ALT Screenshot of the "reports" section of Rösti. The page displays multiple reports in a grid format, each with a card-like design. Each card includes information such as the report title, author, publication date, associated threat indicators (IOCs and YARA rules), and source organization.

ALT Screenshot of the blog post by cloudflare, where they suggest readers "search [their] environment for the FlyingYeti indicators of compromise (IOCs) shown below", but the IOCs are just low-res screenshots.

ALT MooBot botnet C2 domain zelenskyj.ru

ALT A cat hunts a wolf with a crossbow.

ALT A colorful cartoon image of a Python sitting in front of a computer monitor. The monitor shows the logo of Microsoft .Net

ALT Cartoony image of a large sinkhole. A monster character sits at the bottom of the sinkhole with a desperate face. In large letters the title "Sinkholing the DGA of m0yv" is shown.

ALT This screenshot shows the output for the command "bazaar recent -s" which is a list of recently uploaded samples to MalwareBazaar.

ALT This screenshot shows the output of Vendor data for a sample uploaded to MalwareBazaar.

ALT This screenshot shows the output for the command "yaraify recent -s" which is a list of recently uploaded Yara rules to YARAify.

ALT This screenshot shows data related to a scanning task on YARAify and includes detections from ClamAV as well as triggered Yara rules.

ALT how TA551 malspam works: An encrypted zip file contains a word document. This document contains an obfuscated and hidden hta file which is extracted and run by macro code. The hta deobfuscates a Javascript with ActiveX that will download the final payload from an url.