category agnostic blogging on ckwads https://ckwads.com/posts/updates/ Recent content in category agnostic blogging on ckwads Hugo -- gohugo.io en-us This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License. Fri, 07 Aug 2026 00:00:00 +0000 clearfake infra tracking with self-hosted n8n https://ckwads.com/posts/updates/clearfake-infra-tracking-with-self-hosted-n8n/ Fri, 07 Aug 2026 00:00:00 +0000 https://ckwads.com/posts/updates/clearfake-infra-tracking-with-self-hosted-n8n/ <h2 id="introduction">Introduction</h2> <p>Howzit! I suppose this is my first post on here. Short and sweet.</p> <p>Ever since ClearFake started using the EtherHiding technique, which was in <a href="https://rmceoin.github.io/malware-analysis/2024/05/07/clearfake2.html">2024</a>, I&rsquo;ve been pretty keen on not only understanding how it works, but also with tracking updates to the infrastructure. I&rsquo;ve accomplished both, and so have a lot of other people, but with my recent deep dive into automation I wanted to pair the two together.</p> Introduction

Howzit! I suppose this is my first post on here. Short and sweet.

Ever since ClearFake started using the EtherHiding technique, which was in 2024, I’ve been pretty keen on not only understanding how it works, but also with tracking updates to the infrastructure. I’ve accomplished both, and so have a lot of other people, but with my recent deep dive into automation I wanted to pair the two together.

Beginnings

Conclusion

]]>