GoGra Linux Dropper analysis GoGra is an backdoor family which emerged in 2024, mostly targeting India and Afghanistan. In April 2026, its developers released a Linux variant, which was analyzed here. In this blog post, we’ll go over a few interesting functionalities which were not detailed in that prior analysis. IOC: 9c23c65a8a392a3fd885496a5ff2004252f1ad4388814b20e5459695280b0b82 Background info GoGra was first seen in November 2023. It is written in Go and abuses the Microsoft Graph API.

GoGra Linux Payload analysis This blog post continues our analysis of GoGra Linux variant. In a first part, we analyzed the Dropper and found out it was displaying a decoy PDF and executing another binary. In this second part, we analyze the other binary, also called payload or implant. Pclntab The implant is stripped, so at first, Ghidra sees no function names, filenames etc. Note that, at first, our LLM did not know at all how to deal with Go binaries.

Virus Bulletin 2026 I was (speaking) at Virus Bulletin this year, and it was an excellent edition with lots of very interesting, highly technical talks. Conferences are a cool place to learn about new fields you haven’t looked into yet. It’s rarer to learn things in your own field - especially when you’ve 18+ years of experience in that field… That’s what unique at VB in my mind: I get an opportunity to learn in multiple fields including mine.

THCon 2026 Badge The badge at THCon 2026 was created by DVID. It actually had 2 firmware: Shipped on the badges for the conference, and reversed by Virtualabs. Interesting blog post, read it! This firmware has the badges communicate with a master using BLE. A specific firmware for a challenge. Getting the XRefs in Ghidra I had dumped the firmware and retrieved the applicative part see Virtualab’s post, but I was annoyed not to have any xref in Ghidra.

CTE v2 (2026) - Le Vault This challenge begins with some OSINT where we need to find a program protected by password. This program is used by Melanie’s friend, Samir Taleb. NB. These are fake identities used all along “Capture The Evidence” v2. Then, we’ll need to provide the author’s name of this challenge as flag. The tags of the challenge suggest there’s a part with OSINT (first part) and a part with Reverse (second part).

CTE v2 (2026) - Toujours en Vente This is a reverse engineering challenge created by Miaou for Capture The Evidence (CTE) in June 2026. We are given a binary broker_tool, and we need to find a URL to flag, e.g https://u.rl/path. Reconnaissance The binary is an ELF x86-64, not stripped. We run it: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 =================================== B U S I N E S S P O R T A L =================================== Welcome, valued partner.