C0NTRA - A Strand of Consciousness

New Infrastructure Discovery: Salt Typhoon  (APT) - December 2025 Analysis Recent telemetry and infrastructure tracking have identified a significant set of new network assets linked to the Chinese cyber-espionage actor known as Salt Typhoon (also tracked as FamousSparrow or GhostEmperor). This update provides a breakdown of recently observed domains, their operational timeframes, and the low-density IP addresses utilized for Command and Control (C2) or staging operations. Executive Summary Salt Typhoon continues to demonstrate a high level of operational security, frequently cycling through low-density IP addresses and utilizing domains that mimic legitimate business or technical services. The infrastructure identified in this report spans from late 2021 through mid-2025, suggesting long-term persistence and planning for various campaign phases. Infrastructure Breakdown Below is the detailed list of domains and associated network artifacts. Domain Observation Timeframe Related IP...

The Stealthy Assassin: An In-Memory Rootkit Philosophy GITHUB REPO WITH ALL RELEVENT FILES A Historical Perspective on Fear and Stealth For those not well-versed in history, one of the most daring letters of all time was sent to Stalin from Josip Broz Tito, the leader of the former Yugoslavia. It read: "Stop sending people to kill me. We've already captured five of them, one of them with a bomb and another with a rifle. If you don't stop sending killers, I'll send one to Moscow, and I won't have to send a second." Knowing Stalin's reputation, few would dare make such a threat. Tito lived to the age of 87, and reports of assassination attempts ended after that letter. He was one of the few who scared Stalin enough to back off. When I considered the stealthy assassin this rootkit could be, only one name came to mind: Tito . The Shift to In-Memory Methodology For a while now, malware has been moving toward an in-memory-only methodology. It is obviously easie...