Skip to content

Intezer Research

Malware analysis, threat research, and reverse engineering, written by the analysts doing the work.

Intezer’s Research Team publishes its work here: deep-dive write-ups on the malware families, campaigns, and threat actors we track, alongside the practical guides we wish we’d had when we started. Every analysis is built on real samples and real incidents.

  • Blog - Technical analyses of malware and threat actor activity, from Linux rootkits and cloud attacks to phishing campaigns, APT tooling, and the security of AI developer tools.
  • Knowledge Base - Practical guides to malware analysis and reverse engineering, from first-time triage through ELF internals, .NET assemblies, memory forensics, and phishing URL analysis.
  • Presentations - Talks from our team at Virus Bulletin, Black Hat, x33fcon, BSides, and other conferences.

Featured Content

When the AI Edits Its Own Trust Boundary: Remote Code Execution Vulnerability in AWS's Agentic IDE

We discovered a remote code execution vulnerability in Kiro, AWS’s agentic IDE. By planting hidden instructions in a web page Kiro reads, an attacker can make it rewrite its own MCP configuration file (~/.kiro/settings/mcp.json) and launch malicious code, bypassing the user-approval boundary meant to stop risky actions. A routine request like “summarize this page” becomes silent code execution on the developer’s machine. AWS has patched the flaw, so update Kiro to the latest version.

Two Trojan Families Trotting in Through Google Search Ads

Two malware families spread via Trojanized utility apps (PDF and file converters) promoted through Google search ads. SilentMare is a downloader that acts as a beachhead, active since 2024 across three generations; it swaps implementation languages but keeps the same pattern: a daily-checking updater that loads AES-encrypted .NET payloads directly from memory. HollowMare is a PUA that force-installs browser extensions or hijacks the default search engine. Their infrastructure overlaps, but shared authorship isn’t confirmed.

OrBit (Re)turns: Tracking an open-source Linux rootkit across four years of forks and deployments

In July 2022, we published the first analysis of OrBit, a then-undocumented Linux userland-rootkit that stood out for its comprehensive libc hooking, SSH backdoor access, and PAM-based credential harvesting. At the time, OrBit appeared as a single sample with a single operator fingerprint, and the codebase itself looked customized.

Tracing a Paper Werewolf campaign through AI-generated decoys and Excel XLLs

An XLL is a native Windows DLL that Excel loads as an add-in, allowing it to execute arbitrary code through exported functions like xlAutoOpen. Since at least mid-2017, threat actors began abusing Microsoft Excel add-ins via the .XLL format, the earliest documented misuse is by the threat group APT10 (aka Stone Panda / Potassium) injecting backdoor payloads via XLLs.