Red Canary Blog
redcanary.com · Company blog · on HN since 2020
Red Canary is a security company whose blog covers malware analysis, threat detection, macOS and Linux threats, and tooling like Mac Monitor.
What HN saysHN commenters link it for detailed malware write-ups, such as Silver Sparrow and eBPF malware, though one finds its Mac tool hard to download.
22HN people shared it
10linked it in comments
12stories submitted
46story points
2 years agolast shared
2020people per year2026
Most-shared posts
- 1Silver Sparrow macOS Malware with M1 Compatibility10 people · 17 points · first shared 2021 · discussion on HN
- 2Unlocking Heaven's Gate on Linux1 people · 20 points · first shared 2020 · 1 comments on HN
- 3“SemaG DNA NuF” with Right-to-Left Override Unicode Characters1 people · 2 points · first shared 2020 · discussion on HN
- 4A Pastebin scraper, steganography, and a persistent Linux backdoor1 people · 2 points · first shared 2020 · discussion on HN
- 5What to do when you outgrow your Kubernetes cluster1 people · 1 points · first shared 2021 · discussion on HN
- 6Red Canary Mac Monitor1 people · 1 points · first shared 2023 · 1 comments on HN
- 7Fuzzing Golang msgpack for fun and panic1 people · 1 points · first shared 2023 · discussion on HN
- 82025 Threat Detection Practitioner Playbook1 people · 1 points · first shared 2025 · discussion on HN
- 9Broken zippers: Detecting deception with Google’s new ZIP domains1 people · 1 points · first shared 2023 · discussion on HN
- 10Ebpf malware1 people · first shared 2023
- 11Mac threat analysis tool1 people · first shared 2023
- 12Careers1 people · first shared 2021
- 13Managed detection and response1 people · first shared 2021
- 14Its all fun and games until ransomware deletes the shadow copies1 people · first shared 2021
What HN people wrote when they linked it
drtgh · 2023-06-05
eBPF, I thought we were friends!
https://www.youtube.com/watch?v=5zixNDolLrg
eBPF, A new frontier for malware
https://redcanary.com/blog/ebpf-malware/
How Hackers Use eBPF
https://cymulate.com/blog/ebpf_hacking/
Linux eBPF Stack Trace Hack
https://www.brendangregg.com/blog/2016-01-18/ebpf-stack-trace-hack.htm…
cmcconomy · 2023-05-02
The website makes it extremely difficult to figure out how to download it;
https://redcanary.com/mac-threat-analysis-tool/
pizza234 · 2021-06-04
AFAIK, Windows has support for snapshotting as well (Volume Shadow Copy Service¹), and (again AFAIK) certain malware disables it.
The whole point is that if malware gets root access (or anything that can manipulate the disk at will), there's nothing that can be done.
EDIT: briefly searched, and indeed, my suspicions were correct: https://redcanary.com/blog/its-all-fun-and-games-until-ransomware-dele…
¹=https://docs.microsoft.com/en-us/windows-server/storage/file-server/vo…
marcod · 2021-02-22
This has a good breakdown of how it works https://redcanary.com/blog/clipping-silver-sparrows-wings/
beervirus · 2021-02-22
What a silly title. It may not have some active payload right now, but that doesn't mean it won't tomorrow. Seems like a reasonable strategy to spread the malware as wide as possible, then push an update to trigger whatever behavior you want. And yes, it does check for updates.
> Every hour, the persistence LaunchAgent tells launchd to execute a shell script that downloads a JSON file to disk, converts it into a plist, and uses its properties to determine further actions.
https://redcanary.com/blog/clipping-silver-sparrows-wings
kennywinker · 2021-02-22
Check for the existence of these files:
~/Library/._insu (empty file used to signal the malware to delete itself)
/tmp/agent.sh (shell script executed for installation callback)
/tmp/version.json (file downloaded from from S3 to determine execution flow)
/tmp/version.plist (version.json converted into a property list)
https://redcanary.com/blog/clipping-silver-sparrows-wings/
Gys · 2021-02-20
> For those who want to check if they're Mac has been infected, Red Canary provides indicators of compromise at the end of its report.
At the end of https://redcanary.com/blog/clipping-silver-sparrows-wings/
afrcnc · 2021-02-20
Actual source, not this wattered-down Ars rewrite: https://redcanary.com/blog/clipping-silver-sparrows-wings/
mceachen · 2021-02-20
Look at the files in the "Detection opportunities" section at the bottom of the article: https://redcanary.com/blog/clipping-silver-sparrows-wings/
tylersprx · 2021-01-04
Red Canary | Multiple Engineering Roles | Full-Time | Denver, CO | REMOTE (USA)
-Senior Software Engineer, Ruby/Rails
-Software Engineer, Ruby/Rails
-Engineering Manager
-Senior Software Engineer, Rust/Go & Linux
-Senior Production Engineer
We primarily work with: Ruby/Rails, React, PostgreSQL, Rust, Go, AWS, Kubernetes, Terraform
Red Canary is a fast paced security company, headquartered in Denver, CO. Our technical roles have been remote/dispersed across the US since we were founded in 2013. Red Canary is private (Series B), roughly around ~250 employees.
Red Canary is a security operations ally to organizations of all sizes. We deliver outcome-focused solutions that can be deployed in minutes to identify and shut down cyber attacks.
Product Demo: https://redcanary.com/products/managed-detection-and-response/
Apply Here: https://redcanary.com/careers/