🎯 Timestomping

The items that name it 7

• AI-Powered Espionage Campaign Targets Government Linux Infrastructure
  article2026-10-15

  touch -t set old timestamps on long-term malicious files

• Investigating Ephemeral Supply Chain Tampering
  writeup2026-10-15

  Forged 2024 PE compilation timestamps in the CROSSROAD dropper to complicate forensic timelines

• Determined Attacker Uploads Malicious Webshells to Parks and Rec Management Platform Servers
  writeup2026-09-30

  Manipulating file metadata (last modified, last accessed, creation time) via web.config and PowerShell to match legitimate website files and evade forensic timeline analysis

• StyleSmuggler: Magento/Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack
  writeup2026-09-05

  Wraith implant files in php-fpm's private /tmp have timestomped mtime but real birth time

• Defence Impairment Olympics
  writeup2026-06-29

  Threat actor falsified MAC (Modified, Accessed, Created) file timestamps on a re-uploaded webshell to corrupt forensic timelines

• PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182
  writeup2025-12-10

  ZinFoq includes a change_file_time command/capability to modify file timestamps for anti-forensic purposes.

• [s|l]trace - Linux Malware Analysis
  writeup2024-02-01

  BPFDoor uses the utimes() syscall to change the access/modification timestamps of /dev/shm/kdmtmpflush to 2008-10-30 19:17:16 to evade forensic timeline analysis