Naoki Takayama

38th Annual FIRST Conference 登壇発表レポート | IIJ Security Diary sect.iij.ad.jp/blog/2026/07/3… @IIJSECT

#Kimsuky KimJongRAT Determine if Windows Defender is running, different processes are executed.

Venom RAT + HVNC + Stealer + Grabber v6.0.3

LOTSを活用して進化を続けるKimJongRAT | IIJ Security Diary sect.iij.ad.jp/blog/2026/06/c… @IIJSECT

@askardyuss Of course. I will upload it once my account's upload feature is enabled. Please wait for a moment. > I just created my account right now, so it might be cooldown or something.

@mopisec Could you please share the sample to the Malware Bazaar?

Canon.dat #PlugX SHA256: c74d70892fc2193790bedc8c08539b390ea460bc0ef72cb568568943016c35f0 C2: 202.61.72[.]198:443 (FUD)

Related: hxxps://dreamresin[.]com (Already flagged by Microsoft Defender SmartScreen)

I am presenting my latest research "Itinerary to Defeat Yet Another Beacon Implementation" at #FIRSTCON26 today. See you at the venue! #pItinerary-to-Defeat-Yet-Another-Beacon-Implementation" target="_blank" rel="nofollow noopener">first.org/conference/202…

Related sample uploaded from China: b892981af3ca699d13f07ddcf75c2df62c1543b071278b4cc1ac0993d8b9dc01 (Same C2)

WindowsTelemetry[.]zip uploaded from Japan. SHA256: 0fb45474ca58bd67220f79b0e3b07f940270c371ba56e27d3e2b99bf4dbb5174 Sideloaded DLL "VERSION.dll" executes payload that deploys PoisonX RAT and vulnerable driver (EneIo64.sys). C2: 101.32.190[.]202:8080 #malware #iocs

IIJ's Naoki Takayama analyses SLOTAGENT, a newly identified multifunctional RAT found in a ZIP uploaded from Japan to a public malware repository. The malware can execute BOF-format payloads, and implements anti-forensic features including time stomping. sect.iij.ad.jp/blog/2026/04/s…

BOFの実行などに対応した新たなマルウェアSLOTAGENT | IIJ Security Diary sect.iij.ad.jp/blog/2026/04/s… @IIJSECT

Recorded videos from #JSAC2026 are now available on Youtube. ^YU youtube.com/playlist?list=…

#JSAC2026 の講演動画を公開いたしました。 当日ご参加いただけなかった方や、内容を改めて確認されたい方はぜひご視聴ください。^AS youtube.com/playlist?list=…

Correction: The payload will be executed only if the USERDNSDOMAIN variable **starts with** "maz", "minaz", "tib", or "geel.maz".

Found multi-stage Cobalt Strike Beacon Loader. The payload will be executed only if the USERDNSDOMAIN variable is "maz", "minaz", "tib", or "geel.maz". SHA256: 4078905b6f1810a913a7204c320a31bce644376a72ebe1f54cf324db9afa3ecd C2: cloudmanagernetapp[.]nl:443 #malware #iocs

👀

C2: www[.]neurosurgeryx[.]com:443 #PlugX