Category: Incident Response

Verborgene Tastenanschläge: Forensische Analyse eines Digispark HID-Geräts

Verborgene Tastenanschläge

Ein Digispark mag wie ein harmloses USB-Entwicklungsboard aussehen, lässt sich jedoch leicht in ein Gerät zur Tastenanschlag-Injektion verwandeln, das sich wie ein USB Rubber Ducky verhält. In diesem Artikel zeigen wir, wie ein solches Gerät eingerichtet, eingesetzt und forensisch analysiert werden kann, von der Ausführung der Payload auf einem Zielsystem bis hin zur Extraktion der Firmware aus dem ATtiny85-Mikrocontroller.

Keystrokes in Disguise: Forensic Analysis of a Digispark HID Device

A Digispark may look like a harmless USB development board, but it can easily be turned into a keystroke injection device that behaves like a USB Rubber Ducky. In this article, we show how such a device can be set up, used, and forensically analyzed, from payload execution on a target system to firmware extraction from the ATtiny85 microcontroller.

The Detection & Response Chronicles: Covert Operations Through QEMU

Adversaries have always relied on legitimate tools to carry out their attacks. These tools are already trusted by security solutions, which allows them to blend in with normal activity, maintain a low footprint, and make detection much harder for defenders. By using these legitimate tools, adversaries can carry out a wide range of actions, such as moving laterally across networks, establishing C2 channels, or maintaining persistence, all without triggering any alerts.

Ivanti EPMM ‘Sleeper Shells’ not so sleepy?

In late January 2026, an advisory covering two remote code execution vulnerabilities (CVE-2026-1281 & CVE-2026-1340) in Ivanti Endpoint Manager Mobile (EPMM) was published. Shortly after, reports (in example by tenable) mentioned publicly available proof-of-concept exploits. On February 9th 2026, Defused published a blog post describing a specific webshell being deployed on EPMM devices via this … Continue reading Ivanti EPMM ‘Sleeper Shells’ not so sleepy? →