L0Psec

@l0psec · Twitter · 2026-07-23 17:20 UTC

Quick post. Another share from @malwrhunterteam: 4a26cd1c6d66dcc1166369a173aa4c15136f4a480e775588b03d0555e0cf4c75 - "http://com.apple.sync" DPRK attribution. Another one of those "http://com.apple.*" named binaries. Written in go. Obfuscated. 🧵