# Walking on EggStremes.

Page: https://stenobird.com/podcast/research-saturday-1377435/walking-on-eggstremes
Text version: https://stenobird.com/podcast/research-saturday-1377435/walking-on-eggstremes.md
Podcast: [Research Saturday](https://stenobird.com/podcast/research-saturday-1377435)
Published: 2026-01-10T06:00:00+00:00
Episode link: https://thecyberwire.com/podcasts/research-saturday/407/notes
Audio file: https://pdst.fm/e/pdrl.fm/6ec23a/traffic.megaphone.fm/CYBW3905401011.mp3?updated=1767985306
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/research-saturday-1377435/episodes/walking-on-eggstremes
Duration seconds: 1681

## Resource

This week, we are joined by Martin Zugec, Technical Solutions Director from Bitdefender, sharing their work and findings on "EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company." Built for long-term espionage, the campaign uses DLL sideloading, in-memory execution, and abused Windows services to stay stealthy and persistent. We walk through how the multi-stage framework delivers a powerful backdoor with reconnaissance, lateral movement, data theft, and keylogging capabilities—and what this operation reveals about the evolving tactics defenders need to watch for. The research can be found here: EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company Learn more about your ad choices. Visit megaphone.fm/adchoices

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/research-saturday-1377435/episodes/walking-on-eggstremes/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/research-saturday-1377435/walking-on-eggstremes.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.