AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
Æ / PUBLIC MALWARE INTELLIGENCE

Follow the evidence.

Published file metadata, source observations, indicators, and research history in one bounded catalog.

2,400+Reachable catalog records
20 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page

Feed collection status

Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.

2 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.

Review source update dates and status
  • intelligence_src_df9b41f49a7ab5cdddRecent successful batchLast successful batch: Last attempt:
  • intelligence_src_e03c0eb81ecbe60444Recent successful batchLast successful batch: Last attempt:

Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.

Clear filters
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
REPORT1 SOURCE

Detecting SSH Activity via Process Monitoring

In this guest blog post, the noted Mac security researcher/author Jaron Bradley explains how to detect (potentially malicious) SSH activity...via process monitoring and the analysis of process hierarchies.

First reported Dec 10, 2020 05:00 UTCCatalog metadata updated Oct 14, 2026 04:19 UTCOpen evidence record
REPORT1 SOURCE

Made in China: OSX.ZuRu

Attackers are leveraging trojanized appplications to spread malware, via sponsored search results.

First reported Sep 14, 2021 05:00 UTCCatalog metadata updated Oct 14, 2026 04:19 UTCOpen evidence record
REPORT1 SOURCE

OSX.Hydromac

In this guest blog post, the security researcher Taha Karim of ConfiantIntel, dives into a new macOS adware specimen: Hydromac.

First reported Jun 04, 2021 05:00 UTCCatalog metadata updated Oct 14, 2026 04:19 UTCOpen evidence record
REPORT1 SOURCE

Analyzing OSX.DazzleSpy

DazzleSpy is a fully-featured cyber-espionage macOS implant, installed via a remote Safari exploit!

First reported Jan 25, 2022 05:00 UTCCatalog metadata updated Oct 14, 2026 04:19 UTCOpen evidence record
REPORT1 SOURCE

CVE-2020–9934: Bypassing TCC for Unauthorized Access

In this guest blog post, security researcher Matt Shockley describes a lovely security vulnerability he uncovered in macOS. This bug allowed for a complete bypass of TCC's draconian entitlement checks, all without writing a single line of code!

First reported Jul 28, 2020 05:00 UTCCatalog metadata updated Oct 14, 2026 04:19 UTCOpen evidence record
REPORT1 SOURCE

Property List Parsing Bug(s)

In this guest blog post, the security researcher behind @OSCartography, describes a bug related to parsing property lists ...a bug that trivial crashed macOS!

First reported Oct 21, 2020 05:00 UTCCatalog metadata updated Oct 14, 2026 04:19 UTCOpen evidence record
REPORT1 SOURCE

Where there is love, there is ...malware?

Today, Valentine's day, is a day to celebrate love, and for better or worse one my main loves is malware. Let's analyze a new macOS backdoor/updater component: 'iWebUpdate' ...which has been around, undetected for 5 years!

First reported Feb 14, 2023 05:00 UTCCatalog metadata updated Oct 14, 2026 04:19 UTCOpen evidence record
REPORT1 SOURCE

FinFisher Filleted

Interested in learning about a macOS cyber-espionage implant ...that leveraged priv-escalation exploits and a kernel-mode rootkit!? In this post, we analyze the macOS version of FinSpy.

First reported Sep 26, 2020 05:00 UTCCatalog metadata updated Oct 14, 2026 04:19 UTCOpen evidence record
REPORT1 SOURCE

Arm'd & Dangerous

Apple's new M1 systems offer a myriad of benefits, that malware authors are now leveraging. Here, we detail the first malicious program, compiled to natively target Apple Silicon (M1/arm64)!

First reported Feb 14, 2021 05:00 UTCCatalog metadata updated Oct 14, 2026 04:19 UTCOpen evidence record
REPORT1 SOURCE

The LockBit ransomware (kinda) comes for macOS

The infamous LockBit ransomware group has created a macOS variant. In this post we comprehensively analyze this new threat, showing it's not ready for prime-time and iw easily detected with heuristic-based approaches.

First reported Apr 16, 2023 05:00 UTCCatalog metadata updated Oct 14, 2026 04:19 UTCOpen evidence record
REPORT1 SOURCE

Adventures in Anti-Gravity (Part II)

Here we continue to deconstruct a Mac variant of GravityRAT (the cross-platform spyware, known to target the Indian armed forces), focusing on its Electron component.

First reported Nov 27, 2020 05:00 UTCCatalog metadata updated Oct 14, 2026 04:19 UTCOpen evidence record
REPORT1 SOURCE

Office Drama on macOS

Even wondered how a system can be persistently infected by simply opening a document? In this post, I detail an exploit chain (created by yours truly), that was able fully infect a fully-patched macOS Catalina system, by simply opening a malicious (macro-laced) Office document ...no alerts, prompts, nor other direct user interactions required!

First reported Aug 04, 2020 05:00 UTCCatalog metadata updated Oct 14, 2026 04:19 UTCOpen evidence record
REPORT1 SOURCE

Version 7.261008.0

Enhancements: #7644 feat(virustotal): enrich with Google Threat Intelligence information #7562 feat(s3): migrate connector to the catalog #7137 feat: help contributors who vibe code follow our contribution guidelines #6821 feat(connectors): add Flowtriq DDoS incidents external-import connector Bug Fixes: #7893 fix(akamai): manifest container_image points to non-existent opencti/connector-akamai-stream #7860 fix(cve): maintain_data request exceeds NVD 120-day date range limit and blocks the connector in an error loop #7857 fix(google-secops-siem): KeyError 'valid_until' when processing indicators without valid_until #7824 fix(dark-web-informer): connector re-imports the full bundles on every run #7271 fix(google-ti-feeds): int engine_update in last_analysis_results fails GTIFileData pydantic validation Pull Requests: feat(flowtriq): add external-import connector for DDoS incidents (#6821) by Jacob Masse (@jacob-masse) in #6822 chore(deps): update dependency urllib3 to v2.8.0 [security] (master) by renovate[bot] in #7839 chore(deps): update dependency google-auth-oauthlib to v1.5.0 (master) by renovate[bot] in #7835 chore(deps): update dependency azure-identity to v1.26.0 (master) by renovate[bot] in #7834 fix(dark-web-informer): only ingest new data using connector state (#7824) by Gamezilla19 (@gamezilla19) in #7825 chore(deps): update dependency mypy to v2.4.0 (master) by renovate[bot] in #7844 ci(release): stop creating a GitHub Release per connector (#7811) by Hugo Dupras (@jabesq) in #7813 docs: migrate AI agent instructions from Copilot to AGENTS.md (#7793) by Hugo Dupras (@jabesq) in #7794 fix(google-ti-feeds): coerce numeric engine_update in last_analysis_results (#7271) by Hugo Dupras (@jabesq) in #7831 feat(s3): migrate connector to the catalog (#7562) by Hugo Dupras (@jabesq) in #7598 chore(deps): update dependency responses to v0.26.3 (master) by renovate[bot] in #7876 chore(deps): update dependency python-docx to v1.2.0 (master) by renovate[bot] in #7848 chore(deps): update dependency pytest to v9.1.1 (master) by renovate[bot] in #7846 chore(deps): update dependency pytest-mock to v3.16.0 (master) by renovate[bot] in #7847 fix(ci): make connector verified linter non-blocking (#7878) by Thibaut Rouxel (@throuxel) in #7879 feat(wiz): add cloud security use case and category to manifest (#7881) by Romain GUIGNARD (@romain-filigran) in #7882 ci(manifest): parallelize schema generation in build workflow (#7460) by Hugo Dupras (@jabesq) in #7531 ci(workflows): make path-filtered required checks skip internally instead of via workflow triggers (#7733) by Hugo Dupras (@jabesq) in #7732 feat(virustotal): enrich with Google TI information (#7644) by Peritz the Penguin (@peritz) in #7645 chore(deps): update dependency starlette to >=1.7.0, <1.8.0 (master) by renovate[bot] in #7891 chore(deps): update dependency google-auth to v2.60.0 (master) by renovate[bot] in #7888 chore(deps): update dependency pytest to v9.1.1 (master) by renovate[bot] in #7889 fix(manifest): align container_image with the image CI publishes (#7893) by Hugo Dupras (@jabesq) in #7894 fix(google-secops-siem): handle indicators without valid_until (#7857) by Romain GUIGNARD (@romain-filigran) in #7867 fix(cve): split maintain_data requests into 120-day windows (#7860) by Thibaut Rouxel (@throuxel) in #7877 New Contributors: Jacob Masse (@jacob-masse) made their first contribution in #6822 Peritz the Penguin (@peritz) made their first contribution in #7645 Full Changelog: 7.261002.0...7.261008.0

First reported Oct 09, 2026 09:05 UTCCatalog metadata updated Oct 14, 2026 04:15 UTCOpen evidence record
REPORT1 SOURCE

wiz/7.261008.0

chore(release): [all] Release tag 7.261008.0

First reported Oct 08, 2026 13:29 UTCCatalog metadata updated Oct 14, 2026 04:15 UTCOpen evidence record

The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.

A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.