Karsten Hahn

Karsten Hahn

@struppigel.bsky.social

325 followers31 following115 posts

Karsten Hahn
@struppigel.bsky.social

BlueMoon exploit kit allows to infect systems if a user opens a link via Chrome or Chromium based browsers via v8 sandbox escape and RCE on Windows. www.proofpoint.com/us/blog/thre...

proofpoint.comOnce in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days | Proofpoint USAnalyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough to receive a numerical TA designation.
Karsten Hahn
@struppigel.bsky.social

Blog: "Bad advice and myths around malware prevention" If you ever heard or said "visiting websites can't infect you", "PDFs aren't malicious" or "exploits are rare and always targeted" this article might be for you. blog.gdatasoftware.com/2026/07/3846... #GDATATechBlog #GDATA

blog.gdatasoftware.comBad Advice and Myths Around Malware PreventionBad advice about malware prevention creates false confidence. Nuanced advice matters! Learn why websites, old exploits, and PDF files can still pose risks.
Karsten Hahn
@struppigel.bsky.social

I asked a clanker to make me a prompt that I can use to generate images of malware, like literal pictures that represent malware such as the ones used in samplepedia, not PE images. I got a warning for cyber abuse with threats to shut down my account o.O

Karsten Hahn
@struppigel.bsky.social

This seems to be a prevalent issue now: People vibe code security applications and the LLM generates real malware for testing. The generated test files rely on real threat actor infrastructure to download or exfiltrate. hxxps://github.com/DataDog/guarddog/blob/main/tests

Karsten Hahn
@struppigel.bsky.social

I wrote an article about SugarSMP Minecraft scams, Spark stealer, extortion and hacked accounts. After a brief contact to the threat actor, we talked to two victims and followed the trail. Analysis in collaboration with @rifteyy #GDATATechblog #GDATA blog.gdatasoftware.com/2026/03/3839...

blog.gdatasoftware.comMinecraft: SugarSMP's Dark Tale of Scams, Malware & ExtortionSome Minecraft players were looking for safe haven away from griefers, but found an elaborate web of malware, deception and extortion.
Karsten Hahn
@struppigel.bsky.social

You will find the same malware family with this VT search query: vhash:087076656d156d05655253z72zff7z11z23z13z93z12b4z11z behaviour_processes:"C:\\Windows\\system32\\cmd.exe /d /s /c \"taskkill /F /IM discord.exe\""