NorthQuinn
NorthQuinn Inc.

Threat Intelligence
Research.

Primary research and threat actor analysis published by NorthQuinn Inc. All findings submitted through responsible disclosure channels before publication.

TLP:CLEAR — Approved for unrestricted community distribution per FIRST TLP 2.0

Responsible Disclosure: All IOCs and novel findings in NorthQuinn research are submitted to Shadowserver Foundation, CISA ICS-CERT, VirusTotal, and AbuseIPDB prior to publication. Malware samples are submitted to VirusTotal and MalwareBazaar for community benefit.

Publications

Published findings

NQ-DER-2026-001 August 2026

Beacon Detection Without a SIEM: Multi-Signal Correlation as a Basis for Low-False-Positive C2 Identification

Beacon detection keyed on interval regularity alone produces an unmanageable false-positive rate, because benign periodic traffic shares the same timing signal. This paper presents a multi-signal correlation method that scores ten independent signals across Zeek connection, DNS, and TLS logs, spanning timing, volume, connection shape, certificate posture, and DNS behavior. Because a genuine C2 channel exhibits several of these characteristics simultaneously while benign services rarely do, requiring cross-signal agreement suppresses false positives without lowering sensitivity to the threat. Each signal is scored independently, weighted, ATT&CK-mapped, and reported with the evidence that produced it, yielding findings an analyst can audit rather than opaque scores. The method requires no SIEM, database, or agent and operates on a packet capture or Zeek log directory. It is implemented as the open-source tool beacon-score.

Detection EngineeringC2BeaconingZeekJA3/JA4DGAATT&CKThreat HuntingNetwork Security
Download PDF
NQ-MTF-2026-001 August 2026

Reconstructing Telephony Faults from the Radio Log: Per-Slot Event Timelining Under an Adversarial Input Model

Telephony failures on Android are diagnosed from a high-volume radio log in which the diagnostically significant events (service loss, radio access technology downgrades, IMS deregistration, registration flapping, explicit reject causes) are obscured by routine noise and complicated by multi-SIM interleaving. This paper presents a method that extracts these events into a normalized, per-slot timeline using a ranked RAT transition model, classifies five anomaly types by severity, and does so under an explicit adversarial input model in which log content is treated as untrusted. Design commitments include subscriber-identifier redaction by default via hashed tokens that preserve correlation semantics, terminal escape-injection defense, data minimization, crafted-input resource guards, and SHA-256 integrity stamping of the analyzed bytes. Downgrades toward the 2G family are weighted HIGH as a cell-site-simulator indicator, with the stated boundary that host-side logs cannot confirm radio-frequency conclusions. The method is grounded in field diagnosis of a secondary-profile IMS registration fault on GrapheneOS and is implemented as the open-source tool radio-triage.

Mobile ForensicsTelephonyAndroidIMS/VoLTEGrapheneOSCell-Site SimulatorRedactionLogcatDFIR
Download PDF
From Research To Detection

This research is the collection layer.
AVERY is what it feeds.

The infrastructure behind these publications runs continuously. The findings become detection logic, and the detection logic becomes AVERY. Read the papers, test the tools, then see the platform.

Explore AVERY Open-Source Tools