Loading story…
Reverse-engineering researchers published tooling and documentation that expose the inner workings of FinSpy, including a static unpacker, VM disassembler, and deobfuscation components hosted in the RolfRolles/FinSpyVM repository. The work targets FinSpy's custom virtual machine protection and provides practical artifacts for analysts to reconstruct protected code, while separate public documentation from the Chaos Computer Club details analysis of FinSpy for Android and includes leaked files, samples, graphs, tables, and a report on the spyware's components.
A technical walkthrough describing the devirtualization process said the analyzed FinSpy sample relied on a comparatively weak virtualization scheme in which much of the VM bytecode already contained raw x86 machine code. The author outlined a four-stage method for simplifying bytecode, recovering virtualized function calls and pointers, and performing a second devirtualization pass to produce a complete x86 code blob for loading into IDA, giving defenders and malware analysts a clearer path to inspect FinSpy behavior and internals.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A visible commit in the Chaos Computer Club's FinSpy documentation repository added a "phineas phisher torrent." The repository hosts documentation, leaked files, samples, graphs, tables, and a PDF report on FinSpy analysis.
A visible commit in the Chaos Computer Club's FinSpy documentation repository fixed parser output for "TlvTypeInstalledModules." This reflects ongoing maintenance of published analysis materials and tooling around FinSpy components.
The third and final part of a FinSpy VM unpacking series was published, detailing how the author reconstructed x86 code from FinSpy VM bytecode and produced a complete devirtualized code blob for analysis in IDA. The post describes the FinSpy VM protection as weak and explains the four-phase devirtualization process.
A GitHub repository titled "Static unpacker for FinSpy VM" was created to host tooling and notes for unpacking, VM analysis, disassembly, and devirtualization of FinSpy. The visible history shows an initial commit for FinSpyDeob.py and repository setup activity beginning on this date.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcemsreverseengineering.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers published detailed reverse-engineering work on **FinFisher/FinSpy** spyware, showing how the surveillance tool hides its payload behind heavy anti-analysis protections and a proprietary virtual machine. ESET documented Windows samples that use complementary conditional-jump pairs after nearly every instruction to break disassembly, then decrypt and execute protected bytecode through a custom virtual CPU. The whitepaper describes how analysts can peel back those layers by reconstructing components such as `vm_start`, `vm_dispatcher`, `vm_context`, and `vm_handlers`, noting that the examined VM used **34 handlers** and could mix virtualized logic with native instructions when full virtualization was impractical. Additional reverse-engineering research expanded on that work by demonstrating how to simplify and devirtualize FinSpy bytecode into equivalent x86 logic. The analysis focused on removing instruction patterns tied to a dedicated **SCRATCH** register, replacing them with canonical VM forms or direct x86 operations, and decoding sequences that represented x86-style memory addressing and memory access. After those transformations, the remaining bytecode was reduced largely to branch and raw x86-related instructions, and the researcher also corrected an earlier interpretation of one opcode, concluding that a supposed `CRASH` instruction was actually an unconditional jump. Together, the findings show that FinFisher’s protections were built to frustrate reverse engineering and conceal configuration data and newer spyware capabilities.
Aug 14, 2026
Researchers published proof-of-concept tooling to deobfuscate **Nymaim** malware, showing how analysts can recover cleaner code and improve reverse engineering in **IDA Pro**. One GitHub project, **Nymaim deobfuscation**, uses **miasm** for emulation and **grap** for graph-pattern matching to identify and patch common Nymaim obfuscation routines such as `push_reg`, `detour_call`, and `detour_jmp`, then generates an IDA script to rename functions and produce a cleaned sample. A related Bitbucket project, **Patchwork**, was built to demonstrate malware deobfuscation against the same malware family inside IDA using a modified **PyEmu** engine. The author described upgrades including stronger memory management, better support for uncommon x86 instructions, and a Python 2.7-compatible rebuild of **pydasm**, alongside setup guidance for loading Nymaim samples and running the deobfuscation workflow, underscoring a broader effort to automate analysis of heavily obfuscated Nymaim binaries.
Aug 15, 2026
Researchers analyzing a **SystemBC** malware sample found it was protected by **VMProtect 3.6+**, which used layered anti-analysis techniques to frustrate debugging and unpacking. The protection chain reportedly included multiple debugger-detection methods, direct system calls, Windows build-number validation through structures such as `KUSER_SHARED_DATA`, fresh `NTDLL` remapping, and syscall-number extraction designed to evade user-mode hooks. The sample also appeared to rely on well-known anti-debugging and evasion patterns documented in public research, including low-level checks associated with segment handling and other debugger-detection tricks. The analysts said VMProtect also performed anti-virtualization checks using **CPUID**, trap-flag behavior, and firmware-table inspection, exposing artifacts left by some older **VirtualBox** environments. To bypass those defenses, they modified **ScyllaHide** to spoof additional version fields, hook more APIs, change section-mapping behavior, and suppress firmware-table results. Those countermeasures allowed them to debug and unpack the malware, revealing that the **SystemBC** payload had been packed a second time beneath the VMProtect layer.
Aug 15, 2026