Where Have All the Complex Windows Malware and Their Analyses Gone?

I like the hook of the article but this feels LLM written?

There's the kind of cliched writing style that makes want to stop reading unfortunately, I assume the header names and the dashes, not sure if someone else can clue me in for what my subconscious spots

There’s no shortage of new (and sometimes, advanced) Windows malware - I see it every day.

A few thoughts:

• You don’t need fancy, cutting edge malware if you can maintain persistence on edge devices or unmanaged hosts without auditing/EDR/etc. - just fire up chisel.
  • If you do need something more advanced, you only use it where you absolutely have to; why burn your best tool on a target that won’t catch you anyway?
• Advanced red teams have moved to a model of selling tools to trusted third parties with strong vetting (e.g. MDSec with Nighthawk), or keeping their offensive capabilities internal-only, this:
  • Prevents another CobaltStrike, and
  • Helps them maintain competitive advantage in a competitive marketplace.

In my personal opinion, the answer to OP’s question is quite simple:

• If a red team has all of their TTPs burnt, they will struggle to perform their job (which affects the viability of their business) - where’s the incentive for them to share their latest tricks publicly unless it’s guaranteed to bring them new customers?
• If a security org (public or private) discovers a TTP that’s actively identifying bad actors, where a public post would lead to the actor retooling - what’s their incentive to show their entire hand to anyone outside of trusted parties?

Is it cool to read about new malware every day? Yeah! On the other hand, is everyone on the defensive side exposing their entire hand every time they find something “cool” a sustainable defensive strategy? I’d argue no.