IntelCorgi Threat Research

IntelCorgi Threat Research

Sign in Subscribe

Quick Triage - Obsidian Malware Campaign

Quick Triage - Obsidian Malware Campaign

Intake In July 2024, a user on the subreddit for the note-taking application Obsidian made a post warning users of a malicious site masquerading as Obsidian's homepage, obsidian.md. The malicious website (obsidianworking[.]com) was shut down almost immediately after the initial reddit post was made, but some

Bellingcat Malware Investigation

Bellingcat Malware Investigation

💡This article was originally published on 24 March 2024 before I migrated my blog to Ghost. Update 17 April 2024: Mandiant Intelligence analysts published an awesome report on the threat actor group tracked as SANDWORM, which was graduated to APT44. In that report, Mandiant analysts connect this campaign to APT44.