Posts on AP Security

How to find malware samples

Tue, 08 Sep 2026 00:00:00 +0000

In my previous post, I discussed how sandboxes analyze malware samples. But where do cybersecurity companies find malware samples to analyze? How do they stay up to date with the latest malware versions, and how do they do it with minimal delay? Can they even get ahead of the malware authors?

Let’s find out.

Finding samples

The primary source for most companies is VirusTotal. VT is owned by Google and is the largest platform of its kind, making it the obvious first choice. It aggregates files from various sources, such as:

How does a malware sandbox work?

Sun, 06 Sep 2026 00:00:00 +0000

Ever wondered what a malware sandbox is, how it works, what information it produces, or what that information is useful for?

In this series, I’ll discuss exactly that. In this post I’ll go through the overall process and generalize a lot; in the next posts, I’ll go progressively deeper into the technical details.

What’s a malware sandbox?

It’s a VM (virtual machine) that powers up, runs malware, exports behavioral information, then gets killed and reset to a pre-run snapshot (i.e. known good pre-infection state), ready for the next run.

Hello World

Wed, 15 Jul 2026 21:28:41 +0200

Welcome to Advanced Persistent Security, aka AP Security.

In this blog I’ll be writing about various security related topics that I sometimes think about. There will be a variety of topics, but most of them will be related to software engineering, cybersecurity, enterprise security, etc.

Who’s the author?

I’m a senior security engineer with a background in software engineering, reverse engineering, and enterprise security. I worked at various tech companies for over a decade, and I’d like to share some of the lessons learned with you.