YWYanky Wilson

1. Article · Aug 5, 2026 · Yanky Wilson

   One C2 kit. 30 customers. 2 governments (opens the original)

   Excerpt · English

   Read excerpt

   I was mapping the command-and-control infrastructure behind a state-linked intrusion set when the query came back and effectively ended the exercise I thought I was running. The malware resolved its C2 address by reading a smart contract on a public blockchain. Public reporting described one contract. Working from the chain rather than the sample, I found that contract was one member of a family: Two dozen byte-identical contracts plus a set of variants, all emitting the same event, all stamped

   Feedback

2. Article · Jul 8, 2026 · Yanky Wilson

   My threat feed told me it was ‘Chalubo.’ The binary disagreed (opens the original)

   Excerpt · Critical tone · English

   Read excerpt

   I’ve spent two years doing incident response and threat intel, and the one habit I’d keep if I had to give up every other is also the most boring. I don’t act on a piece of intelligence until I’ve checked it against the thing it claims to describe. It’s slow. It’s tedious. Almost nobody does it, because checking costs the exact time the feed was supposed to save. So, we read the report, nod and move on. That works fine most weeks. The weeks it doesn’t are the ones I remember, and the one I keep

   Feedback

Last 90 days. Choose a month to open its work.

Named in the text we hold. One piece can cover several.

• Wicked Panda1 piece
• Cobalt Strike1 piece