Bubka

Malware Analysis | Reverse Engineering | Digital Forensics and Incident Response

Current focus: ELK SIEM · Executable analysis

Recent

CDEF-EtherRAT

April 16, 2026

Malware Analysis Network Analysis CVE-2025-55182 EtherRAT Wireshark Nmap Web Attack Linux PCAP JavaScript TLS Sniffer AES RAT Blockchain Ethereum Smart Contract

An attacker breached Maromalix’s public-facing web application by exploiting CVE-2025-55182 (Next.js Deserialization RCE). They deployed a multi-stage implant dubbed EtherRAT, which utilizes a blockchain-based C2 mechanism via Ethereum smart contracts to dynamically resolve infrastructure. The attacker exfiltrated sensitive data, established multiple persistence mechanisms, and ultimately patched the vulnerability to lock out other actors.

Splunk-AWSRaid

April 15, 2026

Splunk SOC SIEM Log Analysis DFIR AWS CloudTrail S3 IAM BruteForce

An attacker conducted a brute-force attack to compromise the helpdesk.luke account, performed reconnaissance from various VPN IPs, exfiltrated sensitive data including customer backups and secrets, modified bucket permissions, and established persistence by creating an admin backdoor account.

CDEF-FakeGPT

April 14, 2026

Malware Analysis Extension Infostealer Keylogger AES Anti-VM JavaScript

A malicious Chrome extension masquerading as ChatGPT uses anti analysis checks, hooks Facebook login forms, and acts as a keylogger, exfiltrating AES encrypted data via pixel tracking.

↑