/vx/Malware Analysis/2019/

1056 directories 0 files
Name Size Modified
Go up — —
2019-01-01 - VB2018 - Inside Formbook InfoStealer/ —
2019-01-02 - Analysis of Neutrino Bot Sample (dated 2018-08-27)/ —
2019-01-03 - Digging into BokBot’s Core Module/ —
2019-01-03 - LOLbins and trojans- How the Ramnit Trojan spreads via sLoad in a cyberattack/ —
2019-01-04 - How to Decrypt the Aurora Ransomware with AuroraDecrypter/ —
2019-01-04 - mimikatz Repository/ —
2019-01-05 - Emotet Research/ —
2019-01-05 - Getting 'rid' of pre-installed Malware on my YellYouth Android Tablet/ —
2019-01-06 - [RAT] DARK TRACK ALIEN 4.1/ —
2019-01-07 - ChinaZ Revelations- Revealing ChinaZ Relationships with other Chinese Threat Actor Groups/ —
2019-01-07 - GandCrab Operators Use Vidar Infostealer as a Forerunner/ —
2019-01-07 - Let's Learn- Deeper Dive into Gamaredon Group Pteranodon Implant Version '_512'/ —
2019-01-08 - DarkHydrus delivers new Trojan that can use Google Drive for C2 communications/ —
2019-01-09 - Análisis de Linux.Sunless/ —
2019-01-09 - Global DNS Hijacking Campaign- DNS Record Manipulation at Scale/ —
2019-01-09 - Ryuk Ransomware Attack- Rush to Attribution Misses the Point/ —
2019-01-09 - ServHelper and FlawedGrace - New malware introduced by TA505/ —
2019-01-10 - [DNSPIONAGE] – Focus on internal actions/ —
2019-01-10 - Big Game Hunting with Ryuk- Another Lucrative Targeted Ransomware/ —
2019-01-10 - Global DNS Hijacking Campaign- DNS Record Manipulation at Scale/ —
2019-01-10 - Pylocky Unlocked- Cisco Talos releases PyLocky ransomware decryptor/ —
2019-01-10 - TA505 Group Adopts New ServHelper Backdoor and FlawedGrace RAT/ —
2019-01-11 - A Nasty Trick- From Credential Theft Malware to Business Disruption/ —
2019-01-11 - A Zebrocy Go Downloader/ —
2019-01-11 - PHA Family Highlights- Zen and its cousins/ —
2019-01-11 - TA505 Crime Gang Debuts Brand-New ServHelper Backdoor/ —
2019-01-11 - The “AVE_MARIA” Malware/ —
2019-01-11 - Threat Actor “Cold River”- Network Traffic Analysis and a Deep Dive on Agent Drable/ —
2019-01-14 - A Quick Solution to an Ugly Reverse Engineering Problem/ —
2019-01-14 - Juicy Potato (abusing the golden privileges)/ —
2019-01-15 - Analyzing COMmunication in Malware/ —
2019-01-15 - Disclosure of Chilean Redbanc Intrusion Leads to Lazarus Ties/ —
2019-01-15 - Djvu Ransomware Spreading New .TRO Variant Through Cracks & Adware Bundles/ —
2019-01-16 - APT Dark Hydrus/ —
2019-01-16 - North Korean hackers infiltrate Chile's ATM network after Skype job interview/ —
2019-01-17 - BlackRouter Ransomware Promoted as a RaaS by Iranian Developer/ —
2019-01-17 - Emotet infections and follow-up malware/ —
2019-01-17 - Google Play Apps Drop Anubis Banking Malware, Use Motion-based Evasion Tactics/ —
2019-01-17 - Malware Used by Rocke Group Evolves to Evade Detection by Cloud Security Products/ —
2019-01-17 - Malware Used by “Rocke” Group Evolves to Evade Detection by Cloud Security Products/ —
2019-01-17 - Pond Loach delivers BadCake malware/ —
2019-01-17 - Qealler — The Silent Java Credential Thief/ —
2019-01-17 - Sliver Implant Framework/ —
2019-01-18 - BLACK ENERGY – Analysis/ —
2019-01-18 - DarkHydrus delivers new Trojan that can use Google Drive for C2 communications/ —
2019-01-18 - From Hacking Team to hacked team to...-/ —
2019-01-18 - Nymaim deobfuscation/ —
2019-01-18 - Spotted- JobCrypter Ransomware Variant With New Encryption Routines, Captures Desktop Screenshots/ —
2019-01-18 - WIRTE Group Attacking the Middle East/ —
2019-01-19 - AsyncRAT- Open-Source Remote Administration Tool For Windows CSharp/ —
2019-01-21 - HackTool-Win32-RemoteAdmin/ —
2019-01-21 - The Kutaki Malware Bypasses Gateways to Steal Users’ Credentials/ —
2019-01-22 - A Lazarus Keylogger- PSLogger/ —
2019-01-22 - Happy New Year 2019! Anatova is here!/ —
2019-01-23 - New Anatova Ransomware Supports Modules for Extra Functionality/ —
2019-01-23 - Russian Language Malspam Pushing Redaman Banking Malware/ —
2019-01-23 - SectorA01 Custom Proxy Utility Tool Analysis/ —
2019-01-24 - Cisco AMP tracks new campaign that delivers Ursnif/ —
2019-01-24 - Gandcrab and Ursnif Campaign/ —
2019-01-24 - GreyEnergy’s overlap with Zebrocy/ —
2019-01-24 - Razy in search of cryptocurrency/ —
2019-01-24 - Silence group targeting Russian Banks via Malicious CHM/ —
2019-01-25 - Toolkit collection developed to help malware analysts dissecting and detecting the packer used by GreyEnergy samples/ —
2019-01-25 - Widespread DNS Hijacking Activity Targets Multiple Sectors/ —
2019-01-28 - AZORult- Now, as A Signed “Google Update”/ —
2019-01-28 - Russia hit by new wave of ransomware spam/ —
2019-01-29 - APT38/ —
2019-01-29 - APT39- An Iranian Cyber Espionage Group Focused on Personal Information/ —
2019-01-29 - OSX-Keydnap IoCs/ —
2019-01-29 - Phobos Ransomware, A Combo of CrySiS and Dharma/ —
2019-01-30 - Analysis of NetWiredRC trojan/ —
2019-01-30 - Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities/ —
2019-01-30 - Fake Cisco Job Posting Targets Korean Candidates/ —
2019-01-30 - Matrix- Targeted, small scale, canary in the coalmine ransomware/ —
2019-01-30 - New LockerGoga Ransomware Allegedly Used in Altran Attack/ —
2019-01-30 - Operation Kitty Phishing - The Double Life of SectorA05 Nesting in Agora/ —
2019-01-30 - Orcus RAT/ —
2019-01-31 - A New Phase Of TheMoon/ —
2019-02-01 - Information about lnkr5, malware distributed via Chrome extensions/ —
2019-02-01 - LNKR - Extension analysis - Flash Playlist/ —
2019-02-01 - Tracking OceanLotus’ new Downloader, KerrDown/ —
2019-02-02 - Word-based Malware Attack/ —
2019-02-03 - Maoloa Ransomware/ —
2019-02-04 - ExileRAT shares C2 with LuckyCat, targets Tibet/ —
2019-02-04 - SpeakUp- A New Undetected Backdoor Linux Trojan/ —
2019-02-05 - Analyzing Digital Quartermasters/ —
2019-02-05 - Revisiting Hancitor in Depth/ —
2019-02-06 - Analysis of multiplatform Java Jacksbot Backdoor/ —
2019-02-06 - APT10 Targeted Norwegian MSP and US Companies in Sustained Campaign/ —
2019-02-06 - IcedID Operators Using ATSEngine Injection Panel to Hit E-Commerce Sites/ —
2019-02-06 - Qealler – a new JAR-based information stealer/ —
2019-02-06 - Some Notes on the Silence Proxy/ —
2019-02-06 - Threat Actor -Magecart-- Coming to an eCommerce Store Near You/ —
2019-02-07 - An Inside Look at the Infrastructure Behind the Russian APT Gamaredon Group/ —
2019-02-07 - DanaBot updated with new C&C communication/ —
2019-02-07 - Sales of AZORult grind to an AZOR-halt/ —
2019-02-07 - Ursnif- Long Live the Steganography!/ —
2019-02-08 - First clipper malware discovered on Google Play/ —
2019-02-10 - Android Clipper found on Google Play - video demo/ —
2019-02-11 - 620 million accounts stolen from 16 hacked websites now for sale on dark web, seller boasts/ —
2019-02-11 - How the Silence Downloader Has Evolved Over Time/ —
2019-02-12 - APT Groups Moving Down the Supply Chain/ —
2019-02-12 - GreyEnergy Malware Research Paper- Maldoc to Backdoor/ —
2019-02-12 - Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire/ —
2019-02-13 - Alert (AA19-024A)- DNS Infrastructure Hijacking Campaign/ —
2019-02-13 - Analyzing Amadey – a simple native malware/ —
2019-02-13 - Astaroth Malware Uses Legitimate OS and Antivirus Processes to Steal Passwords and Personal Data/ —
2019-02-13 - Former U.S. Counterintelligence Agent Charged With Espionage on Behalf of Iran; Four Iranians Charged With a Cyber Campaign Targeting Her Former Colleagues/ —
2019-02-14 - 127 million user records from 8 companies put up for sale on the dark web/ —
2019-02-14 - Malware Tales- Gootkit/ —
2019-02-14 - Molerats APT/ —
2019-02-14 - Worm.Win32.PYFILEDEL.AA/ —
2019-02-15 - “Sin”-ful SPIDERS- WIZARD SPIDER and LUNAR SPIDER Sharing the Same Web/ —
2019-02-16 - Emotet droppers/ —
2019-02-16 - Spoofing in the reeds with Rietspoof/ —
2019-02-17 - Hacker puts up for sale third round of hacked databases on the Dark Web/ —
2019-02-18 - A Deep Dive on the Recent Widespread DNS Hijacking Attacks/ —
2019-02-18 - APT C 36 Colombian/ —
2019-02-18 - Trojan.Android.SmsAgent 악성코드 분석 보고서/ —
2019-02-19 - ATM robber WinPot- a slot machine instead of cutlets/ —
2019-02-19 - New GandCrab v5.1 Decryptor Available Now/ —
2019-02-19 - North Korea Turns Against New Targets-!/ —
2019-02-19 - 攻撃グループTickによる日本の組織をターゲットにした攻撃活動/ —
2019-02-20 - Combing Through Brushaloader Amid Massive Detection Uptick/ —
2019-02-20 - Cybercrime is focusing on accountants/ —
2019-02-20 - Lazarus Attacks in Russia/ —
2019-02-20 - More Russian language malspam pushing Shade (Troldesh) ransomware/ —
2019-02-20 - Spoofing in the reeds with Rietspoof/ —
2019-02-21 - Fake Jobs- Campaigns Delivering More_eggs Backdoor via Fake Job Offers/ —
2019-02-21 - Shifting in the Wind- WINDSHIFT Attacks Target Middle Eastern Governments/ —
2019-02-22 - Cr1ptT0r Ransomware Infects D-Link NAS Devices, Targets Embedded Systems/ —
2019-02-22 - New BabyShark Malware Targets US National Security Think Tanks/ —
2019-02-23 - D-Link DNS-320 NAS Cr1ptT0r Ransomware ARM Dynamic Analysis - QEMU and Raspberry PI VM/ —
2019-02-25 - Defeating Compiler-Level Obfuscations used in APT10 Malware/ —
2019-02-25 - How To- Analyzing a Malicious Hangul Word Processor Document from a DPRK Threat Actor Group/ —
2019-02-25 - Multiple ArtraDownloader Variants Used by BITTER to Target Pakistan/ —
2019-02-26 - Farseer- Previously Unknown Malware Family bolsters the Chinese armoury/ —
2019-02-26 - Identifying Cobalt Strike team servers in the wild/ —
2019-02-26 - New Golang brute forcer discovered amid rise in e-commerce attacks/ —
2019-02-26 - The Arsenal Behind the Australian Parliament Hack/ —
2019-02-26 - The Supreme Backdoor Factory/ —
2019-02-27 - A Peek Into BRONZE UNION'S Toolbox/ —
2019-02-27 - A Peek into BRONZE UNION’s Toolbox/ —
2019-02-27 - New Global Cyber Attack on Point of Sale Sytem/ —
2019-02-27 - Protecting Against WinRAR Vulnerabilities/ —
2019-02-28 - EmpireMonkey malware distribution/ —
2019-02-28 - Ransomware, Trojan and Miner together against PIK Group/ —
2019-02-28 - Technical Analysis- Pacha Group Deploying Undetected Cryptojacking Campaigns on Linux Servers/ —
2019-03-01 - Breakdown of a Targeted DanaBot Attack/ —
2019-03-01 - Threat Alert- AVE Maria infostealer on the rise/ —
2019-03-03 - Op 'Sharpshooter' Connected to North Korea's Lazarus Group/ —
2019-03-04 - APT-40 - Examining a China-Nexus Espionage Actor/ —
2019-03-04 - APT40- Examining a China-Nexus Espionage Actor/ —
2019-03-04 - New Python-Based Payload MechaFlounder Used by Chafer/ —
2019-03-04 - Reptile/ —
2019-03-05 - CryptoMix Clop Ransomware Says It's Targeting Networks, Not Computers/ —
2019-03-05 - GandCrab 101- All about the most widely distributed ransomware of the moment/ —
2019-03-05 - Quick Analysis of a Trickbot Sample with NSA's Ghidra SRE Framework/ —
2019-03-06 - DE-Cr1pt0r tool - The Cr1pt0r ransomware decompiled decryption routine/ —
2019-03-06 - Internet of Termites/ —
2019-03-06 - Operation Pistacchietto - An Italian Job/ —
2019-03-06 - PINCHY SPIDER Affiliates Adopt “Big Game Hunting” Tactics to Distribute GandCrab Ransomware/ —
2019-03-06 - Taidoor Analysis/ —
2019-03-06 - Whitefly - Espionage Group has Singapore in Its Sights/ —
2019-03-06 - Whitefly- Espionage Group has Singapore in Its Sights/ —
2019-03-07 - New SLUB Backdoor Uses GitHub, Communicates via Slack/ —
2019-03-07 - Slub Backdoor/ —
2019-03-07 - The inside story of the world's most dangerous malware/ —
2019-03-08 - Emotet trojan implicated in Wolverine Solutions ransomware attack/ —
2019-03-08 - Iranian-backed hackers stole data from major U.S. government contractor/ —
2019-03-08 - Supply Chain/ —
2019-03-09 - retefe- Artefacts from various retefe campaigns/ —
2019-03-10 - BI_D Ransomware Redux (Now With 100% More Ghidra)/ —
2019-03-10 - BID Ransomware Redux (Now With 100 Percent More Ghidra)/ —
2019-03-11 - A predatory tale- Who’s afraid of the thief-/ —
2019-03-11 - Attackers Insert Themselves into the Email Conversation to Spread Malware/ —
2019-03-11 - Gaming Industry Asia/ —
2019-03-11 - Gaming industry still in the scope of attackers in Asia/ —
2019-03-11 - Researcher Claims Iranian APT Behind 6TB Data Heist at Citrix/ —
2019-03-11 - Resecurity reports ‘IRIDUIM’ behind Citrix data breach, 200+ government agencies, oil and gas companies, and technology companies also targeted/ —
2019-03-11 - Resecurity reports ‘IRIDUIM’ behind Citrix data breach, over 200 government agencies, oil and gas companies, and technology companies also targeted/ —
2019-03-11 - Study of the Belonard Trojan, exploiting zero-day vulnerabilities in Counter-Strike 1.6/ —
2019-03-12 - New Ursnif Variant targets Japan packed with new Features/ —
2019-03-12 - Nymaim config decoded/ —
2019-03-12 - Operation Comando How to Run a Cheap and Effective Credit Card Business/ —
2019-03-12 - Operation Comando/ —
2019-03-12 - SharPyShell/ —
2019-03-12 - The Advanced Persistent Threat files- Lazarus Group/ —
2019-03-13 - Analysing ISFB - The First Loader/ —
2019-03-13 - BlackBerry Cylance vs. Tinba Banking Trojan/ —
2019-03-13 - DanaBot control panel revealed/ —
2019-03-13 - DMSniff POS Malware/ —
2019-03-13 - Fake CDC Flu Pandemic Warning delivers Gandcrab 5.2 ransomware/ —
2019-03-13 - GlitchPOS Pos Malware/ —
2019-03-13 - GlitchPOS- New PoS malware for sale/ —
2019-03-13 - N Ways to Unpack Mobile Malware/ —
2019-03-13 - Operation Sheep - Pilfer-Analytics SDK in Action/ —
2019-03-13 - ORANGEWORM GROUP – KWAMPIRS ANALYSIS UPDATE/ —
2019-03-13 - The fourth horseman- CVE-2019-0797 vulnerability/ —
2019-03-13 - ‘DMSniff’ POS Malware Actively Leveraged to Target Small-, Medium-Sized Businesses/ —
2019-03-14 - Attacker Tracking Users Seeking Pakistani Passport/ —
2019-03-14 - Daily Ruleset Update Summary 2019-03-14/ —
2019-03-14 - MAR-10135536-12 – North Korean Trojan- TYPEFRAME/ —
2019-03-15 - Flash Bulletin- Emotet Epoch 1 Changes its C2 Communication/ —
2019-03-15 - Immortal information stealer/ —
2019-03-15 - Rocke Evolves Its Arsenal With a New Malware Family Written in Golang/ —
2019-03-17 - Emotet malware analysis. Part 1/ —
2019-03-17 - Global ATM Malware Wall/ —
2019-03-17 - Round 4- Hacker returns and puts 26Mil user records for sale on the Dark Web/ —
2019-03-18 - Analysis of .Net Stealer GrandSteal/ —
2019-03-18 - Analysis of BlackMoon (Banking Trojan)'s Evolution, And The Possibility of a Latest Version Under Development/ —
2019-03-18 - Enterprise Malware-as-a-Service- Lazarus Group and the Evolution of Ransomware/ —
2019-03-18 - New Mirai Variant Targets Enterprise Wireless Presentation & Display Systems/ —
2019-03-19 - Cardinal RAT Sins Again, Targets Israeli Fin-Tech Firms/ —
2019-03-19 - SectorM04 Targeting Singapore – An Analysis/ —
2019-03-20 - FIN7 Revisited- Inside Astra Panel and SQLRat Malware/ —
2019-03-20 - New Evidence Proves Ongoing WIZARD SPIDER - LUNAR SPIDER Collaboration/ —
2019-03-20 - Ransomware or Wiper- LockerGoga Straddles the Line/ —
2019-03-21 - Analysis of the latest attack activities of the suspected MuddyWater APT group against the Iraqi mobile operator Korek Telecom/ —
2019-03-21 - How Lockergoga took down Hydro — ransomware used in targeted attacks aimed at big business/ —
2019-03-21 - Interception- Dissecting BokBot’s “Man in the Browser”/ —
2019-03-22 - AZORult - Rewriting history/ —
2019-03-22 - AZORult++- Rewriting history/ —
2019-03-22 - Lucky Elephant/ —
2019-03-23 - Reverse Engineering Gootkit with Ghidra Part I/ —
2019-03-24 - JEShell- An OceanLotus (APT32) Backdoor/ —
2019-03-25 - API Hashing Tool, Imagine That/ —
2019-03-25 - Emerging Threat on RANSOM_CRYPTESLA/ —
2019-03-25 - Let’s play with Qulab, an exotic malware developed in AutoIT/ —
2019-03-25 - Operation ShadowHammer/ —
2019-03-25 - Patting the Bear (APT-C-37)- Exposure of Continued Attacks Against an Armed Organization/ —
2019-03-26 - Born This Way- Origins of LockerGoga/ —
2019-03-26 - Cryptocurrency businesses still being targeted by Lazarus/ —
2019-03-26 - The Ursnif Gangs keep Threatening Italy/ —
2019-03-26 - WinRAR Zero-day Abused in Multiple Campaigns/ —
2019-03-27 - Analysis of the ShadowHammer backdoor/ —
2019-03-27 - Elfin - Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S/ —
2019-03-27 - Elfin- Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S/ —
2019-03-27 - Emotet adds a further layer of camouflage/ —
2019-03-27 - Forging the ShadowHammer/ —
2019-03-27 - New steps to protect customers from hacking/ —
2019-03-27 - PsiXBot- The Evolution Of A Modular .NET Bot/ —
2019-03-28 - 10 Years Since Ghostnet/ —
2019-03-28 - Above Us Only Stars/ —
2019-03-28 - Analysis of ShadowHammer ASUS Attack First Stage Payload/ —
2019-03-28 - CRTC and RCMP National Division Execute Warrants in Malware Investigation/ —
2019-03-28 - Desktop , Mobile Phishing Campaign/ —
2019-03-28 - Group-IB uncovers Android Trojan named «Gustuff» capable of targeting more than 100 global banking apps, cryptocurrency and marketplace applications/ —
2019-03-28 - Let's Learn- Dissecting Operation ShadowHammer Shellcode Internals in crt_ExitProcess/ —
2019-03-28 - The return of the BOM/ —
2019-03-28 - Threat Actor Group Using Uac Bypass Module to Run Bat File/ —
2019-03-28 - Unleash The Hash - ShadowHammer MAC Address List/ —
2019-03-29 - A Hammer Lurking In The Shadows/ —
2019-03-29 - Exodus- New Android Spyware Made in Italy/ —
2019-03-29 - Researchers Find Google Play Store Apps Were Actually Government Malware/ —
2019-04-01 - Prosecutors Launch Investigation Into Company That Put Malware on Google Play Store/ —
2019-04-02 - A LockerGoga primer and decrypters for Mira and Aurora ransomwares/ —
2019-04-02 - backdoor connectback/ —
2019-04-02 - Canadian Police Raid ‘Orcus RAT’ Author/ —
2019-04-02 - New ServHelper Variant Employs Excel 4.0 Macro to Drop Signed Payload/ —
2019-04-02 - OceanLotus Steganography/ —
2019-04-02 - Report- OceanLotus APT Group Leveraging Steganography/ —
2019-04-02 - Triple Threat- Emotet Deploys Trickbot to Steal Data & Spread Ryuk/ —
2019-04-02 - WIRTE Group attacking the Middle East/ —
2019-04-02 - Xwo - A Python-based bot scanner/ —
2019-04-03 - Allanite/ —
2019-04-03 - Possible ShadowHammer Targeting (Low Confidence)/ —
2019-04-03 - RAT - Hodin/ —
2019-04-04 - BasBanke- Trend-setting Brazilian banking Trojan/ —
2019-04-04 - Bayer points finger at Wicked Panda in cyberattack/ —
2019-04-04 - IcedID Banking Trojan Spruces Up Injection Tactics to Add Stealth/ —
2019-04-04 - Mimikatz in the Wild- Bypassing Signature-Based Detections Using the “AK47 of Cyber”/ —
2019-04-05 - Pick-Six- Intercepting a FIN6 Intrusion, an Actor Recently Tied to Ryuk and LockerGoga Ransomware/ —
2019-04-05 - Spammed PNG file hides LokiBot/ —
2019-04-05 - Ursnif- The Latest Evolution of the Most Popular Banking Malware/ —
2019-04-07 - Emotet malware analysis. Part 2/ —
2019-04-07 - Mobile Malware Analysis - Tricks used in Anubis/ —
2019-04-08 - Mirai Compiled for New Processors Surfaces in the Wild/ —
2019-04-09 - Collection of helper scripts for OceanLotus/ —
2019-04-09 - Cybercrime market selling full digital fingerprints of over 60,000 users/ —
2019-04-09 - Gustuff banking botnet targets Australia/ —
2019-04-09 - LimeRAT spreads in the wild/ —
2019-04-09 - OceanLotus- macOS malware update/ —
2019-04-09 - Say hello to Baldr, a new stealer on the market/ —
2019-04-10 - Analysis of a targeted attack exploiting the WinRAR CVE-2018-20250 vulnerability/ —
2019-04-10 - Floodor- A Linux TCP - UDP Flooder/ —
2019-04-10 - Gaza Cybergang Group1, operation SneakyPastes/ —
2019-04-10 - Lazarus Group rises again from the digital grave with Hoplight malware for all/ —
2019-04-10 - Malware Analysis Report (AR19-100A)- North Korean Trojan- HOPLIGHT/ —
2019-04-10 - OSINT Reporting Regarding DPRK and TA505 Overlap/ —
2019-04-10 - Project Tajmahal a sophisticated new APT framework/ —
2019-04-10 - Project TajMahal – a sophisticated new APT framework/ —
2019-04-10 - The Gaza cybergang and its SneakyPastes campaign/ —
2019-04-10 - The Muddy Waters of APT Attacks/ —
2019-04-10 - TRISIS - TRITON - HatMan Malware Repository/ —
2019-04-11 - Ave_Maria Malware- there's more than meets the eye/ —
2019-04-11 - Lazarus rises- Warning over new HOPLIGHT malware linked with North Korea/ —
2019-04-11 - The official website of a popular video editing software was infected with a banking trojan/ —
2019-04-11 - Two Romanian Cybercriminals Convicted of All 21 Counts Relating to Infecting Over 400,000 Victim Computers with Malware and Stealing Millions of Dollars/ —
2019-04-12 - Analysis of an IRC based Botnet/ —
2019-04-12 - Emotet Malware Revives Old Email Conversations Threads to Increase Infection Rates/ —
2019-04-13 - Decoded Turla Powershell Implant/ —
2019-04-15 - A hacker has dumped nearly one billion user records over the past two months/ —
2019-04-15 - Account With Admin Privileges Abused to Install BitPaymer Ransomware via PsExec/ —
2019-04-15 - Cobalt Strike. Walkthrough for Red Teamers/ —
2019-04-15 - New HawkEye Reborn Variant Emerges Following Ownership Change/ —
2019-04-16 - DNS Tunneling in the Wild- Overview of OilRig’s DNS Tunneling/ —
2019-04-16 - Inside Scranos – A Cross Platform, Rootkit-Enabled Spyware Operation/ —
2019-04-16 - Spear Phishing Campaign Targets Ukraine Government and Military; Infrastructure Reveals Potential Link to So-Called Luhansk People's Republic/ —
2019-04-17 - Aggah Campaign- Bit.ly, BlogSpot, and Pastebin Used for C2 in Large Scale Campaign/ —
2019-04-17 - Aggah Campaign/ —
2019-04-17 - DNS Hijacking Abuses Trust In Core Internet Service/ —
2019-04-17 - Operation Sea Turtle - DNS Hijacking Abuses Trust In Core Internet Service/ —
2019-04-17 - The Dukes - 7 Years Of Russian Cyber-Espionage/ —
2019-04-18 - APT28 and Upcoming Elections- Evidence of Possible Interference (Part II)/ —
2019-04-18 - Predator the Thief- New Routes of Delivery/ —
2019-04-19 - Ocean Lotus - Funky Malware Format Found in Sample/ —
2019-04-19 - Security researcher MalwareTech pleads guilty/ —
2019-04-19 - TDL (Turla Driver Loader) Repository/ —
2019-04-22 - Analyzing Emotet with Ghidra — Part 1/ —
2019-04-22 - C-C++ Runtime Library Code Tampering in Supply Chain/ —
2019-04-22 - C-CPlusPlus Runtime Library Code Tampering in Supply Chain/ —
2019-04-22 - CARBANAK Week Part One- A Rare Occurrence/ —
2019-04-22 - Dissecting Emotet’s network communication protocol/ —
2019-04-22 - Finteam - Trojanized TeamViewer Against Government Targets/ —
2019-04-22 - FINTEAM- Trojanized TeamViewer Against Government Targets/ —
2019-04-22 - Unpacking & Decrypting FlawedAmmyy/ —
2019-04-22 - Who’s Behind the RevCode WebMonitor RAT-/ —
2019-04-23 - APT34- webmask project/ —
2019-04-23 - DNSpionage brings out the Karkoff/ —
2019-04-23 - Operation ShadowHammer - a high-profile supply chain attack/ —
2019-04-23 - Operation ShadowHammer- a high-profile supply chain attack/ —
2019-04-24 - Beapy- Cryptojacking Worm Hits Enterprises in China/ —
2019-04-24 - Deobfuscating APT32 Flow Graphs with Cutter and Radare2/ —
2019-04-24 - TA505 - LS’ ACTORS THREAT INTO TURN TOOLS ADMIN REMOTE TOOLS/ —
2019-04-25 - Chinese-based hackers attack domestic energy institutions/ —
2019-04-25 - Emotet Adds New Evasion Technique/ —
2019-04-25 - JasperLoader Emerges, Targets Italy with Gootkit Banking Trojan/ —
2019-04-25 - Threat Actor TA505 Targets Financial Enterprises Using LOLBins and a New Backdoor Malware/ —
2019-04-26 - A Closer Look at the RobbinHood Ransomware/ —
2019-04-26 - GitHub hosted Magecart skimmer used against hundreds of e-commerce sites/ —
2019-04-27 - Analyzing Amadey/ —
2019-04-29 - Where is Emotet- Latest geolocation data/ —
2019-04-30 - APT 40/ —
2019-04-30 - Behind the Scenes with OilRig/ —
2019-04-30 - Buhtrap backdoor and Buran ransomware distributed via major advertising platform/ —
2019-04-30 - Raw Threat Intelligence 2019-04-30- Oilrig data dump link analysis/ —
2019-04-30 - SectorB06 using Mongolian language in lure document/ —
2019-04-30 - Sodinokibi ransomware exploits WebLogic Server vulnerability/ —
2019-05 - Hancitor's Packer Damystified/ —
2019-05-01 - FrameworkPOS and the adequate persistent threat/ —
2019-05-02 - 2019- The Return of Retefe/ —
2019-05-02 - APT34- Glimpse project/ —
2019-05-02 - Detricking TrickBot Loader/ —
2019-05-02 - FormBook - Hiding in plain sight/ —
2019-05-02 - Goblin Panda continues to target Vietnam/ —
2019-05-02 - Qakbot levels up with new obfuscation techniques/ —
2019-05-03 - Let’s nuke Megumin Trojan/ —
2019-05-03 - Mirrorthief Group Uses Magecart Skimming Attack to Hit Hundreds of Campus Online Stores in US and Canada/ —
2019-05-03 - ZooPark - Who's in the Zoo/ —
2019-05-03 - “MegaCortex” ransomware wants to be The One/ —
2019-05-05 - Unpacking NanoCore Sample Using AutoIT/ —
2019-05-07 - ATMitch - New Evidence Spotted In The Wild/ —
2019-05-07 - Buckeye - Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak/ —
2019-05-07 - Buckeye- Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak/ —
2019-05-07 - CVE-2019-3396 Redux- Confluence Vulnerability Exploited to Deliver Cryptocurrency Miner With Rootkit/ —
2019-05-07 - MegaCortex Ransomware Spotted Attacking Enterprise Networks/ —
2019-05-07 - SystemdMiner,when a botnet borrows another botnet’s infrastructure/ —
2019-05-07 - Turla Light Neuron/ —
2019-05-07 - Turla LightNeuron- An email too far/ —
2019-05-07 - Vulnerable Apache Jenkins exploited in the wild/ —
2019-05-07 - “Filesnfer” Tool (C#, Python)/ —
2019-05-07 - “Filesnfer” Tool (CSharp, Python)/ —
2019-05-08 - A new threat for macOS spreads as WhatsApp/ —
2019-05-08 - APT OceanLotus/ —
2019-05-08 - Dharma Ransomware Uses AV Tool to Distract from Malicious Activities/ —
2019-05-08 - Fin7 hacking group targets more than 130 companies after leaders’ arrest/ —
2019-05-08 - FIN7.5 - the infamous cybercrime rig FIN7 continues its activities/ —
2019-05-08 - FIN7.5- the infamous cybercrime rig “FIN7” continues its activities/ —
2019-05-08 - Get Smart with Enhanced Memory Dumping in VMRay Analyzer 3.0/ —
2019-05-08 - “RobbinHood” ransomware takes down Baltimore City government networks/ —
2019-05-09 - Chinese national indicted for 2015 Anthem breach/ —
2019-05-09 - Deflect Labs Report #6- Phishing and Web Attacks Targeting Uzbek Human Right Activists and Independent Media/ —
2019-05-09 - Deflect Labs Report 6- Phishing and Web Attacks Targeting Uzbek Human Right Activists and Independent Media/ —
2019-05-09 - Donut - Injecting .NET Assemblies as Shellcode/ —
2019-05-09 - Github Repository of AbSent-Loader/ —
2019-05-09 - Iranian APT Leak/ —
2019-05-09 - Malware Analysis Report (AR19-129A)/ —
2019-05-09 - New KPOT v2.0 stealer brings zero persistence and in-memory features to silently steal credentials/ —
2019-05-09 - New leaks of Iranian cyber-espionage operations hit Telegram and the Dark Web/ —
2019-05-09 - RobinHood Ransomware “CoolMaker” Functions Not So Cool/ —
2019-05-09 - Strange Bits- HTML Smuggling and GitHub Hosted Malware/ —
2019-05-09 - Technical Analysis- Pacha Group Competing against Rocke Group for Cryptocurrency Mining Foothold on the Cloud/ —
2019-05-09 - Top-Tier Russian Hacking Collective Claims Breaches of Three Major Anti-Virus Companies/ —
2019-05-09 - Tracking One Year of Malicious Tor Exit Relay Activities (Part II)/ —
2019-05-10 - Exploring Mimikatz - Part 1 - WDigest/ —
2019-05-10 - MegaCortex, deconstructed- mysteries mount as analysis continues/ —
2019-05-11 - Chinese APT Vietnamese/ —
2019-05-12 - Lime Downloader v4.2/ —
2019-05-13 - A Look At Hworm - Houdini aka Njrat/ —
2019-05-13 - Scar Cruft Bluetooth/ —
2019-05-13 - ScarCruft continues to evolve, introduces Bluetooth harvester/ —
2019-05-14 - Plead malware distributed via MitM attacks at router level, misusing ASUS WebStorage/ —
2019-05-14 - Reaver- Mapping Connections Between Disparate Chinese APT Groups/ —
2019-05-14 - Return of Watchbog- Exploiting Jenkins CVE-2018-1000861/ —
2019-05-14 - The Rise of Dridex and the Role of ESPs/ —
2019-05-15 - Threat Actor Profile- TA542, From Banker to Malware Distribution Service/ —
2019-05-15 - Winnti - More than just Windows and Gates/ —
2019-05-16 - GozNym Closure Comes in the Shape of a Europol and DOJ Arrest Operation/ —
2019-05-16 - GozNym Cyber-Criminal Network Operating out of Europe Targeting American Entities Dismantled in International Operation/ —
2019-05-16 - Goznym Indictments – action following on from successful Avalanche Operations/ —
2019-05-16 - The Stealthy Email Stealer in the TA505 Arsenal/ —
2019-05-17 - TeamViewer Confirms Undisclosed Breach From 2016/ —
2019-05-18 - Operation BlackLion/ —
2019-05-19 - HiddenWasp Malware Stings Targeted Linux Systems/ —
2019-05-19 - Skreddersydd dobbeltangrep mot Hydro/ —
2019-05-20 - GozNym Banking Malware- Gang Busted, But Is That The End-/ —
2019-05-20 - Malware Against the C Monoculture/ —
2019-05-20 - Recent MuddyWater-associated BlackWater campaign shows signs of new anti-detection techniques/ —
2019-05-22 - A journey to Zebrocy land/ —
2019-05-22 - Shade Ransomware Hits High-Tech, Wholesale, Education Sectors in U.S, Japan, India, Thailand, Canada/ —
2019-05-22 - TRICKBOT - Analysis/ —
2019-05-23 - Analysing -Retefe- with Sysmon and Splunk/ —
2019-05-23 - One year later- The VPNFilter catastrophe that wasn't/ —
2019-05-23 - Sorpresa! JasperLoader targets Italy with a new bag of tricks/ —
2019-05-24 - Directed attacks against MySQL servers deliver ransomware/ —
2019-05-24 - Overview of Proton Bot, another loader in the wild!/ —
2019-05-24 - Uncovering new Activity by APT10/ —
2019-05-25 - Analyzing ISFB - The Second Loader/ —
2019-05-25 - Fas-Disassembler for Visuallisp 0.8/ —
2019-05-27 - APT-C-38/ —
2019-05-28 - Emissary Panda Attacks Middle East Government Sharepoint Servers/ —
2019-05-28 - FlawedAmmyy/ —
2019-05-28 - Threat Research- New Rocke Variant Ready to Box Any Mining Challengers/ —
2019-05-29 - A dive into Turla PowerShell usage/ —
2019-05-29 - HiddenWasp Malware Stings Targeted Linux Systems/ —
2019-05-29 - TA505 is Expanding its Operations/ —
2019-05-30 - 10 years of virtual dynamite - A high-level retrospective of ATM malware/ —
2019-05-30 - 10 years of virtual dynamite- A high-level retrospective of ATM malware/ —
2019-05-30 - Bug in Malware “TSCookie” - Fails to Read Configuration - (Update)/ —
2019-05-31 - Hidden Bee- Let’s go down the rabbit hole/ —
2019-05-31 - Thưởng tết…/ —
2019-06-01 - GandCrab Ransomware Shutting Down After Claiming to Earn $2 Billion/ —
2019-06-03 - GandCrab ransomware operators put in retirement papers/ —
2019-06-03 - Into the Fog - The Return of ICEFOG APT/ —
2019-06-03 - Report- No ‘Eternal Blue’ Exploit Found in Baltimore City Ransomware/ —
2019-06-03 - Varonis Exposes Global Cyber Campaign- C2 Server Actively Compromising Thousands of Victims/ —
2019-06-03 - Zebrocy’s Multilanguage Malware Salad/ —
2019-06-04 - 2019-06-04 Advisory- Windigo attacks/ —
2019-06-04 - Advisory- Windigo attacks/ —
2019-06-04 - APT Blueprint/ —
2019-06-04 - Inside Cybercrime Groups Harvesting Active Directory for Fun and Profit - Vitali Kremez/ —
2019-06-04 - Magecart skimmers found on Amazon CloudFront CDN/ —
2019-06-04 - Taking a look at Baldr stealer/ —
2019-06-04 - Threat Spotlight- Analyzing AZORult Infostealer Malware/ —
2019-06-05 - Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities/ —
2019-06-05 - Possible Turla HTTP Listener/ —
2019-06-05 - Scattered Canary/ —
2019-06-05 - Upgraded JasperLoader Infecting Machines with New Targets & Functional Improvements- What You Need to Know/ —
2019-06-06 - A Deep Dive into the Emotet Malware/ —
2019-06-06 - APT34- Jason project/ —
2019-06-06 - Google confirms that advanced backdoor came preinstalled on Android devices/ —
2019-06-06 - New Mirai Variant Adds 8 New Exploits, Targets Additional IoT Devices/ —
2019-06-06 - PHA Family Highlights- Triada/ —
2019-06-08 - The Evolution of Aggah- From Roma225 to the RG Campaign/ —
2019-06-08 - Vanilla RAT/ —
2019-06-10 - MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools/ —
2019-06-10 - New Muddy Waters Activities Uncovered/ —
2019-06-10 - Threat Spotlight- MenuPass-QuasarRAT Backdoor/ —
2019-06-11 - CPU miner for Litecoin and Bitcoin/ —
2019-06-11 - Fishwrap Group/ —
2019-06-11 - The InterPlanetary Storm- New Malware in Wild Using InterPlanetary File System’s (IPFS) p2p network/ —
2019-06-12 - Hide ‘N Seek Botnet Updates Arsenal with Exploits Against Nexus Repository Manager & ThinkPHP/ —
2019-06-12 - Ransomware identification for the judicious analyst/ —
2019-06-12 - Threat Group Cards/ —
2019-06-13 - Advanced Notification of Cyber Threats against Family of Malware Giving Remote Access to Computers/ —
2019-06-13 - Hunting and detecting Cobalt Strike/ —
2019-06-13 - New Pervasive Worm Exploiting Linux Exim Server Vulnerability/ —
2019-06-13 - pyLocky Decryptor Released by French Authorities/ —
2019-06-14 - Houdini Worm Transformed in New Phishing Attack/ —
2019-06-14 - Malware Tales- Sodinokibi/ —
2019-06-16 - A Deep Dive Into IcedID Malware- Part II - Analysis of the Core IcedID Payload (Parent Process)/ —
2019-06-16 - APT34 Tools Leak/ —
2019-06-17 - Good riddance, GandCrab! We’re still fixing the mess you left behind/ —
2019-06-18 - Analysis of a New HawkEye Variant/ —
2019-06-18 - Mobile Campaign ‘Bouncing Golf’ Affects Middle East/ —
2019-06-18 - Plurox- Modular backdoor/ —
2019-06-19 - Check Point’s Threat Emulation Stops Large-Scale Phishing Campaign in Germany/ —
2019-06-19 - URLZone top malware in Japan, while Emotet and LINE Phishing round out the landscape/ —
2019-06-20 - APT OceanLotus/ —
2019-06-20 - DanaBot Demands a Ransom Payment/ —
2019-06-20 - New Approaches Utilized by OceanLotus to Target An Environmental Group in Vietnam/ —
2019-06-20 - Waterbug- Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments/ —
2019-06-21 - An Analysis of Linux.Ngioweb Botnet/ —
2019-06-21 - Waterbug - Espionage Group Rolls Out Brand-New/ —
2019-06-24 - GandCrab Threat Actors Retire...Maybe/ —
2019-06-24 - LimeRAT - Simple, yet powerful remote administration tool for Windows (RAT)/ —
2019-06-24 - Ransomware REvil - Sodinokibi- Technical analysis and Threat Intelligence Report/ —
2019-06-25 - Analyzing Ursnif’s Behavior Using a Malware Sandbox/ —
2019-06-25 - More AgentTesla keylogger and Nanocore RAT in one bundle/ —
2019-06-25 - MuddyC3/ —
2019-06-25 - Operation Soft Cell - A Worldwide Campaign Against Telecommunications Providers/ —
2019-06-25 - OPERATION SOFT CELL- A WORLDWIDE CAMPAIGN AGAINST TELECOMMUNICATIONS PROVIDERS/ —
2019-06-25 - Ransomware strain Troldesh spikes again – Avast tracks new attacks/ —
2019-06-25 - Rig Exploit Kit sends Pitou.B Trojan/ —
2019-06-25 - Riltok mobile Trojan- A banker with global reach/ —
2019-06-26 - Iranian Threat Actor Amasses Large Cyber Operations Infrastructure Network to Target Saudi Organizations/ —
2019-06-26 - New Silex Malware Trashes IoT Devices Using Default Passwords/ —
2019-06-26 - ViceLeaker Operation- mobile espionage targeting Middle East/ —
2019-06-27 - Criminals, ATMs and a cup of coffee/ —
2019-06-27 - Inter- Skimmer For All/ —
2019-06-27 - ShadowGate Returns to Worldwide Operations With Evolved Greenflash Sundown Exploit Kit/ —
2019-06-27 - Tracking driver inventory to unearth rootkits/ —
2019-07-01 - An Analysis of Godlua Backdoor/ —
2019-07-01 - Operation Tripoli/ —
2019-07-01 - Ratsnif - New Network Vermin from OceanLotus/ —
2019-07-01 - Remote_Shell- A linux remote shell program/ —
2019-07-01 - Robbinhood Malware Analysis with Radare2/ —
2019-07-01 - Threat Spotlight- Ratsnif - New Network Vermin from OceanLotus/ —
2019-07-02 - LooCipher- The New Infernal Ransomware/ —
2019-07-02 - TA505 begins summer campaigns with a new pet malware downloader, AndroMut, in the UAE, South Korea, Singapore, and the United States/ —
2019-07-03 - BianLian- A New Wave Emerges/ —
2019-07-03 - Lilocked Ransomware/ —
2019-07-03 - Multiple Chinese Threat Groups Exploiting CVE-2018-0798 Equation Editor Vulnerability Since Late 2018/ —
2019-07-03 - Sodin ransomware exploits Windows vulnerability and processor architecture/ —
2019-07-04 - APT33 NewsBeef/ —
2019-07-04 - Latest Spam Campaigns from Ta505 Now Using New Malware Tools Gelup and Flowerpippi/ —
2019-07-08 - Analyzing KSL0T Turlas Keylogger Part 1/ —
2019-07-08 - Analyzing KSL0T Turlas Keylogger Part 2/ —
2019-07-08 - Dismantling a fileless campaign- Microsoft Defender ATP’s Antivirus exposes Astaroth attack/ —
2019-07-08 - Malicious campaign targets South Korean users with backdoor‑laced torrents/ —
2019-07-08 - Who’s Behind the GandCrab Ransomware-/ —
2019-07-09 - A Deep Dive Into IcedID Malware- Part I - Unpacking, Hooking and Process Injection/ —
2019-07-09 - Operation Newscaster/ —
2019-07-09 - Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniques/ —
2019-07-09 - Sea Turtle Keeps on Swimming/ —
2019-07-09 - Spear Phishing against Cryptocurrency Businesses/ —
2019-07-09 - The 2019 Resurgence of Smokeloader/ —
2019-07-10 - Agent Smith- A New Species of Mobile Malware/ —
2019-07-10 - Flirting With IDA and APT28/ —
2019-07-10 - How We Seized 15 Active Ransomware Campaigns Targeting Linux File Storage Servers/ —
2019-07-10 - LooCipher- Can Encrypted Files Be Recovered From Hell-/ —
2019-07-10 - New FinSpy iOS and Android implants revealed ITW/ —
2019-07-10 - The eCh0raix Ransomware/ —
2019-07-11 - Buhtrap group uses zero‑day in latest espionage campaigns/ —
2019-07-11 - Recent AZORult activity/ —
2019-07-11 - Threat Actor Profile- TA544 targets geographies from Italy to Japan with a range of malware/ —
2019-07-12 - BitPaymer Source Code Fork- Meet DoppelPaymer Ransomware and Dridex 2.0/ —
2019-07-12 - TrickBooster – TrickBot’s Email-Based Infection Module/ —
2019-07-13 - Free Tool- LooCipher Decryptor/ —
2019-07-15 - Is there a pattern-/ —
2019-07-15 - Is ‘REvil’ the New GandCrab Ransomware-/ —
2019-07-15 - SWEED - Exposing years of Agent Tesla campaigns/ —
2019-07-15 - SWEED- Exposing years of Agent Tesla campaigns/ —
2019-07-15 - Threat Spotlight- Virlock Polymorphic Ransomware/ —
2019-07-16 - Analysis- Server-side polymorphism & PowerShell backdoors/ —
2019-07-16 - SLUB Gets Rid of GitHub, Intensifies Slack Use/ —
2019-07-16 - The Avast Abuser- Metamorfo Banking Malware Hides By Abusing Avast Executable/ —
2019-07-17 - EvilGnome - Rare Malware Spying on Linux Desktop Users/ —
2019-07-17 - EvilGnome- Rare Malware Spying on Linux Desktop Users/ —
2019-07-17 - Newly identified StrongPity operations/ —
2019-07-17 - Who is Mr Guo-/ —
2019-07-18 - Android Malware Analysis - Dissecting Hydra Dropper/ —
2019-07-18 - Hard Pass - Declining APT34’s Invite to Join Their Professional Network/ —
2019-07-18 - Hard Pass- Declining APT34’s Invite to Join Their Professional Network/ —
2019-07-18 - Okrum and Ketrican/ —
2019-07-18 - Okrum- Ke3chang group targets diplomatic missions/ —
2019-07-18 - Spam Campaign Targets Colombian Entities with Proyecto RAT/ —
2019-07-18 - ZLab - LooCipher Decryption Tool/ —
2019-07-19 - An Analysis of L0rdix RAT, Panel and Builder/ —
2019-07-19 - Elusive MegaCortex Ransomware Found - Here is What We Know/ —
2019-07-19 - Who is Mr Wang-/ —
2019-07-21 - Emissary Panda DLL Backdoor/ —
2019-07-22 - A Deep Dive Into IcedID Malware- Part III - Analysis of Child Processes/ —
2019-07-22 - APT33 PowerShell Malware/ —
2019-07-22 - BrushaLoader still sweeping up victims one year later/ —
2019-07-22 - The Lazarus Injector/ —
2019-07-22 - Who is Mr Zeng-/ —
2019-07-23 - ABADBABE 8BADF00D- Discovering BADHATCH and a Detailed Look at FIN8’s Tooling/ —
2019-07-23 - Chinese APT “Operation LagTime IT” Targets Government Information Technology Agencies in Eastern Asia/ —
2019-07-24 - A deep dive into Phobos ransomware/ —
2019-07-24 - APT17 is run by the Jinan bureau of the Chinese Ministry of State Security/ —
2019-07-24 - Attacking the Heart of the German Industry/ —
2019-07-24 - GuessWho Ransomware – A Variant of Rapid Ransomware/ —
2019-07-24 - Operation Lag Time IT/ —
2019-07-24 - Resurgent Iron Liberty Targeting Energy Sector/ —
2019-07-24 - Updated Karagany Malware Targets Energy Sector/ —
2019-07-24 - Watching the WatchBog- New BlueKeep Scanner and Linux Exploits/ —
2019-07-24 - Winnti - Attacking the Heart of the German Industry/ —
2019-07-24 - Winnti analysis/ —
2019-07-25 - Encore! APT17 hacked Chinese targets and offered the data for sale/ —
2019-07-25 - Unmasking AVE_MARIA/ —
2019-07-26 - Turla Indicators of Compromise/ —
2019-07-28 - Third time's the charm- Analysing WannaCry samples/ —
2019-07-29 - An analysis of a spam distribution botnet- the inner workings of Onliner Spambot/ —
2019-07-29 - Android ransomware is back/ —
2019-07-30 - Picking Locky/ —
2019-07-30 - Practical Threat Hunting and Incidence Response - A Case of A Pony Malware Infection/ —
2019-07-31 - SystemBC is like Christmas in July for SOCKS5 Malware and Exploit Kits/ —
2019-07-31 - TFW Ransomware is only your side hustle/ —
2019-08-01 - Analysis of the Attack of Mobile Devices by OceanLotus/ —
2019-08-01 - APT trends report Q2 2019/ —
2019-08-01 - Cerberus - A New Banking Trojan from the Underworld/ —
2019-08-01 - Clop Ransomware/ —
2019-08-01 - Decrypting L0rdix RAT’s C2/ —
2019-08-01 - LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards/ —
2019-08-02 - SectorE02 Updates YTY Framework in New Targeted Campaign Against Pakistan Government/ —
2019-08-05 - Catching lateral movement in internal emails/ —
2019-08-05 - Corporate IoT – a path to intrusion (APT28-STRONTIUM)/ —
2019-08-05 - Latest Trickbot Campaign Delivered via Highly Obfuscated JS File/ —
2019-08-05 - Machete - Venezuelan military under attack/ —
2019-08-05 - MegaCortex Ransomware Revamps for Mass Distribution/ —
2019-08-05 - Sharpening the Machete/ —
2019-08-06 - Clipsa – Multipurpose password stealer/ —
2019-08-06 - New Echobot Botnet Variant Uses Over 50 Exploits to Propagate/ —
2019-08-07 - APT41 - A Dual Espionage and Cyber Crime Operation/ —
2019-08-07 - APT41- A Dual Espionage and Cyber Crime Operation/ —
2019-08-07 - MoqHao Related Android Spyware Targeting Japan and Korea Found on Google Play/ —
2019-08-07 - New Ursnif Variant Spreading by Word Document/ —
2019-08-08 - Saefko- A new multi-layered RAT/ —
2019-08-08 - Suspected BITTER APT Continues Targeting Government of China and Chinese Organizations/ —
2019-08-08 - Varenyky- Spambot à la Française/ —
2019-08-10 - GermanWiper's big Brother- GandGrab's kid - Sodinokibi!/ —
2019-08-10 - SELECT code_execution FROM USING SQLite;/ —
2019-08-12 - An Overview of Public Platform C2’s/ —
2019-08-12 - Malware Naming Hell Part 1- Taming the mess of AV detection names/ —
2019-08-12 - PsiXBot Continues to Evolve with Updated DNS Infrastructure/ —
2019-08-12 - Recent Cloud Atlas activity/ —
2019-08-12 - Trojaner Emotet greift Unternehmensnetzwerke an/ —
2019-08-13 - The state of advanced code injections/ —
2019-08-14 - In the Balkans, businesses are under fire from a double‑barreled weapon/ —
2019-08-15 - Analysis- New Remcos RAT Arrives Via Phishing Email/ —
2019-08-15 - Gootkit Banking Trojan - Deep Dive into Anti-Analysis Features/ —
2019-08-15 - MICROPSIA (APT-C-23)/ —
2019-08-15 - The Hidden Bee infection chain, part 1- the stegano pack/ —
2019-08-16 - Warning As Devious New Android Malware Hides In Fake Adobe Flash Player Installations (Updated)/ —
2019-08-19 - Banking trojan Bolik spreads disguised as the NordVPN app/ —
2019-08-19 - GAME OVER- Detecting and Stopping an APT41 Operation/ —
2019-08-19 - Konni APT organization emerges as an attack disguised as Russian document/ —
2019-08-20 - Chinese APT/ —
2019-08-20 - Lazarus Continues 'Movie Coin' Campaign Disguised as Calling Document Request/ —
2019-08-20 - Merlin (BETA)/ —
2019-08-20 - Source code- TinyMet/ —
2019-08-21 - Finding Neutrino/ —
2019-08-21 - Kelihos botnet/ —
2019-08-21 - Silence 2.0 - Going Global/ —
2019-08-21 - The Gamaredon Group - A TTP Profile Analysis/ —
2019-08-22 - APT34- The Helix Kitten Cybercriminal Group Loves to Meow Middle Eastern and International Organizations/ —
2019-08-22 - Asruex Backdoor Variant Infects Word Documents and PDFs Through Old MS Office and Adobe Vulnerabilities/ —
2019-08-22 - First‑of‑its‑kind spyware sneaks into Google Play/ —
2019-08-22 - Operation TaskMasters/ —
2019-08-22 - Pupy RAT/ —
2019-08-23 - Ransomware Attacks Are Testing Resolve of Cities Across America/ —
2019-08-24 - Notes on Nemty Ransomware/ —
2019-08-24 - Windows worms. Forbix worm analysis/ —
2019-08-25 - Nanocor Sample/ —
2019-08-26 - APT-C-09 Reappeared as Conflict Intensified Between India and Pakistan/ —
2019-08-26 - APT-C-09/ —
2019-08-26 - Memory Analysis of TrickBot/ —
2019-08-26 - New Nemty Ransomware May Spread via Compromised RDP Connections/ —
2019-08-26 - The DAA File Format/ —
2019-08-27 - APT Patchwork/ —
2019-08-27 - China Chopper still active 9 years later/ —
2019-08-27 - LYCEUM Takes Center Stage in Middle East Campaign/ —
2019-08-27 - TA505 At It Again - Variety is the Spice of ServHelper and FlawedAmmyy/ —
2019-08-27 - TA505 At It Again- Variety is the Spice of ServHelper and FlawedAmmyy/ —
2019-08-27 - TrickBot Modifications Target U.S. Mobile Users/ —
2019-08-28 - Inside the APT28 DLL Backdoor Blitz/ —
2019-08-28 - Other day other malware in the way (died.exe)/ —
2019-08-28 - Putting an end to Retadup- A malicious worm that infected hundreds of thousands/ —
2019-08-28 - RAT Ratatouille- Backdooring PCs with leaked RATs/ —
2019-08-29 - Fully equipped Spying Android RAT from Brazil- BRATA/ —
2019-08-29 - Gootkit Banking Trojan - Part 2- Persistence & Other Capabilities/ —
2019-08-29 - Heatstroke Campaign Uses Multistage Phishing Attack to Steal PayPal and Credit Card Information/ —
2019-08-29 - Implant Teardown/ —
2019-08-29 - More_eggs, Anyone- Threat Actor ITG08 Strikes Again/ —
2019-08-29 - SectorJ04 Group’s Increased Activity in 2019/ —
2019-08-29 - Threat Actor ITG08 Strikes Again/ —
2019-08-29 - Tick Tock - Tick Cyber Espionage Group/ —
2019-08-30 - A Look Inside the Highly Profitable Sodinokibi Ransomware Business/ —
2019-08-30 - DarkComet v5.3.1/ —
2019-08-30 - Github Repository of Octopus/ —
2019-08-30 - njRAT builders/ —
2019-08-30 - RAT.Android.OmniRAT/ —
2019-08-31 - Malware analysis on Bitter APT campaign/ —
2019-09-02 - Digital Crackdown- Large-Scale Surveillance and Exploitation of Uyghurs/ —
2019-09-02 - Revealed- How a secret Dutch mole aided the U.S.-Israeli Stuxnet cyberattack on Iran/ —
2019-09-03 - Deobfuscating Ostap- TrickBot’s 34,000 Line JavaScript Downloader/ —
2019-09-03 - Nemty Ransomware Gets Distribution from RIG Exploit Kit/ —
2019-09-04 - FunkyBot- A New Android Malware Family Targeting Japan/ —
2019-09-04 - Glupteba Campaign Hits Network Routers and Updates C&C Servers with Data from Bitcoin Transactions/ —
2019-09-04 - HILDACRYPT ransomware actively spreading in the wild/ —
2019-09-05 - l0rdix C2 traffic decryptor/ —
2019-09-05 - Netwalker Ransomware/ —
2019-09-05 - Seems Phishy- Back to School Lures Target University Students and Staff/ —
2019-09-05 - UPSynergy - Chinese-American Spy vs. Spy Story/ —
2019-09-06 - BITTER APT- Not So Sweet/ —
2019-09-06 - Lilocked Ransomware Actively Targeting Servers and Web Sites/ —
2019-09-06 - PsiXBot Now Using Google DNS over HTTPS and Possible New Sexploitation Module/ —
2019-09-07 - Malicious RATatouille/ —
2019-09-07 - Thousands Of Linux Servers Infected By Lilu (Lilocked) Ransomware/ —
2019-09-08 - Fake PayPal Site Spreads Nemty Ransomware/ —
2019-09-09 - Evolution of Malware Sandbox Evasion Tactics – A Retrospective Study/ —
2019-09-09 - Malware Analysis Report (AR19-252A)/ —
2019-09-09 - Thrip - Ambitious Attacks Against High Level Targets Continue/ —
2019-09-09 - ‘Purple Fox’ Fileless Malware with Rookit Component Delivered by Rig Exploit Kit Now Abuses PowerShell/ —
2019-09-10 - Gamaredon Analysis/ —
2019-09-10 - Mirai Botnet Continues to Plague IoT Space/ —
2019-09-11 - COBALT DICKENS Goes Back to School…Again/ —
2019-09-11 - RANCOR APT - Suspected targeted attacks against South East Asia/ —
2019-09-11 - Ryuk Related Malware Steals Confidential Military, Financial Files/ —
2019-09-11 - Vulnerable Private Networks- Corporate VPNs Exploited in the Wild/ —
2019-09-11 - Watchbog and the Importance of Patching/ —
2019-09-12 - InnfiRAT- A new RAT aiming for your cryptocurrency and more/ —
2019-09-12 - Ostap Deobfuscation script/ —
2019-09-12 - The tangle of WiryJMPer’s obfuscation/ —
2019-09-13 - Machete/ —
2019-09-14 - WSH RAT (A variant of H-Worm-Houdini)/ —
2019-09-15 - Charming Kitten Campaign Against Academic/ —
2019-09-16 - Emotet is back- botnet springs back to life with new spam campaign/ —
2019-09-17 - Cryptocurrency miners aren’t dead yet- Documenting the voracious but simple “Panda”/ —
2019-09-17 - Nemty Ransomware 1.0- A Threat in its Early Stage/ —
2019-09-17 - TFlower Ransomware - The Latest Attack Targeting Businesses/ —
2019-09-18 - Chirp of the PoisonFrog/ —
2019-09-18 - Magecart Skimming Attack/ —
2019-09-18 - Malware Used by BlackTech after Network Intrusion/ —
2019-09-18 - The WannaCry hangover/ —
2019-09-18 - Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks/ —
2019-09-18 - Tortoiseshell Group/ —
2019-09-19 - Emissary Panda APT- Recent infrastructure and RAT analysis/ —
2019-09-19 - Fileless Cryptocurrency-Miner GhostMiner Weaponizes WMI Objects, Kills Other Cryptocurrency-Mining Payloads/ —
2019-09-19 - Hagga of SectorH01 continues abusing Bitly, Blogger and Pastebin to deliver RevengeRAT and NanoCore/ —
2019-09-19 - Lilith/ —
2019-09-20 - Mac Malware that Spoofs Trading App Steals User Information, Uploads it to Website/ —
2019-09-20 - Multiple signatures 032/ —
2019-09-20 - Russian Cybercrime Group FullofDeep Behind QNAPCrypt Ransomware Campaigns/ —
2019-09-20 - TFlower Ransomware Campaign/ —
2019-09-22 - LookBack Forges Ahead- Continued Targeting of the United States’ Utilities Sector Reveals Additional Adversary TTPs/ —
2019-09-22 - Rancor- The Year of The Phish/ —
2019-09-23 - Diving into Pluroxs DNS based protection layer/ —
2019-09-23 - Hello! My name is Dtrack/ —
2019-09-23 - xHunt Campaign- Attacks on Kuwait Shipping and Transportation Organizations/ —
2019-09-24 - APT or not APT- What's Behind the Aggah Campaign/ —
2019-09-24 - DeadlyKiss/ —
2019-09-24 - How Tortoiseshell created a fake veteran hiring website to host malware/ —
2019-09-24 - Iranian Government Hackers Target US Veterans/ —
2019-09-24 - Missing Link Tibetan Groups Targeted with 1-Click Mobile Exploits/ —
2019-09-24 - No summer vacations for Zebrocy/ —
2019-09-24 - Quick Heal reports 29 malicious apps with 10 million+ downloads on Google Play Store/ —
2019-09-24 - Return of the Mummy - Welcome back, Emotet/ —
2019-09-24 - REvil- The GandCrab Connection/ —
2019-09-24 - REvil-Sodinokibi Ransomware/ —
2019-09-24 - Russia APT Ecosystem/ —
2019-09-25 - Ransomware- two pieces of good news/ —
2019-09-26 - Bring your own LOLBin- Multi-stage, fileless Nodersok campaign delivers rare Node.js-based malware/ —
2019-09-26 - Chinese APT Hackers Attack Windows Users Via Fakenarrator Malware/ —
2019-09-26 - Divergent- -Fileless- NodeJS Malware Burrows Deep Within the Host/ —
2019-09-26 - Masad Stealer- Exfiltrating using Telegram/ —
2019-09-26 - New WhiteShadow downloader uses Microsoft SQL to retrieve malware/ —
2019-09-28 - MMD-0064-2019 - Linux-AirDropBot/ —
2019-09-30 - HELO Winnti- Attack or Scan-/ —
2019-09-30 - HELO Winnti/ —
2019-10 - Geost botnet. The story of the discovery of a new Android banking trojan from an OpSec error/ —
2019-10-01 - Kovcoreg Malvertising Campaign/ —
2019-10-01 - Lemon_Duck PowerShell malware cryptojacks enterprise networks/ —
2019-10-01 - Mariposa Botnet Author, Darkcode Crime Forum Admin Arrested in Germany/ —
2019-10-01 - New Adwind Campaign Targets Us Petroleum Industry/ —
2019-10-01 - New Fileless Botnet Novter Distributed by KovCoreG Malvertising Campaign/ —
2019-10-02 - Another Lazarus Injector/ —
2019-10-02 - Domestic Kitten- an Iranian surveillance program/ —
2019-10-02 - Malware Tales- FTCODE/ —
2019-10-02 - McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us/ —
2019-10-02 - Nicht so goot - Breaking down Gootkit and Jasper (+ FTCODE)/ —
2019-10-02 - Nicht so goot - Breaking down Gootkit and Jasper (and FTCODE)/ —
2019-10-02 - Servers botnet offline/ —
2019-10-03 - AVIVORE – Hunting Global Aerospace through the Supply Chain/ —
2019-10-03 - COMpfun successor Reductor infects files on the fly to compromise TLS traffic/ —
2019-10-03 - Context Identifies new AVIVORE threat group/ —
2019-10-03 - New threat group behind Airbus cyber attacks, claim researchers/ —
2019-10-03 - PKPLUG - Chinese Cyber Espionage Group Attacking Asia/ —
2019-10-03 - PKPLUG- Chinese Cyber Espionage Group Attacking Asia/ —
2019-10-03 - Researchers Say They Uncovered Uzbekistan Hacking Operations Due to Spectacularly Bad OPSEC/ —
2019-10-04 - Geost Botnet/ —
2019-10-04 - ScareCrow Ransomware/ —
2019-10-05 - HildaCrypt Ransomware Developer Releases Decryption Keys/ —
2019-10-06 - Go under the hood- Eris Ransomware/ —
2019-10-07 - Charming Kitten Campaign/ —
2019-10-07 - China-Based APT Mustang Panda Targets Minority Groups, Public and Private Sector Organizations/ —
2019-10-07 - Dissecting Ardamax Keylogger/ —
2019-10-07 - Supply Chain Attacks/ —
2019-10-08 - Một sample nhắm vào Bank ở VN/ —
2019-10-09 - FIN 6 Compromised E-commerce Platform via Magecart to Inject Credit Card Skimmers Into Thousands of Online Shops/ —
2019-10-09 - FIN6 Compromised E-commerce Platform via Magecart to Inject Credit Card Skimmers Into Thousands of Online Shops/ —
2019-10-10 - Analysis of the new TA505 campaign/ —
2019-10-10 - ESET discovers Attor, a spy platform with curious GSM fingerprinting/ —
2019-10-10 - Mahalo FIN7 - Responding to the Criminal Operators’ New Tools and Techniques/ —
2019-10-10 - Mahalo FIN7- Responding to the Criminal Operators’ New Tools and Techniques/ —
2019-10-10 - Nemty Ransomware Decryptor Released, Recover Files for Free/ —
2019-10-10 - Nemty update- decryptors for Nemty 1.5 and 1.6/ —
2019-10-10 - New espionage malware found targeting Russian-speaking users in Eastern Europe/ —
2019-10-10 - Sophisticated Spy Kit Targets Russians with Rare GSM Plugin/ —
2019-10-10 - Winnti - Connecting the Dots/ —
2019-10-10 - xHunt Campaign- New PowerShell Backdoor Blocked Through DNS Tunnel Detection/ —
2019-10-11 - Mespinoza Ransomware/ —
2019-10-11 - За российскими дипломатами 7 лет следят с помощью шпионского ПО/ —
2019-10-12 - Pass the AppleJeus/ —
2019-10-14 - Corona DDoS bot/ —
2019-10-14 - Is Emotet gang targeting companies with external SOC-/ —
2019-10-14 - Is Emotet gang targeting companies with external SOC/ —
2019-10-14 - Threat Actor Profile- TA407, the Silent Librarian/ —
2019-10-14 - Turbine Panda/ —
2019-10-14 - Winnti - From tweet to rootkit/ —
2019-10-15 - Blackremote- Money Money Money – A Swedish Actor Peddles an Expensive New RAT/ —
2019-10-15 - LOWKEY - Hunting for the Missing Volume Serial ID/ —
2019-10-15 - MedusaLocker Ransomware/ —
2019-10-16 - APT trends report Q3 2019/ —
2019-10-16 - APT15/ —
2019-10-16 - LNKR- More than Just a Browser Extension/ —
2019-10-16 - TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader/ —
2019-10-16 - TA505 Timeline/ —
2019-10-17 - Let's Learn- Dissecting Lazarus Windows x86 Loader Involved in Crypto Trading App Distribution- -snowman- & ADVObfuscator/ —
2019-10-17 - Operation Ghost- The Dukes aren’t back – they never left/ —
2019-10-17 - Operation Ghost/ —
2019-10-17 - The Untold Story of the 2018 Olympics Cyberattack, the Most Deceptive Hack in History/ —
2019-10-18 - Maze Ransomware Now Delivered by Spelevo Exploit Kit/ —
2019-10-18 - TrickBot variant “Anchor_DNS” communicating over DNS/ —
2019-10-19 - ABCD Ransomware LockBit Ransomware/ —
2019-10-19 - HILDACRYPT- A Ransomware Newcomer Hits Backup and Anti-virus Solutions/ —
2019-10-19 - 商用RATのエコシステム- Unit 42、高機能商用RAT Blackremote RATの作者を公開後数日で特定/ —
2019-10-20 - InfoDot Ransomware/ —
2019-10-20 - McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Crescendo/ —
2019-10-21 - Advisory- Turla group exploits Iranian APT to expand coverage of victims/ —
2019-10-21 - Geost Botnet/ —
2019-10-21 - Gustuff return, new features for victims/ —
2019-10-21 - New Variant of Remcos RAT Observed In the Wild/ —
2019-10-21 - Shikata Ga Nai Encoder Still Going Strong/ —
2019-10-21 - Turla group exploits Iranian APT to expand coverage of victims/ —
2019-10-21 - Winnti Group’s Skip‑2.0 - A Microsoft Sql Server Backdoor/ —
2019-10-21 - Winnti Group’s skip‑2.0- A Microsoft SQL Server backdoor/ —
2019-10-22 - New PatchWork Spearphishing Attack/ —
2019-10-23 - Mobile Malware and APT Espionage- Prolific, Pervasive, and Cross-Platform/ —
2019-10-23 - PwndLocker Ransomware/ —
2019-10-23 - Spoofing in the reeds with Rietspoof/ —
2019-10-24 - 10-24-2019 - APT28- Targeted attacks against mining corporations in Kazakhstan/ —
2019-10-24 - APT-41 Overview/ —
2019-10-24 - FTdecryptor- a simple password-based FTCODE decryptor/ —
2019-10-24 - How TrickBot Malware Hooking Engine Targets Windows 10 Browsers/ —
2019-10-24 - Hunting Raccoon- The new Masked Bandit on the Block/ —
2019-10-24 - Popular Backup Solutions Easily Disabled by Recent HILDACRYPT Ransomware/ —
2019-10-24 - Tracking down the developer of Android adware affecting millions of users/ —
2019-10-25 - HDMR, GO-SPORT/ —
2019-10-25 - New FuxSocy Ransomware Impersonates the Notorious Cerber/ —
2019-10-25 - The Deep Dive Malware Analysis Approach/ —
2019-10-26 - Earn-quick-BTC-with-Hiddentear.mp4 - About Open Source Ransomware/ —
2019-10-28 - SWEED Targeting Precision Engineering Companies in Italy/ —
2019-10-29 - Osiris, the god of afterlife...and banking malware-!/ —
2019-10-29 - ShadeDecryptor tool/ —
2019-10-29 - Threat Spotlight- Neshta File Infector Endures/ —
2019-10-29 - TRICKBOT - Analysis Part II/ —
2019-10-30 - Emotet is back in action after a short break/ —
2019-10-31 - Calypso APT- new group attacking state institutions/ —
2019-10-31 - Calypso APT/ —
2019-10-31 - Dynamic Imports and Working Around Indirect Calls - Smokeloader Study Case/ —
2019-10-31 - Malware Analysis Report (AR19-304A)/ —
2019-10-31 - Messagetap - Who’s Reading Your Text Messages/ —
2019-10-31 - MESSAGETAP- Who’s Reading Your Text Messages-/ —
2019-11-01 - Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium/ —
2019-11-01 - Ginp - A Malware Patchwork Borrowing From Anubis/ —
2019-11-01 - Operation Wizard Opium CVE-2019-13720/ —
2019-11-01 - WIZARD SPIDER Adds New Features to Ryuk for Targeting Hosts on LAN/ —
2019-11-03 - DTrack/ —
2019-11-04 - APT38 Lazarus/ —
2019-11-04 - Hakbit Ransomware/ —
2019-11-04 - Higaisa Apt/ —
2019-11-04 - Is Lazarus-APT38 Targeting Critical Infrastructures-/ —
2019-11-04 - Nemty Ransomware Expands Its Reach, Also Delivered by Trik Botnet/ —
2019-11-05 - Brief analysis of Redaman Banking Malware (v0.6.0.2) Sample/ —
2019-11-05 - Buran Ransomware; the Evolution of VegaLocker/ —
2019-11-05 - DADJOKE/ —
2019-11-05 - DarkUniverse – the mysterious APT framework #27/ —
2019-11-05 - DarkUniverse – the mysterious APT framework 27/ —
2019-11-05 - DarkUniverse – the mysterious APT framework/ —
2019-11-05 - Hospital cyberattack could have been avoided/ —
2019-11-05 - Lazarus Gaze APT38/ —
2019-11-05 - New Megacortex Ransomware Changes Windows Passwords, Threatens to Publish Data/ —
2019-11-05 - The Lazarus’ gaze to the world- What is behind the first stone-/ —
2019-11-05 - Try not to stare - MedusaLocker at a glance/ —
2019-11-06 - A vine climbing over the Great Firewall- a long‑term attack against China/ —
2019-11-06 - Emotet, Trickbot, Ryuk – ein explosiver Malware-Cocktail/ —
2019-11-06 - Outil de déchiffrement du rançongiciel (ransomware) PyLocky versions 1 et 2/ —
2019-11-06 - Spanish consultancy Everis suffers BitPaymer ransomware attack- a brief analysis/ —
2019-11-07 - Swen (computer worm)/ —
2019-11-08 - Titanium - the Platinum group strikes again/ —
2019-11-08 - Wikipedia Entry on Equation Group/ —
2019-11-08 - Wireshark Tutorial- Examining Trickbot Infections/ —
2019-11-09 - API-Hashing in the Sodinokibi-Revil Ransomware - Why and How-/ —
2019-11-09 - APT34 Event Analysis Report/ —
2019-11-11 - APT cases exploiting vulnerabilities in region‑specific software/ —
2019-11-11 - If it sounds too good to be true, it most likely is- Nobody can decrypt the Dharma ransomware/ —
2019-11-11 - Revenge Is A Dish Best Served… Obfuscated-/ —
2019-11-12 - Meeting a Russian Ransomware Cell/ —
2019-11-12 - PureLocker- New Ransomware-as-a-Service Being Used in Targeted Attacks Against Servers/ —
2019-11-12 - Reversing Qakbot/ —
2019-11-12 - TA-505 - Cybercrime on System Integrator Companies/ —
2019-11-12 - The DGA of QSnatch/ —
2019-11-12 - Weeding out WannaMine v4.0- Analyzing and Remediating This Mineware Nightmare/ —
2019-11-13 - AnteFrigus Ransomware/ —
2019-11-13 - More than a Dozen Obfuscated APT33 Botnets Used for Extreme Narrow Targeting/ —
2019-11-14 - MITRE ATT&CKcon 2.0- How a Threat Hunting Team Has Upgraded Its Use of ATT&CK/ —
2019-11-14 - TA2101 plays government imposter to distribute malware to German, Italian, and US organizations/ —
2019-11-15 - New NextCry Ransomware Encrypts Data on NextCloud Linux Servers/ —
2019-11-16 - ddoor/ —
2019-11-16 - Fresh PlugX October 2019/ —
2019-11-18 - Brushaloader gaining new layers like a pro/ —
2019-11-18 - Linux, Windows Users Targeted With New ACBackdoor Malware/ —
2019-11-18 - New Ransomware Available for Targeted Attacks/ —
2019-11-18 - Pipka Card Skimmer Removes Itself After Infecting eCommerce Sites/ —
2019-11-18 - REWTERZ THREAT ALERT – IRANIAN APT USES JOB SCAMS TO LURE TARGETS/ —
2019-11-18 - Surprised by Julius the Great! Disclosure of Cyrus attacks against Iran/ —
2019-11-19 - Mispadu- Advertisement for a discounted Unhappy Meal/ —
2019-11-19 - Phorpiex Breakdown/ —
2019-11-19 - Quick and painless - Reversing DeathRansom - -Wacatac-/ —
2019-11-19 - Wacatac Ransomware/ —
2019-11-20 - Active C2 Discovery Using Protocol Emulation Part1 (HYDSEVEN NetWire)/ —
2019-11-20 - APT-C-34/ —
2019-11-20 - Mac Backdoor Linked to Lazarus Targets Korean Users/ —
2019-11-20 - MuddyWater Uses New Attack Methods in a Recent Attack Wave/ —
2019-11-20 - New Roboto botnet emerges targeting Linux servers running Webmin/ —
2019-11-20 - Phoenix- The Tale of the Resurrected Keylogger/ —
2019-11-20 - The awaiting Roboto Botnet/ —
2019-11-21 - Allied Universal Breached by Maze Ransomware, Stolen Data Leaked/ —
2019-11-21 - GandCrab Finds DEATHRansom of the Same Appearance Following Nemty in Korea/ —
2019-11-21 - Going Deep - A Guide to Reversing Smoke Loader Malware/ —
2019-11-21 - IconDown – Downloader Used by BlackTech/ —
2019-11-21 - New SectopRAT- Remote access malware utilizes second desktop to control browsers/ —
2019-11-21 - Registers as -Default Print Monitor-, but is a malicious downloader. Meet DePriMon/ —
2019-11-21 - Registers as “Default Print Monitor”, but is a malicious downloader. Meet DePriMon/ —
2019-11-21 - STOP Ransomware- Finger weg von illegalen Software-Downloads/ —
2019-11-22 - Trickbot Updates Password Grabber Module/ —
2019-11-22 - TurkStatik Ransomware/ —
2019-11-23 - Extensive hacking operation discovered in Kazakhstan/ —
2019-11-24 - TA505 Get2 Analysis/ —
2019-11-25 - Studying Donot Team/ —
2019-11-26 - Dexphot - Insights from one year of tracking a polymorphic threat/ —
2019-11-26 - Insights from one year of tracking a polymorphic threat/ —
2019-11-26 - Stantinko botnet adds cryptomining to its pool of criminal activities/ —
2019-11-27 - Threat Spotlight- Machete Info-Stealer/ —
2019-11-27 - Кейлоггер с сюрпризом- анализ клавиатурного шпиона и деанон его разработчика/ —
2019-11-28 - RevengeHotels - cybercrime targeting hotel front desks worldwide/ —
2019-11-28 - RevengeHotels- cybercrime targeting hotel front desks worldwide/ —
2019-11-29 - Libertad y gloria - A Mexican cyber heist story - CyberCrimeCon19 Singapore/ —
2019-11-29 - Operation ENDTRADE- Finding Multi-Stage Backdoors that TICK/ —
2019-11-29 - Operation Endtrade/ —
2019-11-29 - The Fractured Block Campaign- CARROTBAT Used to Deliver Malware Targeting Southeast Asia/ —
2019-12-02 - Facebook Ads Manager Targeted by New Info-Stealing Trojan/ —
2019-12-02 - God save the Queen [...] 'cause Ransom is money - SaveTheQueen Encryptor/ —
2019-12-02 - Imminent Monitor - a RAT Down Under/ —
2019-12-02 - Meet PyXie- A Nefarious New Python RAT/ —
2019-12-03 - In depth analysis of an infostealer- Raccoon/ —
2019-12-03 - Lazarus Group Goes 'Fileless'/ —
2019-12-03 - New version of IcedID Trojan uses steganographic payloads/ —
2019-12-03 - Threat Actor Targeting Hong Kong Pro-Democracy Figures/ —
2019-12-04 - APT review- what the world’s threat actors got up to in 2019/ —
2019-12-04 - Buer, a new loader emerges in the underground marketplace/ —
2019-12-04 - How to Respond to Emotet Infection (FAQ)/ —
2019-12-04 - Kurdish Coder Campaign/ —
2019-12-04 - New Destructive Wiper “ZeroCleare” Targets Energy Sector in the Middle East/ —
2019-12-04 - Ransomware, interrupted- Sodinokibi and the supply chain/ —
2019-12-04 - xHunt Campaign- xHunt Actor’s Cheat Sheet/ —
2019-12-05 - APT28 Attacks Evolution/ —
2019-12-05 - Buer Loader, new Russian loader on the market with interesting persistence/ —
2019-12-05 - Cobalt Strike 4.0 – Bring Your Own Weaponization/ —
2019-12-05 - PoshC2 (specifically as used by APT33)/ —
2019-12-05 - RedRum Ransomware/ —
2019-12-05 - Treasury Sanctions Evil Corp, the Russia-Based Cybercriminal Group Behind Dridex Malware/ —
2019-12-06 - Cosmic Banker Campaign still active revealing link with Banload malware/ —
2019-12-07 - NetWorm/ —
2019-12-09 - Caution! Ryuk Ransomware decryptor damages larger files, even if you pay/ —
2019-12-09 - Snatch ransomware reboots PCs into Safe Mode to bypass protection/ —
2019-12-09 - Snatch Ransomware Reboots to Windows Safe Mode to Bypass AV Tools/ —
2019-12-09 - TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks/ —
2019-12-10 - [Updated] Alert Regarding Emotet Malware Infection/ —
2019-12-10 - Anchor Project - The Deadly Planeswalker- How The TrickBot Group United High-Tech Crimeware & APT/ —
2019-12-10 - MORPHISEC DISCOVERS CCLEANER BACKDOOR SAVING MILLIONS OF AVAST USERS/ —
2019-12-10 - Trickbot Planeswalker/ —
2019-12-10 - Windows 0-day exploit CVE-2019-1458 used in Operation WizardOpium/ —
2019-12-11 - A -Project.exe- that should have stayed in a drawer - MZRevenge - MaMo434376/ —
2019-12-11 - Dropping Anchor - From a TrickBot Infection to the Discovery of the Anchor Malware/ —
2019-12-11 - Dropping Anchor- From a TrickBot Infection to the Discovery of the Anchor Malware/ —
2019-12-11 - Maze Ransomware Behind Pensacola Cyberattack, $1M Ransom Demand/ —
2019-12-11 - Story of the year 2019- Cities under ransomware siege/ —
2019-12-11 - Waterbear is Back, Uses API Hooking to Evade Security Product Detection/ —
2019-12-11 - Waterbear Returns, Uses API Hooking to Evade Security/ —
2019-12-11 - Zeppelin- Russian Ransomware Targets High Profile Users in the U.S. and Europe/ —
2019-12-12 - Another Ransomware Will Now Publish Victims' Data If Not Paid/ —
2019-12-12 - Cyber espionage in the Middle East- unravelling OSX.WindTail/ —
2019-12-12 - Cyber Threat Landscape in Japan – Revealing Threat in the Shadow/ —
2019-12-12 - Cybercrime Groups (FIN8) Targeting Fuel Dispenser Merchants/ —
2019-12-12 - Drilling Deep A Look at Cyberattacks on the Oil and Gas Industry/ —
2019-12-12 - GALLIUM Targeting Global Telecom/ —
2019-12-12 - GALLIUM- Targeting global telecom/ —
2019-12-12 - More than a Dozen Obfuscated APT33 Botnets Used for Extreme Narrow Targeting/ —
2019-12-12 - Mr.Peter/ —
2019-12-12 - Operation Gamework/ —
2019-12-13 - Elegant sLoad Carries Out Spying, Payload Delivery in BITS/ —
2019-12-13 - LALALA InfoStealer which comes with Batch and PowerShell scripting combo/ —
2019-12-13 - Mirai Variant ECHOBOT Resurfaces with 13 Previously Unexploited Vulnerabilities/ —
2019-12-14 - Another one for the collection - Mespinoza (Pysa) Ransomware/ —
2019-12-15 - Ryuk Ransomware Likely Behind New Orleans Cyberattack/ —
2019-12-16 - Momentum Botnet's Newest DDoS Attacks and IoT Exploits/ —
2019-12-16 - My Kings - The Slow But Steady Growth of a Relentless Botnet/ —
2019-12-16 - Ransomware Gangs Now Outing Victim Businesses That Don’t Pay Up/ —
2019-12-17 - Incident Response lessons from recent Maze ransomware attacks/ —
2019-12-17 - Lazarus Group -Dacls Rat/ —
2019-12-17 - Lazarus Group uses Dacls RAT to attack Linux platform/ —
2019-12-17 - Nuclear Bot Author Arrested in Sextortion Case/ —
2019-12-17 - Rancor - Cyber Espionage Group Uses New Custom Malware to Attack Southeast Asia/ —
2019-12-17 - Rancor- Cyber Espionage Group Uses New Custom Malware to Attack Southeast Asia/ —
2019-12-17 - TA505 evolves ServHelper, uses Predator The Thief and Team Viewer Hijacking/ —
2019-12-18 - Echobot Malware Now up to 71 Exploits, Targeting SCADA/ —
2019-12-18 - IcedID PNG Extractor/ —
2019-12-18 - Maze ransomware/ —
2019-12-18 - Understanding Ransomware Series- Detecting Sodin/ —
2019-12-19 - [RE009] Analysis of malicious code -PLAN, KEY TASKS IN 2020.doc- attached to phishing email/ —
2019-12-19 - [RE009] Phân tích mã độc “KẾ HOẠCH, NHIỆM VỤ TRỌNG TÂM NĂM 2020.doc” đính kèm email phishing/ —
2019-12-19 - ChernoLocker Ransomware/ —
2019-12-19 - Inside ‘Evil Corp,’ a $100M Cybercrime Menace/ —
2019-12-19 - Operation Wacao - Shining a light on one of China’s/ —
2019-12-19 - Threat spotlight- the curious case of Ryuk ransomware/ —
2019-12-20 - An Updated ServHelper Tunnel Variant/ —
2019-12-20 - Undressing the REvil/ —
2019-12-20 - Unveiling JsOutProx- A New Enterprise Grade Implant/ —
2019-12-21 - How ransomware exploded in the age of Bitcoin/ —
2019-12-21 - Shamoon 2012 Complete Analysis/ —
2019-12-23 - DarkRat - Hacking a malware control panel/ —
2019-12-23 - FBI Issues Alert For LockerGoga and MegaCortex Ransomware/ —
2019-12-23 - I literally can't think of a fitting pun - MrDec Ransomware/ —
2019-12-23 - Mozi, Another Botnet Using DHT/ —
2019-12-23 - POS Malware Used at Fuel Pumps/ —
2019-12-23 - Wireshark Tutorial- Examining Ursnif Infections/ —
2019-12-24 - Gozi V3- tracked by their own stealth/ —
2019-12-24 - Maze Ransomware Releases Files Stolen from City of Pensacola/ —
2019-12-24 - Unpacking Payload used in Bottle EK/ —
2019-12-24 - Warning over LockerGoga and MegaCortex ransomware attacks targeting private industry in western countries/ —
2019-12-25 - BlackNet RAT - When you leave the Panel unprotected/ —
2019-12-25 - Let’s play (again) with Predator the thief/ —
2019-12-26 - FinSpy-Dokumentation/ —
2019-12-26 - Introducing BIOLOAD- FIN7 BOOSTWRITE’s Lost Twin/ —
2019-12-26 - Ryuk Ransomware Stops Encrypting Linux Folders/ —
2019-12-26 - Targeting Portugal- A new trojan ‘Lampion’ has spread using template emails from the Portuguese Government Finance & Tax/ —
2019-12-26 - Trojan Lampion - A new trojan ‘Lampion’ has spread using template emails from the Portuguese Government Finance & Tax/ —
2019-12-28 - The Tale of the Pija-Droid Firefinch/ —
2019-12-29 - BRONZE PRESIDENT Targets NGOs/ —
2019-12-29 - Unnamed 1/ —
2019-12-31 - Cuba Ransomware/ —
2019-12-31 - Fuel Pumps II – PoSlurp.B/ —