a fake resume invoked China’s defence-tech elite, then installed VShell

2026-08-27 :: Himanshu Anand

#malware #threat-intel #reverse-engineering #snowlight #vshell #any.run #China

A fake resume claimed an applicant from one of China’s Seven Sons of National Defence, then delivered a Go loader, SNOWLIGHT and a 4.65 MB fileless VShell payload.

someone is filing your GST return, and it is not your CA

2026-08-18 :: Himanshu Anand

#malware #threat-intel #India #reverse-engineering #any.run

Disclosure: this research was conducted using an ANY.RUN account provided as part of a collaboration. All analysis and conclusions are my own. TLDR Found an unreported Silver Fox campaign serving ValleyRAT to Indian taxpayers with a fake “GSTR-3B overdue” lure, timed to the real 20 August GST filing deadline. The delivery is a disk image containing a genuinely Microsoft-signed SystemSettings.exe that sideloads a patched SystemSettings.dll (Microsoft cert still attached, hash broken cute).

Reading a patch tuesday diff for fun: the dhcp client memcpy that copies more than four bytes (CVE-2026-44815)

2026-06-11 :: Himanshu Anand

#security #windows #1-day #bindiff #dhcp #reverse-engineering

TLDR; June 2026 was the biggest Patch Tuesday Microsoft has ever shipped 208 CVEs. One of them, CVE-2026-44815 (This is as bad as Etner blue, Wanna cry isse), is a CVSS 9.8 “DHCP Client Service Remote Code Execution.” I pulled the patched dhcpcore.dll, diffed it against last month’s build and the whole bug fits on one screen: a function called GetOriginalSubnetMask does a memcpy into a 4-byte buffer using a length field that came off the wire from a DHCP server, with no check that the length is actually 4.