Reverse engineering, infrastructure analysis, and detection content for the ShinySp1d3r ransomware family and an associated rogue ScreenConnect / MeshCentral estate. 63 findings, 9 YARA, 36 Sigma, 18 KQL. Attribution: Scattered Spider / SLSH (Likely, low confidence). ICD-203 throughout. (287)
reverse-engineering suricata ransomware malware-analysis cti sigma yara threat-intelligence screenconnect kql detection-engineering meshcentral golang-malware ransomware-analysis shinyhunters icd-203 shinysp1d3r sh1nysp1d3r scattered-spider scattered-lapsus-hunters
-
Updated
Jul 16, 2026 - YARA