<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Anna Širokova &#8211; Noise</title>
	<atom:link href="https://noise.getoto.net/author/anna-sirokova/feed/" rel="self" type="application/rss+xml" />
	<link>https://noise.getoto.net</link>
	<description>The collective thoughts of the interwebz</description>
	<lastBuildDate>Mon, 17 Aug 2026 11:29:31 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=7.1.3</generator>
	<item>
		<title>Operation ASTERIX: Anatomy of a Crypto Fraud Pipeline</title>
		<link>https://noise.getoto.net/2026/08/17/operation-asterix-anatomy-of-a-crypto-fraud-pipeline/</link>
		
		<dc:creator><![CDATA[Anna Širokova]]></dc:creator>
		<pubDate>Mon, 17 Aug 2026 11:29:31 +0000</pubDate>
				<category><![CDATA[artificial intelligence]]></category>
		<category><![CDATA[Phishing]]></category>
		<guid isPermaLink="false">http://noise.getoto.net/?guid=bd034757771a856155de3b535b5c2c8b</guid>

					<description><![CDATA[Operation ASTERIX overviewRapid7 researchers identified an exposed web directory on infrastructure used to support a cryptocurrency fraud operation. The server contained raw phone-number datasets, account-validation tools, enriched lead records, phishi...]]></description>
		
		
		<enclosure url="https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt83e3180716d766f0/69b180eb669f1ce1a02fe1aa/Purple-teaming-in-2026-hero.jpg" length="0" type="" />

			</item>
		<item>
		<title>From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware Delivery Lab</title>
		<link>https://noise.getoto.net/2026/07/20/from-a-single-alert-to-1000-files-inside-an-exposed-webdav-malware-delivery-lab/</link>
		
		<dc:creator><![CDATA[Anna Širokova]]></dc:creator>
		<pubDate>Mon, 20 Jul 2026 13:00:00 +0000</pubDate>
				<category><![CDATA[Labs]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[Phishing]]></category>
		<guid isPermaLink="false">http://noise.getoto.net/?guid=c6d4cf3e2a2faf7b48f4694d6e758f00</guid>

					<description><![CDATA[Executive summaryAn MDR alert recently led our team to an exposed server that was doing more than hosting payloads. It was functioning as a fully operational malware delivery lab. Containing over 1,000 artifacts, the infrastructure served as a QA hub w...]]></description>
		
		
		<enclosure url="https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt83e3180716d766f0/69b180eb669f1ce1a02fe1aa/Purple-teaming-in-2026-hero.jpg" length="0" type="" />

			</item>
		<item>
		<title>Malware à la Mode: Tracking Dropping Elephant Tradecraft Through a China-Themed Loader Chain</title>
		<link>https://noise.getoto.net/2026/06/17/malware-a-la-mode-tracking-dropping-elephant-tradecraft-through-a-china-themed-loader-chain/</link>
		
		<dc:creator><![CDATA[Anna Širokova]]></dc:creator>
		<pubDate>Wed, 17 Jun 2026 11:20:10 +0000</pubDate>
				<category><![CDATA[Labs]]></category>
		<category><![CDATA[Malware]]></category>
		<guid isPermaLink="false">http://noise.getoto.net/?guid=3fd23de85d1c1afdfc20d775ad2007d6</guid>

					<description><![CDATA[Executive summaryRapid7 researchers have identified a sophisticated malware campaign attributed to the threat actor "Dropping Elephant," characterized by the use of a China-themed decoy document to deliver a heavily reworked, in-memory remote access tr...]]></description>
		
		
		<enclosure url="https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt83e3180716d766f0/69b180eb669f1ce1a02fe1aa/Purple-teaming-in-2026-hero.jpg" length="0" type="" />

			</item>
		<item>
		<title>When IT Support Calls: Dissecting a ModeloRAT Campaign from Teams to Domain Compromise</title>
		<link>https://noise.getoto.net/2026/05/13/when-it-support-calls-dissecting-a-modelorat-campaign-from-teams-to-domain-compromise/</link>
		
		<dc:creator><![CDATA[Anna Širokova]]></dc:creator>
		<pubDate>Wed, 13 May 2026 14:44:02 +0000</pubDate>
				<category><![CDATA[Labs]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[research]]></category>
		<guid isPermaLink="false">http://noise.getoto.net/?guid=4d598a6570bc319ee151576034893365</guid>

					<description><![CDATA[OverviewAttackers do not need to break into the front door when they can convince employees to open it for them through the tools they already trust.In April 2026, Rapid7 investigated an enterprise intrusion that began with a Microsoft Teams message fr...]]></description>
		
		
		<enclosure url="https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt83e3180716d766f0/69b180eb669f1ce1a02fe1aa/Purple-teaming-in-2026-hero.jpg" length="0" type="" />

			</item>
		<item>
		<title>Kyber Ransomware Double Trouble: Windows and ESXi Attacks Explained</title>
		<link>https://noise.getoto.net/2026/04/21/kyber-ransomware-double-trouble-windows-and-esxi-attacks-explained/</link>
		
		<dc:creator><![CDATA[Anna Širokova]]></dc:creator>
		<pubDate>Tue, 21 Apr 2026 14:15:23 +0000</pubDate>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[ransomware]]></category>
		<guid isPermaLink="false">http://noise.getoto.net/?guid=590c8f8535973b2ae42a15795af5ed39</guid>

					<description><![CDATA[OverviewFor executive leadership, the emergence of Kyber ransomware represents a significant and immediate threat due to its specialized, dual-platform deployment capability targeting mission-critical virtualization infrastructure (VMware ESXi) and cor...]]></description>
		
		
		<enclosure url="https://images.contentstack.io/v3/assets/blte4f029e766e6b253/blt4180d9ccc3a54fb5/69aed6f8cb63a70008936e97/card-red-blue-purple-teaming.jpg" length="0" type="" />

			</item>
		<item>
		<title>NSIS Abuse and sRDI Shellcode: Anatomy of the Winos 4.0 Campaign</title>
		<link>https://noise.getoto.net/2025/05/22/nsis-abuse-and-srdi-shellcode-anatomy-of-the-winos-4-0-campaign/</link>
		
		<dc:creator><![CDATA[Anna Širokova]]></dc:creator>
		<pubDate>Thu, 22 May 2025 12:00:00 +0000</pubDate>
				<category><![CDATA[Labs]]></category>
		<category><![CDATA[Malware]]></category>
		<category><![CDATA[research]]></category>
		<guid isPermaLink="false">http://noise.getoto.net/?guid=e5222165da12733735fb6b8bc6d0ba29</guid>

					<description><![CDATA[Rapid7 has been tracking a malware campaign that uses fake software installers disguised as popular apps like VPN and QQBrowser—to deliver Winos v4.0, a hard-to-detect malware that runs entirely in memory and gives attackers remote access.]]></description>
		
		
		<enclosure url="https://blog.rapid7.com/content/images/2025/05/GettyImages-1307354522.jpg" length="0" type="" />

			</item>
		<item>
		<title>A Bag of RATs: VenomRAT vs. AsyncRAT</title>
		<link>https://noise.getoto.net/2024/11/21/a-bag-of-rats-venomrat-vs-asyncrat/</link>
		
		<dc:creator><![CDATA[Anna Širokova]]></dc:creator>
		<pubDate>Thu, 21 Nov 2024 17:19:50 +0000</pubDate>
				<category><![CDATA[Malware]]></category>
		<category><![CDATA[research]]></category>
		<category><![CDATA[Threat Intel]]></category>
		<guid isPermaLink="false">http://noise.getoto.net/?guid=fde74b553faeea9623dd0b5575177029</guid>

					<description><![CDATA[Remote access tools (RATs) have long been a favorite tool for cyber attackers, since they enable remote control over compromised systems and facilitate data theft, espionage, and continuous monitoring of victims. Among the well-known RATs are VenomRAT and AsyncRAT.]]></description>
		
		
		<enclosure url="https://blog.rapid7.com/content/images/2024/11/GettyImages-2167356719.jpg" length="0" type="" />

			</item>
		<item>
		<title>Exploring the (Not So) Secret Code of Black Hunt Ransomware</title>
		<link>https://noise.getoto.net/2024/02/05/exploring-the-not-so-secret-code-of-black-hunt-ransomware/</link>
		
		<dc:creator><![CDATA[Anna Širokova]]></dc:creator>
		<pubDate>Mon, 05 Feb 2024 19:08:15 +0000</pubDate>
				<category><![CDATA[ransomware]]></category>
		<guid isPermaLink="false">http://noise.getoto.net/?guid=ad81b8ac3ba63d8024571a2656967360</guid>

					<description><![CDATA[In this analysis we examined the BlackHunt sample shared on X (formerly Twitter). During our analysis we found notable similarities between BlackHunt ransomware and LockBit, which suggested that it uses leaked code of Lockbit. In addition, it uses some techniques similar to REvil ransomware.]]></description>
		
		
		<enclosure url="https://blog.rapid7.com/content/images/2024/02/GettyImages-1128503636.jpg" length="0" type="" />

			</item>
	</channel>
</rss>

<!--
Performance optimized by W3 Total Cache. Learn more: https://www.boldgrid.com/w3-total-cache/?utm_source=w3tc&utm_medium=footer_comment&utm_campaign=free_plugin

Object Caching 23/60 objects using Memcached
Page Caching using Disk: Enhanced 
Lazy Loading (feed)
Database Caching using Memcached

Served from: noise.getoto.net @ 2026-10-26 12:40:22 by W3 Total Cache
-->