#Rapid7 published some analysis of #malware likely dropped through the Notepad++ issue.
One of the loaders used by the malware is built with #Microsoft Warbird, a kernel-level code protection framework used by Windows. @cirosec blogged about how this framework could be abused a while back and also published a PoC on GitHub.
I'm one of the authors of that research. We included some thoughts on detection in the article but if there's any further questions about the technique or anything, ask away :)

#notepad #chrysalis #ioc #apt #warbird

#PlaneAlert ICAO: #A387EE Tail: #N3267G Flt: #N3267G
Owner: #TitanAerobatic
Aircraft: #North American SNJ-5 Texan
2025-11-28 18:11:45 CET
#T6 #WarBird #Shiny #TitanAerobatic https://w.wiki/3nth
https://globe.adsbexchange.com/?icao=A387EE&zoom=7&lat=33.549595&lon=-86.986885&timestamp=1764349905&showTrace=2025-11-28

#adsb #planefence #planealert by kx1t - https://sdr-e.com/docker-planefence

#PlaneAlert ICAO: #A387EE Tail: #N3267G Flt: #N3267G
Owner: #TitanAerobatic
Aircraft: #North American SNJ-5 Texan
2025-11-28 15:35:20 CET
#T6 #WarBird #Shiny #TitanAerobatic https://w.wiki/3nth
https://globe.adsbexchange.com/?icao=A387EE&zoom=7&lat=30.781921&lon=-91.903160&timestamp=1764340520&showTrace=2025-11-28

#adsb #planefence #planealert by kx1t - https://sdr-e.com/docker-planefence