Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Fatih Cam
Following the refund: how fake South African government sites led to a global phishing kit
Imagine you get an SMS promising a tax refund about $3,000 and you tap the link. The page that loads looks almost identical to the tax authority's own website. South Africa's revenue service, SARS, put out a public warning about exactly this kind of lure in late July, citing a R48,900 figure.[1] Figure 1. Original South African Revenue Service website Figure 2.
September 2026 Detection Highlights: 11 New VTIs, Including Five for FlowerStorm Phishing Kit, and 70+ YARA Rules
The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape. In September 2026, the VMRay Labs team has been focused on the following areas: Now, let’s delve into each topic for a more comprehensive understanding.
Release Highlights: VMRay Platform 2026.4.0
2026 has already been an exciting year for VMRay, with three major releases delivered so far. We hope you have enjoyed the new capabilities introduced in recent months, including customizable IR Mailbox notifications, webhooks for IR Mailbox submissions, KnowBe4 alert filtering using custom tags, support for additional special characters in tags, and many other enhancements.
Hunting a Global Formbook Campaign with Machine Learning
This is the story of a hunt: how a pile of 276 Formbook samples run through a machine learning pipeline led us to a global Business Email Compromise campaign. The idea behind that pipeline starts simple: take a pile of samples you suspect share an origin, then group the ones that behave alike. Compared side by side, two clusters show you which direction a family is moving. What an operator dropped or added since the last wave.
What Indicators Miss: Geo-Aware Malware and Two Hidden Backdoors
// VMRAY LABS · THREAT RESEARCH Executive summary A file hash identifies a file, a domain identifies a server, and a location lookup identifies a service the malware contacted. These indicators do not explain the malware’s next decision, the code behind it, or the data hidden inside the file. Two samples can share an indicator but behave very differently. This post examines that missing context and why it matters for detection. We examine this through two investigations.
August 2026 Detection Highlights: Stronger Phishing Detection, 7 New VTIs, and 50+ YARA Rules
The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape.
Deleting the Defenders: A Commodity BYOVD Toolkit That Erases Host Safeguards
Threat Intelligence Spotlight Executive Summary VMRay Labs has analyzed a family of malicious WinRAR self-extracting archives that act as droppers. Each one unpacks several helper tools and a password protected archive into a temporary folder, then executes a batch script.
Every agent needs an oracle: How to trust AI-drafted detection rules
Every Agent Needs an Oracle Detection rules are increasingly drafted by machines rather than by human engineers. An agent reads threat intelligence, proposes a Sigma rule, and opens a pull request. The appeal is not hard to see: detection engineering has always competed with triage and incident response for the same finite hours. What moves quietly are the errors. An agent cannot check its source against reality. It can only repeat what it was told.
July 2026 Detection Highlights: 10 New VTIs, 50+ YARA Rules, and 4 Config Extractors
The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape.
STIX and TAXII Explained: Threat Intelligence That Survives Ingestion
STIX and TAXII solve an important problem: moving cyber threat intelligence between systems in a standard format. Transport is not the same thing as operational value. A feed can be valid STIX, delivered over TAXII, and still create low-value alerts if the receiving SOC only gets isolated values. The useful feed is the one that preserves enough context for analysts and systems to decide what an object means, how current it is, what it relates to, and what action it should support.
The Operational Guide to IOC Quality
Security teams do not have an IOC shortage. They have an IOC usability problem. Most SOCs already ingest more hashes, domains, IPs, and URLs than they can handle cleanly. The hard question is not whether more indicators are available. It is whether the indicators are reliable enough, current enough, and contextual enough to support detection, triage, enrichment, hunting, or automation without increasing noise. An IOC is not valuable because it is a value.
Execution-Level Analysis of a Russian-Speaking Multi-Operator Intrusion Campaign: Operation STANDOFF
Executive Summary VMRay Labs identified a previously unattributed, actively operated cybercriminal campaign conducted by a Russian-speaking threat group, tracked in this report as Operation STANDOFF.
Unifying Forces: Converging Incident Response and Detection Engineering for Proactive Defense
TL;DR / Fast Answer Incident Response (IR) and Detection Engineering (DE) are often treated as separate silos, but their convergence is the key to proactive security. By creating a collaborative loop, DE provides IR with the deep analysis and IOCs needed to triage threats faster, while IR feeds real-world findings back to DE to fine-tune future detection rules.
Defense-in-Depth: Why Multi-Layered Security is Non-Negotiable
TL;DR / Fast Answer Reliance on a single security control is a guaranteed failure point. A robust cybersecurity strategy demands Defense-in-Depth—a multi-layered approach where firewalls, EDR, secure email gateways, and advanced malware analysis work in concert. By creating overlapping barriers, you ensure that if one layer fails (e.g., a phishing email bypasses the gateway), another (e.g., behavior-based detection) is ready to stop the breach.
Generating Precise Intelligence from Your & Phishing Malware Alerts
TL;DR / Fast Answer Generic threat intelligence feeds often lack the specific context needed to defend your organization effectively. To bridge this “relevance gap,” security teams must pivot from passive consumption to active generation by analyzing their own internal malware alerts.
Understanding Cyber Threat Intelligence (CTI)
TL;DR / Fast Answer Effective Cyber Threat Intelligence (CTI) is more than just data feeds; it is the transformation of raw information into actionable insights that drive proactive defense. By understanding the distinction between data, information, and intelligence—and categorizing intelligence into Strategic, Tactical, and Operational tiers—organizations can move beyond reactive measures to anticipate and thwart sophisticated attacks before they manifest.
IoCs vs Artifacts: How to filter out the noise
TL;DR / Fast Answer Not all data found during malware analysis is a threat. While artifacts are neutral traces of activity (like a file created), Indicators of Compromise (IOCs) are the “gold nuggets” confirming malicious intent (like a C2 server IP). Confusing the two leads to alert fatigue and false positives.
Release Highlights: VMRay Platform 2026.3.0
Introduction Since the release of VMRay Platform 2026.2, we’ve had a busy start to the summer.
The RedLine Thread That Led to a Maritime BEC Infrastructure Cluster
Introduction Most threat intelligence work begins with a feed. Platforms like VMRay UniqueSignal deliver a continuous stream of fresh and unique indicators, each timestamped and labeled with contextual information such as the malware family, runtime behavior and MITRE ATT&CK labels. In a typical workflow, an analyst takes one of these indicators, confirms it’s still relevant and pushes it into a blocklist or SIEM rule. Pivoting takes the same indicator further.
Operationalizing VMRay UniqueSignal in MISP for detection, hunting and blocking
In the previous post, we covered how to connect VMRay UniqueSignal to MISP. This follow-up looks at how to put the feed to work in a SOC or CSIRT. The objective is straightforward: turn threat intelligence into something analysts can trust, and push indicators to the places where they can be used. Some belong in blocking controls. Others are better suited to enrichment or historical hunting. Why this matters The problem is rarely a lack of data.
How to Integrate UniqueSignal with OpenCTI Using STIX/TAXII 2.1
OpenCTI is one of the most widely used open-source platforms for managing cyber threat intelligence. It gives CTI teams, SOC analysts, and threat hunters a structured environment to collect, organize, enrich, and operationalize intelligence.
May 2026 Detection Highlights: New Config Extractors, a Phishkit Behavior Detection Set, and 30+ New YARA Rules
The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape.
Blocking a Threat Is Only the Start. Learning From It Comes Next.
What a blocked alert in Microsoft Defender or Sentinel can still teach your SOC — and how to turn it into attacker intelligence, enriched workflows, and decisions the team can trust. Something gets blocked. The alert closes. Everyone moves on. That’s the moment most SOC teams know the least about what just happened. And it’s becoming a bigger problem. After roughly a decade of outsourcing, large enterprises are bringing malware and phishing triage back in-house.
April 2026 Detection Highlights: 7 New VTIs, AutoUI Support for Fake CAPTCHA Campaigns, and 20+ New YARA Rules
The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape.
Threat Intelligence Insights: Pivoting off the Blockchain
Background “EtherHiding” is a technique that we keep seeing with increased popularity in the threat landscape. Threat actors store data (for example C2 configuration) or code on a public blockchain, where they face no risk of a takedown due to the decentralized nature. Additionally, by using smart contracts, they are also able to update the stored information on the fly.
Why simple phishing is dying, and what that means for your SOC
The era of the single malicious link is fading. Today’s phishing attacks are multi-stage, multi-format delivery chains designed to exhaust analysts and evade gateways. Here’s what’s changed, and how VMRay helps you keep up. A few years ago, a phishing email was a phishing email. A sketchy link, a credential harvesting page, a verdict. Done. That’s no longer the world we live in. The attacks landing in SOC queues today look nothing like that.
March 2026 Detection Highlights: 10 New VTIs, Expanded Config Extractors, and 30+ Fresh YARA Rules
The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape.
Strategic Decisions for CISOs: Part 2: Why Deployment Strategy Just Became Strategic
The gap in analytical competence would already be a serious concern on its own. But a second structural shift is now colliding with it — one that many security vendors did not anticipate. For years, deployment architecture was treated as a secondary consideration. The prevailing wisdom was simple: move security tooling to the cloud, centralize operations and let hyperscale infrastructure handle the rest. In many environments, that strategy worked. But the world has changed.
Strategic Decisions for CISOs: Part 1: The Core Competence Missing in Email, EDR and Threat Intel
For more than a decade, cybersecurity leaders have been told the same story. Consolidate your tools. Standardize on a platform. Adopt the “single pane of glass.” The promise was simple: fewer vendors, more visibility, better security. But many CISOs are discovering an uncomfortable reality. The dashboards got better. The detections did not.
Malware & Phishing Threat Landscape Report – 2025/2
/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / / The second half of 2025 highlights a familiar pattern: ransomware remained a popular payload for attackers, while the paths into devices kept changing. Public leak sites continued to grow, and break-ins often started with quickly abused security vulnerability, sometimes through supply chain attacks.
Tracing Blockchain-Controlled Malware Across Chains: A Joint Investigation by VMRay and Iknaio
Threat actors are constantly evolving their tactics. One increasingly observed technique involves abusing public blockchains, specifically the Binance Smart Chain (BSC), as Command-and-Control (C2) infrastructure for malware operations. By hosting malicious code on-chain, attackers can circumvent traditional blocking mechanisms: smart contracts cannot simply be taken down like a conventional web server.
February 2026 Detection Highlights: 8 New VTIs, Expanded Config Extractors, and 30+ Fresh YARA Rules
The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape.
VMRay UniqueSignal
VMRay UniqueSignal Last year VMRay announced UniqueSignal, a threat intelligence feed that includes: Indicators of Compromise (IOCs) such as IPs, URLs and hashes Tactics, Techniques, and Procedures (TTPs) mapped to MITRE ATT&CK® Malware family context that helps you track how threats evolve over time What sets this feed apart is its context and relevancy.
Why sandboxing is the foundation of AI-first defense
This content is password-protected. To view it, please enter the password below.
New identifiers, YARA Rules, and Phishing Defense Updates
The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitoring of events reported by the security community to stay up to date on the latest changes in the cyber threat landscape.
Climbing the Pyramid of Pain with Lumma Stealer
Introduction In this blogpost, we will discuss how malware analysis supports threat intelligence, specifically by climbing the Pyramid of Pain. To this end we will take a deep dive into Lumma Stealer samples and Command-and-Control (C2) infrastructure. We will provide insights into the C2 domain lifecycle for Lumma, as well as learnings from our quantitative analysis.
Clearer Malware Delivery Chains, Phishing Integration, and Enhanced Analysis
Introduction Welcome to 2026! We’re starting the year with a new release of the VMRay Platform, and we’re enthusiastic to share what’s new. This release brings meaningful enhancements designed to improve visibility, accuracy, and usability across the Platform.
Speed & Scale: What CISOs Really Need from AI in the SOC
The AI Buzz—and the Backlash AI has become the new zero-trust: everyone claims to have it, few can prove it works. When we recently sat down with two veteran CISOs from heavily regulated industries, the message was blunt: “If AI doesn’t save my analysts time or fit into the stack we already have, it’s just stickerware.” The takeaway? Security leaders aren’t chasing algorithms. They’re chasing minutes—minutes saved in detection, investigation, and response.
Behavioral Detections for Stealers Loaders and RATs Analysis
The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape.
Cyber Resilience as a Pillar of NATO’s Evolving Deterrence Posture
NATO and its partners face a rapidly evolving landscape of hybrid threats that continuously target both military and civilian infrastructures through cyberspace. This article explores how advanced cyber technologies and collaborative practices support resilient cyber defence operations for the Alliance. Understanding Hybrid Threats Hostile cyber operations against critical functions such as energy supply, communications, logistics and government services are a common tactic in hybrid warfare.
Why sandboxing is the foundation of AI-first defense
Most teams treat a block as the end of the story: defense succeeded, move on. That’s true — but incomplete. Microsoft Defender and Sentinel do an excellent job surfacing and stopping threats. What many SOCs miss is the next step: turning those blocked alerts into fresh, environment-relevant threat intelligence that prevents whole campaigns — not just the same file — from striking again.
Smarter Phishing Detection, On-Prem FinalVerdict & API Upgrades
Introduction The pace of innovation hasn’t slowed in 2025, and neither have we! With three impactful releases already rolled out, we continue to strengthen the VMRay Platform with comprehensive updates that empower analysts, enhance detection accuracy, and boost overall performance. Now, without further ado, let’s dive into the highlights of the 2025.4.0 release.
CMMC Compliance: Essential for Cybersecurity Maturity
As organizations move toward Cybersecurity Maturity Model Certification (CMMC), they must prove they can identify, analyze, and respond to cyber threats. Whether preparing for Level 2 or aiming for Level 3, the ability to investigate advanced attacks with confidence is no longer optional but essential. CMMC Level 2 introduces practices that go beyond basic hygiene, while Level 3 raises the bar further, requiring operational resilience and defenses against advanced persistent threats.
Threat Detection Highlights
The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape.
Enhance Your Malware Tracking
TL;DR: If you’re tracking fast-moving malware (think infostealers, loaders, cryptominers) and drowning in indicators, VMRay UniqueSignal + OpenCTI gives you high-fidelity, malware-centric context you can act on—without building a heavy/spaghetti enrichment pipeline. This post lays out 5 real problems security teams face and how this integration solves them, with concrete use cases. Why this matters Malware tracking is critical but resource-intensive.
CISO Guide to Strategic Cybersecurity Decisions
Over the last 6–9 months, we have witnessed many CISOs and their teams have been making strategic decisions about how they approach and harden their malware and phishing defenses: I had a chance to observe and discuss at the Gartner Risk & Security Summit in London last week. Here are some of my – maybe contentious – takeaways. Key shifts we’re seeing from CISOs: Probably the most unexpected shift we have seen in 2025 so is the shift back to on-premise deployments.
VMRay Detection Highlights: 30 New YARA Rules
Overview As announced In our VMRay 2025.3 Release highlights blogpost, our phishing detections on cloud are now powered with Computer Vision capabilities. This allows VMRay’s threat identifiers ( VTIs ) to detect brands and page structures based on how they appear to the end user, which makes them more resilient for source code obfuscation and other evasion techniques employed in phishing threats.
Threat Detection Highlights
The Labs team at VMRay actively gathers publicly available data to identify any noteworthy malware developments that demand immediate attention. We complement this effort with our internal tracking and monitor events the security community reports to stay up-to-date with the latest changes in the cyber threat landscape.
Why sandboxing is the foundation of AI-first defense
Automation and AI are reshaping how Security Operations C enters (SOCs) work. That’s a good thing, but only if the systems you automate and the models you train are fed high-quality, reliable data. When you hand decision-making to AI-assisted investigators or automated playbooks, you need the behavioral truth. You need facts, not assumptions; signals, not noise. This is exactly where sandboxing still plays a decisive role.
How threat actors abuse SVGs for phishing
Introduction Scalable Vector Graphics (SVG) files are increasingly being abused as initial phishing vectors. . At VMRay, our continuous threat monitoring has revealed multiple distinct SVG-powered phishing campaigns. In this blog, we dissect the underlying tactics, payload delivery mechanisms, and detection strategies to strengthen your defenses. Why SVG?
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Fatih
Contact Fatih, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack