InfoSec 2025.04.28 - 2025.05.04

Yara

https://yarahq.github.io/

• Github
• Public Yara rule collection

AI & LLM

https://github.com/WithSecureLabs/damn-vulnerable-llm-agent

• for practicing prompt injection
• Github
• 練習 LLM Prompt Injection 的靶機

https://snyk.io/articles/what-is-rag-and-how-to-secure-it/

• Blog
• Introduction to RAG and related security aspects

https://github.com/transformerlab/transformerlab-app

• Github
• Easy to capture and fine-tune any model on your own computer

C2

https://www.darkentry.net/blogs/how-c2-works-in-depth-part-3

• Blog
• Exploring how C2 works

Red Team

https://cyberdom.blog/inside-the-microsoft-teams-attack-matrix-unpacking-the-the-frontier-in-collaboration-threats/

• Attackers use techniques like token hijacking, app abuse, and shared channels for access, movement, exfiltration, and C2, mapped in the Teams Attack Matrix
• Blog
• Microsoft Teams 成主要目標，攻擊者用令牌劫持、應用程式和共享頻道等手法。

Malware

https://www.esentire.com/blog/the-long-and-shortcut-of-it-koiloader-analysis

• Blog
• lnk -> KOILOADER varieant

https://thedfirreport.com/2025/04/28/navigating-through-the-fog/

• Blog
• An exploration of Cybersecurity incident analysis related to the Fog ransomware group, featuring a detailed Diamond Model

https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/

• Cisco Blog
• Gamaredon campaign use lnk -> Remcos backdoor

https://www.welivesecurity.com/en/eset-research/thewizards-apt-group-slaac-spoofing-adversary-in-the-middle-attacks/

• blog
• THEWIZARDS APT group and the WizardNet malware

https://www.gdatasoftware.com/blog/2025/04/38169-vidar-stealer

• blog
• Vidar Stealer analysis article

Reversing

https://0xreverse.com/tracing-and-manipulating-anti-analysis-techniques-with-dynamorio

• Blog
• Using DynamoRIO for reversing engineering programs

Related to cybersecurity automation

https://www.cybersec-automation.com/

• blog
• Many articles explore using automation to perform cybersecurity tasks