Kevin Henson

Malware Reverse Engineer, IBM

Kevin joined IBM Security’s X-Force IRIS team as a Malware Reverse Engineer in November 2018 after 21 years of experience in supporting various commercial, Department of Defense and Intelligence Community projects. Currently, Kevin performs malware reverse engineering, develops malware configuration parsers, YARA signatures, and network signatures. In addition to his technical responsibilities, Kevin enjoys mentoring junior members of his team. Prior to joining IBM Security’s X-Force IRIS team, Kevin spent 9 years performing forensic examinations, intrusions analysis and malware reverse engineering for the Department of Defense Cyber Crime Center (DC3).

Malware September 1, 2022

Raspberry Robin and Dridex: Two birds of a feather

8 min read - IBM Security Managed Detection and Response (MDR) observations coupled with IBM Security X-Force malware research sheds additional light on the mysterious objectives of the operators behind the Raspberry Robin worm. Based on a comparative analysis between a downloaded Raspberry Robin…

Intelligence & Analytics May 26, 2022

Black Basta besting your network?

7 min read - This post was written with contributions from Chris Caridi and Kat Weinberger. IBM Security X-Force has been tracking the activity of Black Basta, a new ransomware group that first appeared in April 2022. To date, this group has claimed attribution…

Malware March 4, 2022

New wiper malware used against Ukranian organizations

3 min read - March 7, 2022 Update A correction has been applied to this blog, further analysis of the wiper malware revealed that the wiper leverages an implementation of the Mersenne Twister pseudorandom number generator (PRNG) and not ISAAC PRNG as originally reported.…

Endpoint February 2, 2022

TrickBot gang uses template-based metaprogramming in Bazar malware

6 min read - Malware authors use various techniques to obfuscate their code and protect against reverse engineering. Techniques such as control flow obfuscation using Obfuscator-LLVM and encryption are often observed in malware samples. This post describes a specific technique that involves what is…

Advanced Threats August 29, 2019

More_eggs, Anyone? Threat Actor ITG08 Strikes Again

14 min read - X-Force IRIS observed ITG08, which has historically targeted POS machines in the retail and hospitality sectors, injecting malicious code into online checkout pages to steal payment card data.

Failed to load data

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.

Subscribe today

Analysis and insights from hundreds of the brightest minds in the cybersecurity industry to help you prove compliance, grow business and stop threats.

Cybersecurity News By Topic By Industry Exclusive Series X-Force Podcast Events Contact About Us

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Kevin Henson

Raspberry Robin and Dridex: Two birds of a feather

Black Basta besting your network?

New wiper malware used against Ukranian organizations

TrickBot gang uses template-based metaprogramming in Bazar malware

More_eggs, Anyone? Threat Actor ITG08 Strikes Again

{{{title}}}

Topic updates