ThreatLab Blog https://threatlabsandbox.com/blog/ Malware analysis, sandboxing, and detection engineering notes from the team building ThreatLab. en-us Thu, 08 Oct 2026 12:00:00 GMT https://www.rssboard.org/rss-specification Building a malware sandbox on Hyper-V: the problems nobody documents https://threatlabsandbox.com/blog/malware-sandbox-hyper-v/ https://threatlabsandbox.com/blog/malware-sandbox-hyper-v/ Thu, 08 Oct 2026 12:00:00 GMT Most guides to building a malware lab start with VirtualBox or VMware. We built on Hyper-V instead and found almost nothing written about it. What the platform actually gives you for telemetry, containment and fast resets - and the quirk that will quietly take your ports. Andrew, ThreatLab Founder Analyzing suspicious files under CMMC: the boundary problem https://threatlabsandbox.com/blog/cmmc-malware-analysis/ https://threatlabsandbox.com/blog/cmmc-malware-analysis/ Wed, 24 Jun 2026 12:00:00 GMT When a suspicious file shows up in a CMMC-scoped environment, where do you actually analyze it? Uploading to a cloud sandbox can move CUI outside your boundary - exactly what the framework exists to prevent. A look at the analysis-boundary problem and the considerations behind it. Andrew, ThreatLab Founder Living off the land: how attackers use your own tools against you https://threatlabsandbox.com/blog/lolbins-living-off-the-land/ https://threatlabsandbox.com/blog/lolbins-living-off-the-land/ Wed, 03 Jun 2026 12:00:00 GMT A lot of modern intrusions don't involve a foreign binary at all - attackers use programs already on the machine, signed by Microsoft, used legitimately every day. What LOLBins are, why they work, and what catching them actually looks like. Andrew, ThreatLab Founder Command and control in 2026: how malware actually phones home https://threatlabsandbox.com/blog/c2-in-2026/ https://threatlabsandbox.com/blog/c2-in-2026/ Sun, 24 May 2026 12:00:00 GMT Most people's mental model of malware C2 hasn't moved in a decade. A tour of where C2 actually lives now - DGAs, fast-flux, legitimate services as channels, DoH abuse, traffic mimicry - and what catching it requires. Andrew, ThreatLab Founder Cloud sandbox vs local sandbox: which is right for your team? https://threatlabsandbox.com/blog/cloud-vs-local-sandbox/ https://threatlabsandbox.com/blog/cloud-vs-local-sandbox/ Tue, 19 May 2026 12:00:00 GMT Both have real strengths. A direct look at where each one wins, when each one loses, and a framework for picking the right tool for your team. Andrew, ThreatLab Founder