Binary Defense

Detection engineering has a credibility problem: a rule that compiles and references the right-looking fields can still fail silently in production, and nothing about that failure announces itself. A query that never matches anything looks identical to a quiet, well-tuned detection, right up until an incident responder goes looking for an alert that should have fired. I wanted to find out whether an AI agent could be held to a stricter standard than that.

Tis the season to be jolly. Incident Response Teams everywhere are scrambling to keep up with onslaught of compromises due to the recent Citrix NetScaler 0-day vulnerability. Write-ups are popping up highlighting payloads such as the trusty web shell, to custom adversary toolkits. Grab your big gulp coffee mug and let’s go on a journey we’ve been on before; Remote Management Tools for C2.

Between August and September 2026, Binary Defense's Analysis on Demand (AOD) team worked two separate account-compromise investigations that looked nothing like the ransomware cases most incident response playbooks are built to handle. There was no encrypted file server. No dropped binary. No ransom notes on a desktop. No files with concatenated file extensions pointing to a particular ransomware.

ARC Labs Blog How a LummaStealer variant changed tactics to hide in the blockchain. RemusStealer is a malware-as-a-service (MaaS) program with multiple similarities to LummaStealer. LummaStealer is a notorious information stealer active since at least 2022 and has been covered in a previous Binary Defense blog post regarding ClickFix initial access methods, which can be found here.

Ask a SOC leader what changed after they turned on agentic triage, and you’ll usually get a quick answer: fewer alerts, faster decisions, maybe a new platform name. Ask what changed on the shift schedule, and the answer usually gets a lot less clear. Dave Kennedy laid out the what: deterministic work moves to agents, judgment work stays with the analyst, and three new responsibilities show up on the SOC floor. I want to talk about the part that gets less attention: when that work actually happens.

Dindoor is a backdoor that abuses the Deno runtime to execute malware within a target environment. Rather than shipping its own interpreter, Dindoor relies on Deno, a legitimate and widely used JavaScript and TypeScript runtime, and will install that runtime on the victim machine on demand if it is not already present. Using a signed, mainstream developer tool as its execution engine is the detail that sets Dindoor apart.

CLEVELAND – July 28, 2026 – Binary Defense, the trusted Managed Detection and Response (MDR) and enterprise defense provider, today announced the appointment of Rafal Los as Chief Strategy Officer. In this role, Los will report directly to CEO and Founder David Kennedy and lead market-facing strategy across sales, sales engineering, customer success, marketing, channel, and technology alliances while helping expand Binary Defense's voice across the broader cybersecurity community.

Walk into almost any security operations center and the first thing you'll see is a queue. A list of alerts, ranked by severity, waiting for a human to work them from the top. The whole operation is organized around emptying that list faster than it fills. We hire against it, we build shift schedules around it, we measure analysts on how quickly they acknowledge and close it. For about twenty years, the queue has been the job. Start with the arithmetic, because it's brutal.

The Tines 2025 Voice of the SOC Analyst report found that 71% of SOC analysts report burnout and 64% are considering leaving within the year. The SANS 2025 SOC Survey found that satisfaction with generative AI tools ranks last among SOC technologies. Those two numbers tell the same story from different angles. The analyst job is being squeezed between two pressures. The deterministic work is moving to agents, which is good, because that's where most of the burnout was coming from.

A full-featured backdoor with file encryption, drive wiping, and a C2 channel that looks like normal message broker traffic. Meet BLUERABBIT, this Golang-based backdoor, attributed to a likely Iran-nexus threat actor, routes its command-and-control through RabbitMQ (AMQP) for tasking, Redis for state management, and MinIO for S3-compatible data exfiltration.