JSSLoader: Recoded and Reloaded

 https://www.proofpoint.com/us/blog/threat-insight/jssloader-recoded-and-reloaded (co-author)

New TA402 Molerats Malware Targets Governments in the Middle East

 https://www.proofpoint.com/us/blog/threat-insight/new-ta402-molerats-malware-targets-governments-middle-east (co-author)

NimzaLoader: TA800’s New Initial Access Malware

https://www.proofpoint.com/us/blog/threat-insight/nimzaloader-ta800s-new-initial-access-malware

New Year, New Version of DanaBot

https://www.proofpoint.com/us/blog/threat-insight/new-year-new-version-danabot

FlowCloud Version 4.1.3 Malware Analysis

https://www.proofpoint.com/us/blog/threat-insight/flowcloud-version-413-malware-analysis

TA410: The Group Behind LookBack Attacks Against U.S. Utilities Sector Returns with New Malware

https://www.proofpoint.com/us/blog/threat-insight/ta410-group-behind-lookback-attacks-against-us-utilities-sector-returns-new (FlowCloud malware reversing)

There is always a Zeus.

https://www.proofpoint.com/us/blog/threat-insight/zloader-loads-again-new-zloader-variant-returns