FLARE - leading the world in advanced binary analysis
FLARE is a team of elite reverse engineering professionals specializing in advanced malware analysis. Known for their expertise, open source tools, and training, their vital threat intelligence enables robust incident response efforts and strengthens global cyber defenses through the Google Threat Intelligence product.
FLARE research
FLARE blog posts help shape the reverse engineering landscape by disseminating cutting-edge research, practical analysis techniques, and insights into new malware tactics.
- Time travel triage: Analyze obfuscated .NET malware with TTDLearn to use Time Travel Debugging to rewind execution and defeat process hollowing in WinDbg.
5-min read
Read the blog - DPRK's blockchain malwareNorth Korea uses EtherHiding to hide persistent malware on blockchains, avoiding takedowns.
7-min read
Read the blog - FLARE-VM upgradesFLARE-VM's new GUI and expanded toolset are sharpening malware analysis and reverse engineering.
7-min read
Read the blog
- Oracle EBS zero-day extortionZero-day in Oracle E-Business Suite (CVE-2025-61882) exploited by CL0P for data theft extortion.
15-min read
Read the blog - Ongoing SonicWall Secure Mobile Access exploitationUNC6148 is exploiting end-of-life SonicWall appliances with an OVERSTEP backdoor to steal data
12-min read
Read the blog - Unraveling time: A deep dive into TTD instruction emulation bugsThis blog post examines emulation challenges, historical context, and analyzes emulation bugs.
16-min read
Read the blog
Open source projects
The FLARE open source tools empower reverse engineers, malware analysts, and security researchers to analyze malicious software and complex binaries.
FLARE-VMA Windows-based virtual machine distribution for reverse engineering and malware analysis.Find FLARE-VM on GitHub
CAPADetect capabilities in executable files using a community-driven rule collection.Find CAPA on GitHub
FLOSSUse advanced static analysis techniques to extract obfuscated strings.Find FLOSS on GitHub
FakeNet-NGIntercept and redirect network traffic while simulating network services.Find FakeNet-NG on GitHub
XREFERAn IDA Pro plugin providing advanced navigation features for efficient analysis of complex binaries.Find XREFER on GitHub
GoReSymA cross-platform Go symbol parser that extracts program and function metadata.Find GoReSym on GitHub
FLARE-On Capture-the-Flag (CTF) challenge
The Flare-On challenge is the FLARE team's annual CTF contest featuring a gauntlet of reverse engineering puzzles whose designs draw inspiration from frontline malware analysis.
- FLARE-On 12Check out the leader board and review challenge solutions.FLARE-On 12
- FLARE-On 11Missed a challenge? Revisit with official solutions. It's over, so learn.Challenge Yourself!
- FLARE-On 10Reverse engineering is a timeless art and these challenges can sharpen your reversing skills.Challenge solutions
Community projects
The FLARE team's participation in Google Summer of Code (GSoC) cultivates a lasting impact on the open source landscape, nurturing emerging talent, and enriching the capabilities of essential reversing tools.
- GSoC 2025: Explore malware analysis and reverse engineering with FLAREDive into emulation, disassembly, and more.Read the blog
- GSoC 2024: Building capa explorer webVisualize capa's reverse engineering insights in your browser.Read the blog
- GSoC 2023: Improving fakenet-ng, capa, and FLOSSExplore the new features and meet the authors behind them.Read the blog
