IRCC researchhttps://dev.irchaos.club/blog/Investigations, experiments, and methods from Incident Response Chaos Club.en-USAnalyzing the Midnight Blizzard Eviction Planhttps://dev.irchaos.club/analyzing-the-midnight-blizzard-eviction-plan/https://dev.irchaos.club/analyzing-the-midnight-blizzard-eviction-plan/Wed, 25 Feb 2026 00:00:00 +0000cauliflowerdoughnutsincident responsecloudA hands-on walkthrough of rebuilding the Midnight Blizzard OAuth attack chain in Azure and developing an eviction plan for it.Darkgate 3: Return of the Temphttps://dev.irchaos.club/darkgate-3-return-of-the-temp/https://dev.irchaos.club/darkgate-3-return-of-the-temp/Tue, 21 Oct 2025 00:00:00 +0000grepStrengthmalware analysisreverse engineeringAnalyzing the prolific malware loader that loves AutoIt.Install Linters, Get Malware - DevSecOps Speedrun Editionhttps://dev.irchaos.club/install-linters-get-malware/https://dev.irchaos.club/install-linters-get-malware/Sun, 20 Jul 2025 00:00:00 +0000humpty/tony ยท invokeresupply chainmalware analysisreverse engineeringHow Scavenger rode a compromised npm eslint-config-prettier: loader/stealer internals, anti-analysis + XXTEA C2, Chromium targeting, BeamNG ties, and actionable IOCs (with InvokeRE)Supper is servedhttps://dev.irchaos.club/supper-is-served/https://dev.irchaos.club/supper-is-served/Sun, 29 Jun 2025 00:00:00 +0000humpty/tonyreverse engineeringmalware analysisA deep dive into Supper (Interlock RAT) a fileless Windows backdoor linked to Vice Society clarifying public report errors and detailing its C2 protocol, encryption, self-deletion, and reverse shell behavior.Analyzing the RedTiger Malware Stealerhttps://dev.irchaos.club/redtiger-malware/https://dev.irchaos.club/redtiger-malware/Sun, 16 Mar 2025 00:00:00 +0000humpty/tonymalware analysisreverse engineeringAnalysis of RedTiger, a python based stealer that leverages Discord to exfiltrate credentialsDissecting a fresh BlankGrabber samplehttps://dev.irchaos.club/dissecting-blankgrabber/https://dev.irchaos.club/dissecting-blankgrabber/Sat, 15 Feb 2025 00:00:00 +0000humpty/tonyreverse engineeringmalware analysisAnalysis of BlankGrabber, a python based stealerThreat hunting for shits and giggleshttps://dev.irchaos.club/threat-hunting-for-giggles/https://dev.irchaos.club/threat-hunting-for-giggles/Thu, 28 Nov 2024 00:00:00 +0000humpty/tonythreat huntingmalware analysisreverse engineeringAnalyzing XWorm and tracking related infrastructure with hunt.io