c-b.io | RE // DFIR // CTF

Cloudy With A Chance Of Compromise: How A Skid Ransoms Your Buckets

Sat, 04 Apr 2026 00:00:00 +0000

Preface

If you spend any amount of time in infosec circles, you’ll notice that the vast majority of offensive research is still centered around endpoint malware, Active Directory abuse, EDR evasion and auth-provider shenanigans. That makes sense though! That’s where the industry mostly grew up. The tooling ecosystem around AD alone is absurd; BloodHound, Mimikatz, Rubeus, Impacket, CrackMapExec, the list goes on and on.

Meanwhile, cloud offensive tooling is still pretty fragmented. There’s no unified kill chain equivalent to the BloodHound-to-Mimikatz-to-CrackMapExec pipeline that AD pentesters take for granted. SentinelOne noted there are “far fewer references to scripts designed to perform ransom attacks directly on cloud services” and 74% of organizations still report a shortage of qualified cloud security professionals¹. Cloud security is still treated as the nerdy cousin nobody invites to dinner.

does-not-exist-bucket exists now and it's mine

Sat, 28 Mar 2026 00:00:00 +0000

As someone who’s got the great misfortune of working very closely with Cloud providers (namely AWS, Azure & GCP, the unholy trinity) I’m well aware that there’s a bunch of stuff that’s vulnerable out there for various reasons.

AWS, as a whole, is an unfathomably complex ecosystem. They offer an absolutely insane amount of flexibility and ways to quite literally shoot yourself in the foot. It often looks somewhat simple at the surface, but when you start looking under the hood you see just how weird some things are. Some underlying mechanisms are ported from one system to another, but the migration was only half-done so key features are missing in one place but not another. You think you see the full picture by enabling X but after looking through the logs you realize you’re missing a bunch of stuff and after REALLY reading the doc, you realize you also need to enable Y.

Getting SaaSy with SIEMs — Introduction

Sun, 25 Jan 2026 00:00:00 +0000

Welcome! It's so good to finally have a SOC analyst, we've got so much work to do! I know this will be a lot for you as a junior since it's all we could afford but I'm sure you can figure it out. Anyways, you're probably wondering where our logs are eh? Well for compliance reasons we've essentially been dumping everything into an ELK stack (whatever that is) but have never actually made sense of all those logs...

Install Linters, Get Malware — DevSecOps Speedrun Edition

Sun, 20 Jul 2025 00:00:00 +0000

Recommend song to listen to while reading:

If you find something off with what I say, please let me know. I’ll gladly amend my content and credit you for the fix.

Some thanks in alphabetical order for all those who supported this blog post:

Bakki & Deluks for supporting my insane rambling.
Rad for helping me ID the initial phish as a Device Code phishing
Struppigel for helping us associate this sample to others.
Rajnikanth for the last second memes
cxiao for pointing us towards the second stage payload
And most importantly: Josh from InvokeRe for being an exceptional partner and a great mentor. Couldn’t have done this one without his big ol’ brain.

Preface

This blog post was written as a partnership with Josh at InvokeRE. Josh is an absolute beast and a fantastic teacher. If you’re curious about reverse engineering, binary ninja or IDA, he’s your guy. In a bind and need a team of cracked nerds to assess malware, create detection rules and reverse it? InvokeRE is there for you! Interested in some onsite or virtual training? You get the idea.

Supper is served

Thu, 15 Aug 2024 00:00:00 +0000

Recommend song to listen to while reading:

If you find something off with what I say, please let me know. I’ll gladly amend my content and credit you for the fix.

Some thanks in alphabetical order for all those who supported this blogpost:

AptAmoeba
Bakki
Deluks
Dingusxmcgee
Josh
Sean
Struppigel
Xorist
.Koozy
And more generally the InvokeRe community for being so encouraging

As part of my morning routine, I’ll usually check out what’s new in Malpedia. I’ve found the information posted there to be curated enough that I can usually make something useful out of the latest information that’s been added. Following my read on Supper, a somewhat new malware also known as the “Interlock Rat”, I kind of got nerd sniped by the fact it was known to be operated by a somewhat well-established entity (Vanilla Tempest/Vice Society).

Threat hunting for shits and giggles

Sun, 14 Jul 2024 00:00:00 +0000

I’ll start by saying this post is not endorsed by hunt.io. I just happen to be a really big fan of what they’re doing.

Some hackers suck at OpSec

Not all hackers are the smartest. If you’ve ever played with Shodan or Censys, you’ve most likely come across open directories. What’s an open dir? It’s essentially when you expose the entire root of your website. It’ll typically look something like this:

As you’ll see in this blogpost, sometimes hacker expose their entire /home/user directory which leads to some pretty interesting findings such as valid SSH keys, cobaltstrike configs and malware sample ripe with debug info. What a time to be alive!

Analyzing the RedTiger Malware Stealer

Mon, 10 Jun 2024 00:00:00 +0000

Today we’ll dive into a fresh malware stealer dubbed RedTiger, a sample targeting personal user data, particularly Discord tokens, browser-stored credentials, and gaming accounts. This stealer, like many others seen recently, heavily leverages Discord webhooks for Command & Control (C2).

SHA256: b8d1c0436023bf58ea7b0f530ea37ae67bac0e956d9c93376702b4832055e0fd Distributed as: Phantom X.exe Deobfuscated sample: https://github.com/cyb3rjerry/revengd-malware/tree/main/redtiger

How I found this sample

As usual, I grabbed this malware sample from tria.ge after spotting it flagged as malicious.

Initial Analysis

The sample is a Python-based malware script targeting Windows, easily recognizable from its initial imports:

Dissecting a fresh BlankGrabber sample

Wed, 22 May 2024 00:00:00 +0000

BlankGrabber is nothing new. It’s been documented by multiple companies such as ThreatMon, K7Security and has even had it’s source code disclosed on GitHub. So why exactly are we looking at a well documented and even reversed sample? Because there’s more than just the final payload. We a fresh unaltered sample, we get to look into how the sample gets dropped and loaded!

How I found this sample

If you’ve read other blogposts I wrote, you’ll know I’m no pro. I’m just a curious dude that’s starting to delve into the world of RE because malware has always fascinated me. Aside from the certification I’m currently working on, I really enjoy just grabbing random samples and figuring out how it works. One way of doing so is to simply go on tria.ge, look for public reports that got flagged as malicious and download it. Put simply and quickly, tria.ge is a free and public dynamic analysis tool that gives you information about a sample by actually detonating it. The results will include interesting details such as PCAPs, dropped files and Windows APIs used.