyze this malware?

2- What is my goal in analyzing this malware?

3- What do I need to look for inside this malware?

4- What tools are effective for this stage of analysis?

Malware analysis is not about having different virtual environments for different purposes and maintaining large analysis toolkits. In reality, you may not need all of those tools to inspect malware.

Having many tools in your arsenal is good, but one of the main issues that causes analysts to fail is tool switching.

For example, switching from x64dbg to OllyDbg raises the question: if you already have x64dbg, why do you need OllyDbg? If the answer is plugins, x64dbg also supports plugins.

If you have Strings, why do you need BinText?

If you have Ghidra or Iaito/Radare2, why do you need Cutter or Binary Ninja?

If you already have a pattern-matching tool, why do you need a separate URL revealer?

However, we should not ignore that each tool has its own advantages and disadvantages.

An analyst should adjust their mindset to inspect and dissect malware samples effectively.

What I have seen from many junior analysts nowadays, and what I also did at the beginning of my journey, is performing a quick review of the sample by dragging and dropping it into different tools and then immediately jumping into dynamic analysis.

Dynamic analysis often shows what malware is doing, at least in most non-sophisticated cases. However, there are still valuable indicators that may be missed during static analysis.

You may ask: “If the malware is packed or obfuscated, why not just jump directly into dynamic and network analysis?”

The answer is that dynamic analysis is not a “bibbidi-bobbidi-boo” solution that reveals everything.

There are still static analysis approaches you can follow:

1- Unpack the malware if the packer can be unpacked using a public open-source tool.

2- If the malware is obfuscated, connect small indicators and patterns together until they provide meaningful context.

3- Dump stack strings using FLOSS if the malware does not provide strings of interest.

4- Look for Windows API functions related to registry, networking, or file activities.

You can validate these approaches through advanced static analysis.

This can be useful when the malware does not act as a dropper, downloader, stager, or loader in most cases. Samples often have different structures, different hash values, different import address tables, and clearer plaintext strings. They may appear different, but they are still connected.

Another mindset analysts should build is: never trust, always verify. Do not assume. Look for evidence and avoid cognitive bias. Focus on facts.

You should never forget that malware analysis is a cat-and-mouse game. Malware authors do their best to misdirect analysts because once you are misdirected, your analysis may no longer provide meaningful results.

Some common misdirection techniques include:

1- Junk code

2- Dead code

3- Junk strings

4- Unusable Windows API functions

Finally, you must understand that as a malware analyst, whether junior or senior, malware analysis is not something you can fully learn in a few weeks, through one course, or by reading one book.

Malware analysis is a field of experience.

I believe it is one of the fields that requires more hands-on experience than many others, because malware authors continuously develop new techniques, new methodologies, and new approaches every day.

The more samples you analyze, the more experience you gain. Day by day, you will begin to feel the difference in your analysis process.

The last thing I want to say to junior analysts is that you may not immediately see or feel your progress. Usually, it takes months or even years to clearly notice how much you have grown in this field.

You can compare it to growing your hair longer; most visible changes only become noticeable after several months.

However, try to focus on the binary platform you want to specialize in, for example:

  • Windows malware analysis
  • Linux malware analysis
  • macOS malware analysis
  • Android malware analysis
  • iOS malware analysis

Each of these has its own approaches and methodologies.

The tools you use for Windows malware analysis may not be effective for Android malware analysis, and the same applies across other platforms.

Secjuice – ​Read More

I’m an iPhone user who switches to Gemini with Android Auto in the car – why I don’t regret it

Gemini can help with a variety of tasks when behind the wheel. All you need is an Android phone and a car with Android Auto.

Latest news – ​Read More

Fake Anthropic Sites Deliver Fileless Infostealer to Claude Code Users

Fake Anthropic websites are being used to target Claude Code users with a fileless infostealer campaign that steals browser credentials and evades detection.

Hackread – Cybersecurity News, Data Breaches, AI and More – ​Read More

Exploit Code Published for Critical Flowise RCE Vulnerability

The one-click vulnerability allows attackers to execute arbitrary code on self-hosted Flowise servers by tricking users into importing a malicious chatflow.

The post Exploit Code Published for Critical Flowise RCE Vulnerability appeared first on SecurityWeek.

SecurityWeek – ​Read More

Russian Spies Are Aggressively Seeking Western Technology as Sanctions Bite, Officials Say

Moscow’s agents are building fake companies, recruiting middlemen and deploying cyber spies and hackers who gather information that could be used to attack key infrastructure.

The post Russian Spies Are Aggressively Seeking Western Technology as Sanctions Bite, Officials Say appeared first on SecurityWeek.

SecurityWeek – ​Read More

I tried Microsoft’s Windows 365 Cloud PC on MacOS, Android, and iOS – here’s what it’s like

Who needs a Cloud PC, anyway? What’s the experience like? How much does it really cost? I’ve got answers to all those questions.

Latest news – ​Read More

Is Amazfit’s most premium smartwatch worth it? I tested it on the golf course, and it paid off

Amazfit is on a blistering pace for new watch releases in 2026 and for the past few weeks I’ve been using its new Cheetah 2 Pro for all of my activities.

Latest news – ​Read More