Daniel Stepanic

@DanielStepanic

Malwarez at @elasticseclabs | Macrodata Refinement

Joined March 2011

645 Following 1.3K Followers 328 Posts

Latest posts 5

Pinned post

Daniel Stepanic @DanielStepanic May 7, 2022

Our team revisited #BLISTER, a stealthy loader recently tied to #LockBit and #SocGholish. We go through it's different capabilities, and released config extractor.

Blog🔗: elastic.github.io/security-resea…

Config extractor 🧰: elastic.github.io/security-resea…

Daniel Stepanic @DanielStepanic Sep 4

Our team recently did a full teardown on #RevStealer. The malware is full of features and super interesting, unlike a lot of AI-generated stuff we are seeing nowadays.

Blog: elastic.co/security-labs/…

Whitepaper: assets.contentstack.io/v3/assets/blte…

Daniel Stepanic @DanielStepanic Nov 14, 2025

Really awesome new research from @k33b0i @soolidsnakee

Elastic Security Labs Verified account @elasticseclabs Nov 14, 2025

#ElasticSecurityLabs uncovers #RONINGLOADER, a multi-stage loader utilizing signed drivers, PPL abuse, CI Policies, and other evasion techniques to deliver #DragonBreath's gh0st RAT variant.

Check it out at ela.st/roningloader

View quoted post on X

Daniel Stepanic @DanielStepanic May 22, 2025

This was a fun write-up! I go through open-source obfuscator, Alcatraz and walk through its obfuscation techniques and how to approach de-obfuscation. Hopefully it can help some people!

Elastic Security Labs Verified account @elasticseclabs May 22, 2025

Analyzing DOUBLELOADER malware & its use of Alcatraz, an open-source obfuscator! 🚨 Learn how Alcatraz employs control flow flattening, anti-disassembly tricks, and more to evade detection. Dive into our research on de-obfuscating these techniques: go.es.io/4je0AFO
View quoted post on X

Daniel Stepanic @DanielStepanic Oct 3, 2024

Had fun presenting #WARMCOOKIE research at #VB2024. The malware was recently updated with new handlers. Our team wrote some tooling to simulate the C2 server to help organizations build better detections.

Tooling: github.com/elastic/labs-r…