AMIR S.

Aug 31, 2026

What does it actually look like when a state-sponsored actor digs in and hides? 🐻🚨

I recently led the triage for a high-severity escalation involving the Zebrocy framework—a signature tool of the APT28 (Fancy Bear) espionage group. Working through this simulated incident response scenario provided a deep dive into the sophisticated evasion tactics and reconnaissance patterns used by top-tier adversaries.

My latest L2 Incident Response Write-up deconstructs the entire lifecycle, from the initial breach to final containment. Understanding these advanced TTPs isn't just a technical exercise; it’s essential for hardening our defenses against real-world nation-state threats.

Key technical highlights from the investigation:

🔹 **Delivery Evasion:** Using password-protected archives with credentials hidden in the phishing body to neutralize automated email gateway scanning.

🔹 **Environmental Awareness:** Analyzing how the malware utilizes complex PowerShell CIM queries to detect AWS, Xen, or Citrix hardware artifacts and terminate in virtualized/sandbox environments.

🔹 **Living off the Land (LotL):** Mapping the process lineage as the actor leveraged native Windows utilities (silcollector.cmd, TASKLIST) and dropped secondary payloads into AppData\Local\Temp to circumvent permission sets.

By mapping these behaviors to the MITRE ATT&CK framework, we can build more resilient detection engineering and streamline SOC workflows.

📄 I’ve attached the full Incident Response Report below, featuring the complete forensic timeline, process tree analysis, and extracted IoCs.

https://github.com/Mehrshad-sh1382/SOC-Writeups-Reports/blob/main/1)%20SOC%20L2%20331%20Report.pdf

Blue Teamers: What is your primary strategy for catching evasive, multi-stage malware like Zebrocy before it successfully establishes a C2 heartbeat? Let’s discuss in the comments! 👇

#CyberSecurity #IncidentResponse #SOC #ThreatHunting #APT28 #BlueTeam #MalwareAnalysis #LetsDefend #InfoSec

View post

Aug 25, 2026

[celebration:new_certification]Has successfully verified **The Structured Query Language (SQL)** (University of Colorado ) and **Certified in Cybersecurity** (ISC²)

View post