Matthew Brennan

A suspicious .vbs script persisting via scheduled task led Huntress SOC analysts to a heavily obfuscated AsyncRAT loader. Here are the advanced CyberChef techniques they used to pull it apart.

Most attackers use Cobalt Strike's default API hashing settings, and detection vendors know it. Here's Huntress' research on how that detection logic works and what happens when attackers change the defaults.

A Python malware loader was hiding in plain sight and it came packaged with a friendly RAT. Huntress traces the full infection chain from the shady script to what it was designed to deliver.

A suspicious run key led Huntress analysts down a rabbit hole — and at the bottom was Cobalt Strike hidden across nearly 700 registry values in multiple layers of obfuscation. Here's the full analysis.