http://localhost:4000/ Insights and analysis from LIA observations 2026-06-03T18:40:32+02:00 LIA http://localhost:4000/ Jekyll © 2026 LIA /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-06-03T09:02:23+02:00 2026-06-03T09:02:23+02:00 http://localhost:4000/posts/context-graph/ LIA

Threat intelligence has always been about connecting dots. Now you can actually see them in an interactive relationship map built from tasks, payload, detections and infrastructure data. Today we’re shipping the Context Graph — an interactive relationship visualization layer directly in LIA. You can start from a blank graph and add a domain, IP address, URL or SHA256 hash. The graph automati...

2026-03-10T08:02:23+01:00 2026-03-10T08:02:23+01:00 http://localhost:4000/posts/malcat-kesakode/ LIA

Malware is constantly evolving in an effort to evade detection and identification, using different kinds of obfuscation and morphing that makes creating a reliable signature more challenging. To increase the detection capabilities of downloaded payloads, LIA has partnered with Malcat to implement Kesakode in the payload analysis pipeline. Kesakode - Fuzzy Detections Compared to static signatu...

2025-12-04T08:02:23+01:00 2025-12-04T08:02:23+01:00 http://localhost:4000/posts/major-update/ LIA

In September, we mentioned that new features were in the works, and we are excited to share that they are now live. Over the past few months, we have focused heavily on backend improvements and enhancing our existing analysis pipeline. A major part of this effort has been the addition of a new sandbox environment that helps us extract more value from the payloads sourced from tracked families. ...

2024-10-17T09:02:23+02:00 2024-10-17T09:02:23+02:00 http://localhost:4000/posts/vidar-build-id-correlation/ LIA

Botnet Identifiers When running a botnet, threat actors typically want to group bots together to keep track of campaigns or separate access in the administrative panel between users. This is the case in Malware-as-a-Service (MaaS) offerings where the malware author is providing threat actors access to existing infrastructure to manage bots and access information specific to their botnets. When...