In public
We do not publish client names. We publish research.
Our work in public is devoted to the techniques adversaries actually use, and to the means by which defenders can recognize them.
Every dossier is written from first-hand analysis of the sample or system in question, never from summaries of other people's work.
Featured dossier
Malware Analysis
ZB-R-2026-01
A 64-bit .NET assembly that mounts the EFI System Partition and enumerates kernel security features, behavior rarely seen outside bootkits. We take it apart across five parts, from the logic that triggers it to the capability it carries but never uses.
Sample
SHA-256
Tooling
In five parts
ZB-R-2026-01
Malware Analysis
A 64-bit .NET assembly that mounts the EFI System Partition and enumerates kernel security features, behavior rarely seen outside bootkits. We take it apart across five parts, from the logic that triggers it to the capability it carries but never uses.
In preparationZB-R-2026-02
Identity
How Microsoft's family of client IDs allows a single refresh token to be exchanged across first-party applications, how role-assignable groups widen what an intruder can reach, and what defenders can watch for.
ForthcomingZB-R-2026-03
Malware Analysis
A rootkit written in C#, decompiled and examined to show how malicious code is borrowed, adapted and redeployed, and why reuse leaves fingerprints a defender can follow.
ForthcomingTechnical dissections of malware families, from loaders to rootkits, with the detections to match.
Attack paths across Active Directory and Microsoft Entra ID, and the means to close them.
YARA, Sigma and Suricata rules derived from our own analyses, written to be deployed rather than admired.
What applications and their embedded SDKs quietly collect and transmit.
YARA · Sigma · Suricata
The rules that emerge from our dossiers will be published openly, for any defender to deploy in their own environment.
By request
Receive each dossier before it is published, together with its detection rules. Distribution is by request only, and the list is never shared.
A senior member of our team responds personally within 48 hours, under NDA should you prefer.
Request a Private Briefing