Armin Buescher

The analysts were nestled all snug in their beds; While visions of assembly danced in their heads; And the red team in their hoodies, and I in my cap, Had just settled our brains for a long winter's nap,

When out on Twitter there arose such a clatter, I sprang from my bed to see what was the matter. Away to the laptop I flew like a flash, Tore open the logs and threw up the bash.

The moon on the breast of the display glow, Gave a lustre of midday to the keyboard below, When what to my wondering eyes did appear, But a miniature loader that gave me fear,

With a little old operator so lively and at ease, I knew in a moment he must be Chinese. More rapid than eagles his tools they came, And he whistled, and shouted, and called them by name:

"Now, PlugX! now, PoisonIvy! now Termite and a dropper! On, gh0st! on, Mimikatz! on, Htran and China Chopper! To the top of the endpoint! to the top of the directory! Now dash away! dash away! dash away into the memory!"

So up to the firewall the downloads they flew With the sleigh full of malware, and Powershell too— As I drew in my head, and was turning around, Down the proxy the operator came with a bound.

He was dressed all in black, from his head to his foot, And his clothes were all tarnished with Cheetos and soot; A bundle of documents he had flung on his back, And he looked like a thief just opening his pack.

His droll little mouth he drew up in a pinch, And the hair on his head was as green as the Grinch; He was chubby and plump, and coded in Delph, And I laughed when I saw him, in spite of myself;

A wink of his eye and a sandbox report Soon gave me to know I had no retort; He typed not a word, but clicked all his work, And filled all the ZIPs; then turned with a jerk,

And laying his finger aside of his nose, And giving a nod, up the gateway he rose; He sprang to his server, to his team gave a whistle, And away they all flew like the down of a thistle.