Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
62 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_0da39c1a13e9279185Recent successful batchLast successful batch: Last attempt:
intelligence_src_1e525cc24bd4c654beRecent successful batchLast successful batch: Last attempt:
intelligence_src_6df1fb5096a2991dbdRecent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
This afternoon I had a meeting with IT people at a huge US power infrastructure company. They had found a libcurl.dll file in their C:\Windows\System32 directory and asked us for help to upgrade it. Their vulnerability scanner identified it as vulnerable to several publicly known vulnerabilities. Can we bump it to the latest version please? … Continue reading There’s a libcurl.dll in my system32 →
First reported Aug 17, 2026 21:27 UTCCatalog metadata updated Oct 14, 2026 06:04 UTCOpen evidence record
On October 14 2026 we will ship curl 8.23.0. The next iteration in the never-ending series of version bumps from the curl project. We always think of the next release as the best version we ever did – and this time is no exception. Decades of collected experiences and meticulous polishing has lead us to … Continue reading Twenty-two pending curl vulnerabilities →
First reported Oct 07, 2026 07:12 UTCCatalog metadata updated Oct 14, 2026 06:04 UTCOpen evidence record
Welcome to this new release. Get it as always from https://curl.se. If you rather want a security-patched older release branch, stay tuned for the follow-up Rock-solid curl announcement within a few days. Release presentation Numbers the 276th release6 changes70 days (total: 10,887)302 bugfixes (total: 14,489)525 commits (total: 39,608)0 new public libcurl function (total: 100)4 new … Continue reading curl 8.22.0 →
First reported Sep 02, 2026 05:52 UTCCatalog metadata updated Oct 14, 2026 06:04 UTCOpen evidence record
Back in August I mentioned the new curl performance tests we have running. I figured it could be apt to return to this topic just to mention some of the initial outcomes. When the team gets a new set of charts, graphs and plots that visualize something, like performance, they offer an excellent opportunity for … Continue reading A slightly faster slimmer curl →
First reported Oct 13, 2026 06:07 UTCCatalog metadata updated Oct 14, 2026 06:04 UTCOpen evidence record
The recently published RFC 9421 describes how to do HTTP Message Signatures, and starting just now, curl experimentally supports them. Message Signatures The specification describes this as a mechanism for creating, encoding, and verifying digital signatures or message authentication codes over components of an HTTP message. It is a way to verify that selected parts … Continue reading HTTP Message Signatures with curl →
First reported Jul 27, 2026 06:55 UTCCatalog metadata updated Oct 14, 2026 06:04 UTCOpen evidence record
Exactly on this day, September 25 2001, Apple shipped version 10.1 of their OS X operating system. The one they later would rename to macOS. Exactly twenty-five years ago today. Within all their fancy release presentations and videos there are barely no mentions of curl. In their technical notes page, there is just this short … Continue reading 25 years on Apple computers →
First reported Sep 25, 2026 07:57 UTCCatalog metadata updated Oct 14, 2026 06:04 UTCOpen evidence record
At this exact moment curl’s summer of bliss 2026 ends. We (the maintainers of curl) took the entire month of July off from vulnerability reporting and in this post I will try to explain how this went. (If you feel like skipping the wordy blab below, the single word answer is: fine) This was possibly … Continue reading What the bliss taught us →
First reported Aug 03, 2026 06:42 UTCCatalog metadata updated Oct 14, 2026 06:04 UTCOpen evidence record
Authors: Axel Boesenach and Erik Schamper In this blog post we will go into a user-friendly memory scanning Python library that was created out of the necessity of having more control during memory scanning. We will give an overview of how this library works, share the thought process and the why’s. This blog post will … Continue reading Memory Scanning for the Masses →
First reported Jan 25, 2024 11:00 UTCCatalog metadata updated Oct 14, 2026 05:56 UTCOpen evidence record
Authored by Joshua Kamp Executive summary The authors behind Android banking malware Vultur have been spotted adding new technical features, which allow the malware operator to further remotely interact with the victim’s mobile device. Vultur has also started masquerading more of its malicious activity by encrypting its C2 communication, using multiple encrypted payloads that are … Continue reading Android Malware Vultur Expands Its Wingspan →
First reported Mar 28, 2024 10:00 UTCCatalog metadata updated Oct 14, 2026 05:56 UTCOpen evidence record
Authors: Yun Zheng Hu and Mick Koomen Summary Last year, we published research about a North Korean Lazarus subgroup targeting financial and cryptocurrency organizations, encountered during multiple incident response engagements. This Lazarus subgroup overlaps with activity linked to AppleJeus, Citrine Sleet, UNC4736, and Gleaming Pisces. In one investigation, we observed that the actor had replaced … Continue reading RemotePE: The Lazarus RAT that lives in memory →
First reported May 22, 2026 14:55 UTCCatalog metadata updated Oct 14, 2026 05:56 UTCOpen evidence record
Authors: Yun Zheng Hu and Mick Koomen Introduction In the past few years, Fox-IT and NCC Group have conducted multiple incident response cases involving a Lazarus subgroup that specifically targets organizations in the financial and cryptocurrency sector. This Lazarus subgroup overlaps with activity linked to AppleJeus, Citrine Sleet, UNC4736, and Gleaming Pisces. This actor uses … Continue reading Three Lazarus RATs coming for your cheese →
First reported Sep 01, 2025 13:00 UTCCatalog metadata updated Oct 14, 2026 05:56 UTCOpen evidence record
Authored by Willem Zeeman and Yun Zheng Hu This blog is part of a series written by various Dutch cyber security firms that have collaborated on the Cactus ransomware group, which exploits Qlik Sense servers for initial access. To view all of them please check the central blog by Dutch special interest group Cyberveilig Nederland … Continue reading Sifting through the spines: identifying (potential) Cactus ransomware victims →
First reported Apr 25, 2024 04:00 UTCCatalog metadata updated Oct 14, 2026 05:56 UTCOpen evidence record
Author: Guus Beckers Back in 2022 Fox-IT decided to open source its proprietary incident response tooling known as Dissect. Since then it has been adopted by many different companies in their regular workflow. For those of you who are not yet familiar with Dissect, it is an incident response framework built with incident response engagements of any … Continue reading Decrypting Full Disk Encryption with Dissect →
First reported Dec 11, 2024 07:30 UTCCatalog metadata updated Oct 14, 2026 05:56 UTCOpen evidence record
Authors: Boudewijn Meijer && Rick Veldhoven Introduction As defensive security products improve, attackers must refine their craft. Gone are the days of executing malicious binaries from disk, especially ones well known to antivirus and Endpoint Detection and Reponse (EDR) vendors. Now, attackers focus on in-memory payload execution for both native and managed applications to evade … Continue reading Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation →
First reported Sep 25, 2024 10:36 UTCCatalog metadata updated Oct 14, 2026 05:56 UTCOpen evidence record
Authored by Margit Hazenbroek At Fox-IT (part of NCC Group) identifying servers that host nefarious activities is a critical aspect of our threat intelligence. One approach involves looking for anomalies in responses of HTTP servers. Sometimes cybercriminals that host malicious servers employ tactics that involve mimicking the responses of legitimate software to evade detection. However, … Continue reading The Spelling Police: Searching for Malicious HTTP Servers by Identifying Typos in HTTP Responses →
First reported Nov 15, 2023 14:00 UTCCatalog metadata updated Oct 14, 2026 05:56 UTCOpen evidence record
Authors: Yun Zheng Hu Introduction Today Fox-IT is publicly releasing its full Cobalt Strike Beacon Corpus, containing 56,843 raw beacons and their parsed configurations, from 190,182 sightings collected from 30,604 unique IP addresses running a Team Server (the Cobalt Strike command-and-control server that beacons connect back to) between 4 July 2018 and 29 September 2026, … Continue reading Releasing the Cobalt Strike Beacon Corpus →
First reported Oct 13, 2026 14:26 UTCCatalog metadata updated Oct 14, 2026 05:56 UTCOpen evidence record
Max Groot & Erik Schamper TL;DR Windows Defender (the antivirus shipped with standard installations of Windows) places malicious files into quarantine upon detection. Reverse engineering mpengine.dll resulted in finding previously undocumented metadata in the Windows Defender quarantine folder that can be used for digital forensics and incident response. Existing scripts that extract quarantined files do … Continue reading Reverse, Reveal, Recover: Windows Defender Quarantine Forensics →
First reported Dec 14, 2023 05:13 UTCCatalog metadata updated Oct 14, 2026 05:56 UTCOpen evidence record
A CVSS score 3.3 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N severity vulnerability discovered by 'NURIHAN KIM (HanTul)' was reported to the affected vendor on: 2026-10-01, 13 days ago. The vendor is given until 2027-01-29 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.
First reported Oct 01, 2026 05:00 UTCCatalog metadata updated Oct 14, 2026 05:55 UTCOpen evidence record
A CVSS score 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-08-25, 50 days ago. The vendor is given until 2026-12-23 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.
First reported Aug 25, 2026 05:00 UTCCatalog metadata updated Oct 14, 2026 05:55 UTCOpen evidence record
A CVSS score 3.3 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N severity vulnerability discovered by 'NURIHAN KIM (HanTul)' was reported to the affected vendor on: 2026-09-10, 34 days ago. The vendor is given until 2027-01-08 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.
First reported Sep 10, 2026 05:00 UTCCatalog metadata updated Oct 14, 2026 05:55 UTCOpen evidence record
A CVSS score 3.3 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N severity vulnerability discovered by 'Liang Zhu' was reported to the affected vendor on: 2026-08-21, 54 days ago. The vendor is given until 2026-12-19 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.
First reported Aug 21, 2026 05:00 UTCCatalog metadata updated Oct 14, 2026 05:55 UTCOpen evidence record
A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Anonymous' was reported to the affected vendor on: 2026-09-28, 16 days ago. The vendor is given until 2027-01-26 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.
First reported Sep 28, 2026 05:00 UTCCatalog metadata updated Oct 14, 2026 05:55 UTCOpen evidence record
A CVSS score 9.0 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H severity vulnerability discovered by 'msh1307' was reported to the affected vendor on: 2026-09-22, 22 days ago. The vendor is given until 2027-01-20 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.
First reported Sep 22, 2026 05:00 UTCCatalog metadata updated Oct 14, 2026 05:55 UTCOpen evidence record
A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Aaron Luo and Ziv Chang of VicOne LAB R7' was reported to the affected vendor on: 2026-09-11, 33 days ago. The vendor is given until 2027-01-09 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.
First reported Sep 11, 2026 05:00 UTCCatalog metadata updated Oct 14, 2026 05:55 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.