/vx/Malware Analysis/2021/

2634 directories 0 files
Name Size Modified
Go up — —
2021-01-01 - The Mac Malware of 2020 - a comprehensive analysis of the year's new malware/ —
2021-01-02 - As Understanding of Russian Hacking Grows, So Does Alarm/ —
2021-01-02 - How Russia’s ‘Info Warrior’ Hackers Let Kremlin Play Geopolitics on the Cheap/ —
2021-01-03 - Babuk Ransomware/ —
2021-01-04 - APT 27 Turns to Ransomware/ —
2021-01-04 - Building a Custom Malware Analysis Lab Environment/ —
2021-01-04 - China's APT hackers move to ransomware attacks/ —
2021-01-04 - Darknet Threat Actors Are Not Playing Games with the Gaming Industry/ —
2021-01-04 - Detecting Supernova Malware- SolarWinds Continued/ —
2021-01-04 - Dridex - Catching the Next Strike/ —
2021-01-04 - DRIDEX Stopping Serial Killer- Catching the Next Strike/ —
2021-01-04 - Finding Targeted SUNBURST Victims with pDNS/ —
2021-01-04 - Royal Road Re-Dive/ —
2021-01-04 - Royal Road! Re-Dive/ —
2021-01-04 - TransLink confirms ransomware data theft, still restoring systems/ —
2021-01-05 - [Threat Analysis] CLOP Ransomware that Attacked Korean Distribution Giant/ —
2021-01-05 - An Overview of the DoppelPaymer Ransomware/ —
2021-01-05 - Attack from Mustang Panda- My rabbit is back!/ —
2021-01-05 - Discharging ElectroRAT/ —
2021-01-05 - Earth Wendigo Injects JavaScript Backdoor for Mailbox Exfiltration/ —
2021-01-05 - Earth Wendigo Injects JavaScript Backdoor to Service Worker for Mailbox Exfiltration/ —
2021-01-05 - Manual analysis of new PowerSplit maldocs delivering Emotet/ —
2021-01-05 - Operation ElectroRAT- Attacker Creates Fake Companies to Drain Your Crypto Wallets/ —
2021-01-05 - ReconHellcat Uses NIST Theme as Lure To Deliver New BlackSoul Malware/ —
2021-01-05 - Red team's perspective on the TTPs in Sunburst's backdoor/ —
2021-01-05 - ‘I Was Running Two Parallel Lives’- An Ex-Secret Service Agent Opens Up About Going Undercover To Catch Cybercriminals/ —
2021-01-06 - A Deep Dive into Lokibot Infection Chain/ —
2021-01-06 - A Trump Sex Video- No, It's a RAT!/ —
2021-01-06 - All About Doki Malware/ —
2021-01-06 - Department of Justice Statement on Solarwinds Update/ —
2021-01-06 - Expanding Range and Improving Speed- A RansomExx Approach/ —
2021-01-06 - Hackers start exploiting the new backdoor in Zyxel devices/ —
2021-01-06 - Holiday Bazar- Tracking a TrickBot-Related Ransomware Incident/ —
2021-01-06 - How to Slam a Door on the Cutwail Botnet- Enforce DMARC/ —
2021-01-06 - ReconHellcat Uses NIST Theme as Lure To Deliver New BlackSoul Malware/ —
2021-01-06 - Retrohunting APT37 - North Korean APT used VBA self decode technique to inject RokRat/ —
2021-01-06 - Retrohunting APT37- North Korean APT used VBA self decode technique to inject RokRat/ —
2021-01-06 - SolarWinds_Countermeasures/ —
2021-01-06 - Supply Chain Compromise/ —
2021-01-07 - Avoiding supply-chain attacks similar to SolarWinds Orion’s (SUNBURST)/ —
2021-01-07 - Brunhilda DaaS Malware Analysis Report/ —
2021-01-07 - Malware using new Ezuri memory loader/ —
2021-01-07 - Meet Oski Stealer- An In-depth Analysis of the Popular Credential Stealer/ —
2021-01-07 - SolarWinds- How a Rare DGA Helped Attacker Communications Fly Under the Radar/ —
2021-01-07 - TA551- Email Attack Campaign Switches from Valak to IcedID/ —
2021-01-08 - A Golden SAML Journey- SolarWinds Continued/ —
2021-01-08 - Alert (AA21-008A)- Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments/ —
2021-01-08 - Charming Kitten’s Christmas Gift/ —
2021-01-08 - Leonardo S.p.A. Data Breach Analysis/ —
2021-01-08 - Ransomware Delivered Using RDP Brute-Force Attack/ —
2021-01-08 - The malware analyst’s guide to aPLib decompression/ —
2021-01-09 - Command and Control Traffic Patterns/ —
2021-01-09 - ezuri_unpack/ —
2021-01-09 - Malware Development- Leveraging Beacon Object Files for Remote Process Injection via Thread Hijacking/ —
2021-01-10 - MAN1, Moskal, Hancitor and a side of Ransomware/ —
2021-01-11 - CrowdStrike Technical Analysis/ —
2021-01-11 - Darkside Ransomware Decryption Tool/ —
2021-01-11 - Exclusive- FBI probes Russian-linked postcard sent to FireEye CEO after cybersecurity firm uncovered hack - sources/ —
2021-01-11 - FADE DEAD - Adventures in Reversing Malicious Run-Only AppleScripts/ —
2021-01-11 - New Findings From Our Investigation of SUNBURST/ —
2021-01-11 - Operation Spalax- Targeted malware attacks in Colombia/ —
2021-01-11 - Robust Indicators of Compromise for SUNBURST/ —
2021-01-11 - Sunburst backdoor – code overlaps with Kazuar/ —
2021-01-11 - SUNSPOT- An Implant in the Build Process/ —
2021-01-11 - Trickbot Still Alive and Well/ —
2021-01-11 - xHunt Campaign New BumbleBee Webshell and SSH Tunnels Used for Lateral Movement/ —
2021-01-11 - xHunt Campaign- New BumbleBee Webshell and SSH Tunnels Used for Lateral Movement/ —
2021-01-12 - Abusing cloud services to fly under the radar/ —
2021-01-12 - Chimera - Abusing cloud services to fly under the radar/ —
2021-01-12 - Confucius APT deploys Warzone RAT/ —
2021-01-12 - Cybereason vs. Conti Ransomware/ —
2021-01-12 - Going Rogue- a Mastermind behind Android Malware Returns with a New RAT/ —
2021-01-12 - Important Update from Mimecast/ —
2021-01-12 - Multiple vulnerabilities found in FiberHome HG6245D routers/ —
2021-01-12 - New Android spyware targets users in Pakistan/ —
2021-01-12 - New Variant of Ursnif Continuously Targeting Italy/ —
2021-01-12 - Opening “STEELCORGI”- A Sophisticated APT Swiss Army Knife/ —
2021-01-12 - Operation Spalax - Targeted malware attacks in Colombia/ —
2021-01-12 - Slamming The Backdoor On BazarLoader/ —
2021-01-12 - STEEL CORGI - A Sophisticated APT Swiss Army Knife/ —
2021-01-12 - UNC2452- What We Know So Far/ —
2021-01-13 - [RE019] From A to X analyzing some real cases which used recent Emotet samples/ —
2021-01-13 - A Rare Look Inside a Cryptojacking Campaign and its Profit/ —
2021-01-13 - Analysis Report (AR21-013A)- Strengthening Security Configurations to Defend Against Attackers Targeting Cloud Services/ —
2021-01-13 - Github Repository- BlackNET 3.7.0.1/ —
2021-01-13 - Gitlab RCE Stealth Shellbot/ —
2021-01-13 - Hancitor activity resumes after a hoilday break/ —
2021-01-13 - Passive Income of Cyber Criminals- Dissecting Bitcoin Multiplier Scam/ —
2021-01-13 - Reviving MuddyC3 Used by MuddyWater (IRAN) APT/ —
2021-01-13 - 年度最慘漏洞！深入探究 Oracle WebLogic CVE-2020-14882/ —
2021-01-14 - Higaisa or Winnti - APT41 backdoors, old and new/ —
2021-01-14 - Higaisa or Winnti- APT41 backdoors, old and new/ —
2021-01-14 - Increasing resilience against Solorigate and other sophisticated attacks with Microsoft Defender/ —
2021-01-14 - Killed In Translation/ —
2021-01-14 - New Analysis Puts Magecart Interconnectivity into Focus/ —
2021-01-14 - Python Cryptominer Botnet Quickly Adopts Latest Vulnerabilities/ —
2021-01-14 - Real-Time Phishing Kit Targets Brazilian Central Bank/ —
2021-01-14 - The Devil’s in the Details- SUNBURST Attribution/ —
2021-01-14 - You Can Run, But You Can’t Hide- Advanced Emotet Updates/ —
2021-01-15 - Detecting Malicious C2 Activity -SpawnAs & SMB Lateral Movement in CobaltStrike/ —
2021-01-15 - How we’re helping to reshape the software supply chain ecosystem securely/ —
2021-01-15 - Joker’s Stash, the Largest Carding Marketplace, Shuts Down/ —
2021-01-15 - Last Dash for Jokers Stash Carding forum may close in 30 days/ —
2021-01-15 - Researchers Disclose Undocumented Chinese Malware Used in Recent Attacks/ —
2021-01-15 - Sign over Your Hashes – Stealing NetNTLM Hashes via Outlook Signatures/ —
2021-01-15 - SolarWinds- Insights into Attacker Command and Control Process/ —
2021-01-15 - Windows Finger command abused by phishing to download malware/ —
2021-01-16 - Babuk Ransomware v3/ —
2021-01-16 - Iran’s Cyber Campaign, and Coercive Recruitment Methods/ —
2021-01-16 - Oski Stealer - A Credential Theft Malware/ —
2021-01-17 - Backdooring MSBuild/ —
2021-01-18 - All That for a Coinminer-/ —
2021-01-18 - Botnet Deploys Cloud and Container Attack Techniques/ —
2021-01-18 - Docx Files Template-Injection/ —
2021-01-18 - Extracting Shellcode in ICEID .PNG Steganography/ —
2021-01-18 - IObit forums hacked in widespread DeroHE ransomware attack/ —
2021-01-18 - IObit forums hacked to spread ransomware to its members/ —
2021-01-18 - Linux.Midrashim- Assembly x64 ELF virus/ —
2021-01-18 - Raindrop- New Malware Discovered in SolarWinds Investigation/ —
2021-01-18 - Trump’s Worst, Most Bizarre Statements About ‘the Cyber’/ —
2021-01-19 - Dridex Malicious Document Analysis- Automating the Extraction of Payload URLs/ —
2021-01-19 - FreakOut – Leveraging Newest Vulnerabilities for creating a Botnet/ —
2021-01-19 - Malwarebytes targeted by Nation State Actor implicated in SolarWinds breach. Evidence suggests abuse of privileged access to Microsoft Office 365 and Azure environments/ —
2021-01-19 - Mandiant Azure AD Investigator- Focusing on UNC2452 TTPs/ —
2021-01-19 - Oh, So You Got IOCs- Being a Good CTI Consumer/ —
2021-01-19 - Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452/ —
2021-01-19 - Tools used within the network invaded by attack group Lazarus/ —
2021-01-19 - VPNFilter Two Years Later- Routers Still Compromised/ —
2021-01-19 - Wireshark Tutorial- Examining Emotet Infection Traffic/ —
2021-01-20 - A Deep Dive Into Patchwork APT Group/ —
2021-01-20 - Anchor and Lazarus together again-/ —
2021-01-20 - Commonly Known Tools Used by Lazarus/ —
2021-01-20 - Deep dive into the Solorigate second-stage activation- From SUNBURST to TEARDROP and Raindrop/ —
2021-01-20 - Emulation of Kernel Mode Rootkits With Speakeasy/ —
2021-01-20 - MoqHao Part 1- Identifying Phishing Infrastructure/ —
2021-01-20 - XDR investigation uncovers PlugX, unique technique in APT attack/ —
2021-01-21 - Disclosure of Manling Flower Organization (APT-C-08) using Warzone RAT attack/ —
2021-01-21 - MrbMiner- Cryptojacking to bypass international sanctions/ —
2021-01-21 - Necro在频繁升级，新版本开始使用PyInstaller和DGA/ —
2021-01-21 - Powershell Dropping a REvil Ransomware/ —
2021-01-21 - Silencing Microsoft Defender for Endpoint using firewall rules/ —
2021-01-21 - Solarwinds Attack- Sunburst's DLL Technical Analysis/ —
2021-01-21 - Vadokrist- A wolf in sheep’s clothing/ —
2021-01-22 - Another File Extension to Block in your MTA- .jnlp/ —
2021-01-22 - Change in Perspective on the Utility of SUNBURST-related Network Indicators/ —
2021-01-22 - DreamBus Botnet - Technical Analysis/ —
2021-01-22 - LDAP Channel Binding and Signing/ —
2021-01-22 - Malware Analysis Report No2/ —
2021-01-22 - Necro is going to version 3 and using PyInstaller and DGA/ —
2021-01-22 - SolarWinds- How Sunburst Sends Data Back to the Attackers/ —
2021-01-22 - Stay Alert, Joker still making its way on Google Play Store!/ —
2021-01-23 - Deep Dive Into SectopRat/ —
2021-01-23 - RIFT- Analysing a Lazarus Shellcode Execution Method/ —
2021-01-23 - Yet Another Bazar Loader DGA/ —
2021-01-24 - Another ransomware (Avaddon) now uses DDoS attacks to force victims to pay/ —
2021-01-24 - Catching Debuggers with Section Hashing/ —
2021-01-24 - Finding SUNBURST victims and targets by using passive DNS, OSINT/ —
2021-01-24 - The only command you will ever need to understand and fix your Group Policies (GPO)/ —
2021-01-24 - VisualDoor- SonicWall SSL-VPN Exploit/ —
2021-01-25 - A detailed analysis of ELMER Backdoor used by APT16/ —
2021-01-25 - Affiliates vs Hunters- Fighting the DarkSide/ —
2021-01-25 - Fake Office 365 Used for Phishing Attacks on C-Suite Targets/ —
2021-01-25 - Individuato sito che veicola in Italia un APK malevolo/ —
2021-01-25 - New campaign targeting security researchers/ —
2021-01-25 - On attribution- APT28, APT29…Turla- No, they are NOT the same/ —
2021-01-25 - Twenty-three SUNBURST Targets Identified/ —
2021-01-25 - Ungilded Secrets- A New Paradigm for Key Security/ —
2021-01-26 - Cybereason vs. RansomEXX Ransomware/ —
2021-01-26 - DPRK Malware Targeting Security Researchers/ —
2021-01-26 - Examining a Sodinokibi Attack/ —
2021-01-26 - GhostDNSbusters (Part 3) Illuminating GhostDNS Infrastructure/ —
2021-01-26 - Important Security Update/ —
2021-01-26 - Mimecast links security breach to SolarWinds hackers/ —
2021-01-26 - Nefilim Ransomware Attack Uses “Ghost” Credentials/ —
2021-01-26 - New Year, New Version of DanaBot/ —
2021-01-26 - North Korea APT Might Have Used a Mobile 0day Too-/ —
2021-01-26 - Ongoing Analysis of SolarWinds Impacts/ —
2021-01-26 - Operation Dream Job by Lazarus/ —
2021-01-26 - PANDORABOX - North Koreans target security researchers/ —
2021-01-26 - Phishing Campaign Leverages WOFF Obfuscation and Telegram Channels for Communication/ —
2021-01-26 - Ransomware- Analyzing the data from 2020/ —
2021-01-26 - Shell Break-Lazarus (APT-C-26) organized targeted attacks against security researchers to reveal the secret/ —
2021-01-26 - SunBurst industrial victims/ —
2021-01-26 - Threat Attribution — Chimera -Under the Radar-/ —
2021-01-26 - TrickBot’s Survival Instinct Prevails — What’s Different About the TrickBoot Version-/ —
2021-01-26 - Undefeated, hackers use Visual Studio compiler features to target binary vulnerabilities security researcher/ —
2021-01-26 - W4 Jan - EN - Story of the week- Ransomware on the Darkweb/ —
2021-01-27 - Accellion cyber incident/ —
2021-01-27 - Analysis of THREATNEEDLE C&C Communication (feat. Google TAG Warning to Researchers)/ —
2021-01-27 - Arrest, Seizures Tied to Netwalker Ransomware/ —
2021-01-27 - CrimsonIAS- Listening for an 3v1l User/ —
2021-01-27 - Department of Justice Launches Global Action Against NetWalker Ransomware/ —
2021-01-27 - Emotet takedown is not like the Trickbot takedown/ —
2021-01-27 - How to communicate between RAT infected devices (White paper)/ —
2021-01-27 - How We Hacked Azure Functions and Escaped Docker/ —
2021-01-27 - International Action Targets Emotet Crimeware/ —
2021-01-27 - Malware Analysis Report (AR21-027A)- MAR-10319053-1.v1 - Supernova/ —
2021-01-27 - Oscorp, il “solito” malware per Android/ —
2021-01-27 - Taking Down Emotet How Team Cymru Leveraged Visibility and Relationships to Coordinate Community Efforts/ —
2021-01-27 - TeamTNT delivers malware with new detection evasion tool/ —
2021-01-27 - World’s most dangerous malware EMOTET disrupted through global action/ —
2021-01-28 - A Look at iMessage in iOS 14/ —
2021-01-28 - BazarLoader’s Elaborate Flower Shop Lure/ —
2021-01-28 - BlueCrab ransomware constantly trying to bypass detection/ —
2021-01-28 - Deep into the SunBurst Attack/ —
2021-01-28 - Emotet Botnet Disrupted in International Cyber Operation/ —
2021-01-28 - Emotet Botnet Takedown/ —
2021-01-28 - Emotet disruption - Europol counterattack/ —
2021-01-28 - Emotet vs. Windows Attack Surface Reduction/ —
2021-01-28 - In cyber espionage, U.S. is both hunted and hunter/ —
2021-01-28 - Learn how to fix PE magic numbers with Malduck/ —
2021-01-28 - Lebanese Cedar APT/ —
2021-01-28 - Osno – A Stealer and a Miner in One/ —
2021-01-28 - Pro-Ocean- Rocke Group’s New Cryptojacking Malware/ —
2021-01-28 - Tailoring Cobalt Strike on Target/ —
2021-01-28 - ZINC attacks against security researchers/ —
2021-01-29 - Chopper ASPX web shell used in targeted attack/ —
2021-01-29 - Cleaning up after Emotet- the law enforcement file/ —
2021-01-29 - Cloudy with a Chance of Persistent Email Access/ —
2021-01-30 - Analysis of Lazarus attacks against security researchers/ —
2021-01-31 - $1 Million is Just the Beginning- Q4 2020 in Network Access Sales/ —
2021-01-31 - A41APT case/ —
2021-01-31 - Bazar, No Ryuk-/ —
2021-02-01 - Analysis of the attack activity organized by Konni APT using the topic of North Korean epidemic materials as bait/ —
2021-02-01 - BazarLoader Mocks Researchers in December 2020 Malspam Campaign/ —
2021-02-01 - BlueCrab ransomware, CobaltStrike hacking tool installed in corporate environment/ —
2021-02-01 - DDG- A Mining Botnet Aiming at Database Servers/ —
2021-02-01 - DPRK Targeting Researchers II- .Sys Payload and Registry Hunting/ —
2021-02-01 - Operation NightScout - Supply‑chain attack targets online gaming in Asia/ —
2021-02-01 - Operation NightScout- Supply‑chain attack targets online gaming in Asia/ —
2021-02-01 - Pivoting- finding malware domains without seeing malicious activity/ —
2021-02-01 - Relay Attacks via Cobalt Strike Beacons/ —
2021-02-01 - Trickbot masrv Module/ —
2021-02-01 - Urgent Security Notice- SonicWall Confirms SMA 100 Series 10. X Zero-Day Vulnerability/ —
2021-02-01 - What tracking an attacker email infrastructure tells us about persistent cybercriminal operations/ —
2021-02-02 - Babyk Ransomware won't hit charities, unless they support LGBT, BLM/ —
2021-02-02 - Credit card skimmer piggybacks on Magento 1 hacking spree/ —
2021-02-02 - De ataque con Malware a incidente de Ransomware/ —
2021-02-02 - Exclusive- Suspected Chinese hackers used SolarWinds bug to spy on U.S. payroll agency - sources/ —
2021-02-02 - Finding and Decoding Multi-Step Obfuscated Malware/ —
2021-02-02 - Hackers Lurked in SolarWinds Email System for at Least 9 Months, CEO Says/ —
2021-02-02 - How Vietnam-based hacking operation OceanLotus targets journalists/ —
2021-02-02 - Investigation Xoth - Smartphone Location Tracking/ —
2021-02-02 - Kobalos goes after HPCs/ —
2021-02-02 - Kobalos – A complex Linux threat to high performance computing infrastructure/ —
2021-02-02 - Whitespace Steganography Conceals Web Shell in PHP Malware/ —
2021-02-02 - XLSB- Analyzing a Microsoft Excel Binary Spreadsheet/ —
2021-02-03 - A Spyware Vendor Seemingly Made a Fake WhatsApp to Hack Targets/ —
2021-02-03 - Backdoored Browser Extensions Hid Malicious Traffic in Analytics Requests/ —
2021-02-03 - Dissecting a RAT. Analysis of DroidJack v4.4 RAT network traffic/ —
2021-02-03 - Dissemination of malicious code disguised as a document of'Amendment of Ministry of Defense's Business Report in 2021/ —
2021-02-03 - Déjà vu-lnerability A Year in Review of 0-days Exploited In-The-Wild in 2020/ —
2021-02-03 - Emotet Disruption- what it means for the cyber threat landscape/ —
2021-02-03 - Excel spreadsheets push SystemBC malware/ —
2021-02-03 - Findings From Our Ongoing Investigations/ —
2021-02-03 - Hildegard - New TeamTNT Malware Targe/ —
2021-02-03 - Hildegard- New TeamTNT Malware Targeting Kubernetes/ —
2021-02-03 - Malvertising- Made in China/ —
2021-02-03 - MTR casebook- Uncovering a backdoor implant in a SolarWinds Orion server/ —
2021-02-03 - New cryptojacking malware called Pro-Ocean is now attacking Apache, Oracle and Redis servers/ —
2021-02-03 - Ursnif Trojan has targeted over 100 Italian banks/ —
2021-02-03 - Zeoticus 2.0 - Ransomware With No C2 Required/ —
2021-02-04 - Abusing Google Chrome extension syncing for data exfiltration and C&C/ —
2021-02-04 - Blockchain Analysis Shows Connections Between Four of 2020’s Biggest Ransomware Strains/ —
2021-02-04 - Connecting the dots inside the Italian APT Landscape/ —
2021-02-04 - Fonix Ransomware Decryptor/ —
2021-02-05 - Behavior Clustering just got easier using new characteristics/ —
2021-02-05 - CinaRAT Resurfaces with New Evasive Tactics and Techniques/ —
2021-02-05 - Cybersecurity Advisory for Public Water Suppliers/ —
2021-02-05 - Exploits in the Wild for WordPress File Manager RCE Vulnerability (CVE-2020-25213)/ —
2021-02-05 - Kobalos Malware Mapping Potentially Impacted Networks and IP Address Mapping/ —
2021-02-05 - Microsoft warns of increasing OAuth Office 365 phishing attacks/ —
2021-02-05 - New in Ransomware- Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker/ —
2021-02-05 - Voltron STA The curious case of 0xFancyFilter/ —
2021-02-06 - Decrypting AzoRult traffic for fun and profit/ —
2021-02-07 - Dridex Malware Analysis/ —
2021-02-07 - New phishing attack uses Morse code to hide malicious URLs/ —
2021-02-08 - A Hacker Tried to Poison a Florida City's Water Supply, Officials Say/ —
2021-02-08 - After Lightning Comes Thunder/ —
2021-02-08 - Auf Tätersuche- Herausforderungen bei der Analyse von Cyber-Angriffen/ —
2021-02-08 - Blocking SolarMarker Backdoor/ —
2021-02-08 - Domestic Kitten - An Inside Look at the Iranian Surveillance Operations/ —
2021-02-08 - Domestic Kitten – An Inside Look at the Iranian Surveillance Operations/ —
2021-02-08 - Long Live, Osiris; Banking Trojan Targets German IP Addresses/ —
2021-02-08 - Malware Analysis Report (AR21-039A)- SUNBURST/ —
2021-02-08 - Malware Analysis Report (AR21-039B)- MAR-10320115-1.v1 - TEARDROP/ —
2021-02-08 - Recommendations Following the Oldsmar Water Treatment Facility Cyber Attack/ —
2021-02-08 - Reverse engineering Emotet – Our approach to protect GRNET against the trojan/ —
2021-02-08 - What Is the Point of These Nation-State Indictments-/ —
2021-02-09 - BazarBackdoor’s Stealthy Infiltration Evades Multiple SEGs/ —
2021-02-09 - BendyBear - Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech/ —
2021-02-09 - Dependency Confusion- How I Hacked Into Apple, Microsoft and Dozens of Other Companies/ —
2021-02-09 - Extracting the Cobalt Strike Config from a TEARDROP Loader/ —
2021-02-09 - Ghidra script to decrypt strings in Amadey 1.09/ —
2021-02-09 - Kasablanka Group's LodaRAT improves espionage capabilities on Android and Windows/ —
2021-02-09 - Learn Pipe Fitting for all of your Offense Projects/ —
2021-02-09 - Multiple Security Updates Affecting TCP-IP- CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086/ —
2021-02-09 - Threat actors now target Docker via container escape features/ —
2021-02-09 - Water, Water Everywhere – But Nary a Hacker to Blame/ —
2021-02-09 - Windows Win32k Elevation of Privilege Vulnerability CVE-2021-1732 (exploited ITW)/ —
2021-02-10 - Lampion trojan disseminated in Portugal using COVID-19 template/ —
2021-02-10 - Lookout Discovers Novel Confucius APT Android Spyware Linked to India-Pakistan Conflict/ —
2021-02-10 - Probable Iranian Cyber Actors, Static Kitten, Conducting Cyberespionage Campaign Targeting UAE and Kuwait Government Agencies/ —
2021-02-10 - Profiling a Currently Active High-Profile Cybercriminals Portfolio of Ransomware-Themed Extortion Email Addresses - Part Two/ —
2021-02-10 - Punk Kitty Ransom - Analysing HelloKitty Ransomware Attacks/ —
2021-02-10 - Rinfo Is Making A Comeback and Is Scanning and Mining in Full Speed/ —
2021-02-10 - Windows kernel zero-day exploit (CVE-2021-1732) is used by BITTER APT in targeted attack/ —
2021-02-11 - A Baza Valentine’s Day/ —
2021-02-11 - Agent Tesla hidden in a historical anti-malware tool/ —
2021-02-11 - BlackTech Updates Elf-Plead Backdoor/ —
2021-02-11 - Cosmic Lynx Returns in 2021 with Updated Tricks/ —
2021-02-11 - Press #1 to Play- A Look Into eCrime Menu-style Toolkits/ —
2021-02-11 - Visibility, Monitoring, and Critical Infrastructure Security/ —
2021-02-11 - Web shell attacks continue to rise/ —
2021-02-12 - AgentTesla Dropped Through Automatic Click in Microsoft Help File/ —
2021-02-12 - Malvertising campaign on PornHub and other top adult brands exposes users to tech support scams/ —
2021-02-12 - New Bazar Trojan Variant is Being Spread in Recent Phishing Campaign – Part I/ —
2021-02-12 - New Bazar Trojan Variant is Being Spread in Recent Phishing Campaign – Part II/ —
2021-02-12 - The Many Roads Leading To Agent Tesla/ —
2021-02-14 - Arm'd & Dangerous malicious code, now native on apple silicon/ —
2021-02-14 - Hildegard- TeamTNT’s New Feature-Rich Malware Targeting Kubernetes/ —
2021-02-15 - France Ties Russia's Sandworm to a Multiyear Hacking Spree/ —
2021-02-15 - More LodaRAT infrastructure targeting Bangladesh uncovered/ —
2021-02-15 - Ngrok Platform Abused by Hackers to Deliver a New Wave of Phishing Attacks/ —
2021-02-15 - Ransomware Profile- Egregor/ —
2021-02-16 - A Conti ransomware attack day-by-day/ —
2021-02-16 - ApoMacroSploit- Apocalyptical FUD race/ —
2021-02-16 - Conti ransomware- Evasive by nature/ —
2021-02-16 - Cybereason vs. NetWalker Ransomware/ —
2021-02-16 - Dark Net Markets Going Out of Business- Where are Users Headed to Next-/ —
2021-02-16 - Hacker Claims to Have Stolen Files Belonging to Prominent Law Firm Jones Day/ —
2021-02-16 - Hard lessons learned- Threat intel takeaways from the community response to Solarigate/ —
2021-02-16 - Latin American Javali trojan weaponizing Avira antivirus legitimate injector to implant malware/ —
2021-02-16 - Malvertiser “ScamClub” Bypasses Iframe Sandboxing With postMessage() Shenanigans [CVE-2021–1801]/ —
2021-02-16 - Q4 2020 Threat Report- A Quarterly Analysis of Cybersecurity Trends, Tactics and Themes/ —
2021-02-16 - TAG Bulletin- Q1 2021/ —
2021-02-16 - What to expect when you’ve been hit with Conti ransomware/ —
2021-02-17 - [RE020] ElephantRAT (Kunming version)- our latest discovered RAT of Panda and the similarities with recently Smanager RAT/ —
2021-02-17 - Alert (AA21-048A)- AppleJeus- Analysis of North Korea’s Cryptocurrency Malware/ —
2021-02-17 - Confucius APT Android Spyware Targets Pakistani and Other South Asian Regions/ —
2021-02-17 - Detect and prevent the SolarWinds build-time code injection attack/ —
2021-02-17 - Don’t Get Schooled- Understanding the Threats to the Academic Industry/ —
2021-02-17 - Egregor operation takes huge hit after police raids/ —
2021-02-17 - ELF Malware Analysis 101- Part 3 - Advanced Analysis/ —
2021-02-17 - GuLoader Snowballs via MalSpam Campaigns/ —
2021-02-17 - Malware Analysis Report (AR21-048A)- AppleJeus- Celas Trade Pro/ —
2021-02-17 - Malware Analysis Report (AR21-048B)- AppleJeus- JMT Trading/ —
2021-02-17 - Malware Analysis Report (AR21-048C)- AppleJeus- Union Crypto/ —
2021-02-17 - Malware Analysis Report (AR21-048D)- AppleJeus- Kupay Wallet/ —
2021-02-17 - Malware Analysis Report (AR21-048E)- AppleJeus- CoinGoTrade/ —
2021-02-17 - Malware Analysis Report (AR21-048F)- AppleJeus- Dorusio/ —
2021-02-17 - Malware Analysis Report (AR21-048G)- AppleJeus- Ants2Whale/ —
2021-02-17 - Masslogger campaigns exfiltrates user credentials/ —
2021-02-17 - Politie bestrijdt cybercrime via Nederlandse infrastructuur/ —
2021-02-17 - SBU blocks activity of transnational hacking group/ —
2021-02-17 - Targeting Process for the SolarWinds Backdoor/ —
2021-02-17 - Threat Alert- TeamTNT Pwn Campaign Against Docker and K8s Environments/ —
2021-02-17 - Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe/ —
2021-02-17 - Understand Shellcode with CyberChef/ —
2021-02-17 - Update on Investigaton on Solarwinds supply chain attack from the Deputy National Security Advisor/ —
2021-02-17 - WatchDog- Exposing a Cryptojacking Campaign That’s Operated for Two Years/ —
2021-02-18 - Clipping Silver Sparrow’s wings- Outing macOS malware before it takes flight/ —
2021-02-18 - Further Updates in LODEINFO Malware/ —
2021-02-18 - https---www.ptsecurity.com-ww-en-analytics-antisandbox-techniques-/ —
2021-02-18 - Lazarus- Three North Koreans Charged for Financially Motivated Attacks/ —
2021-02-18 - Microsoft Internal Solorigate Investigation – Final Update/ —
2021-02-18 - nccTrojan used in targeted attack by TA428 group against defense and aviation organizations/ —
2021-02-18 - One thousand and one ways to copy your shellcode to memory (VBA Macros)/ —
2021-02-19 - Alleged Hydra Market Operators Identified/ —
2021-02-19 - Behind the Scenes of the SunBurst Attack/ —
2021-02-19 - Cyber Attribution Is More Art Than Science. This Researcher Has a Plan to Change That/ —
2021-02-19 - GitHub – Home to AsyncRAT Backdoor/ —
2021-02-19 - How to Understand Iranian Information Operations/ —
2021-02-19 - IronNetInjector- Turla’s New Malware Loading Tool/ —
2021-02-20 - Finding Forensic Goodness In Obscure Windows Event Logs/ —
2021-02-20 - Malpedia Website for Malware Family Team TNT/ —
2021-02-22 - Cyber Criminals Exploit Accellion FTA for Data Theft and Extortion/ —
2021-02-22 - Economic Growth, Digital Inclusion, & Specialized Crime- Financial Cyber Fraud in LATAM/ —
2021-02-22 - Gh0stRat Anti-Debugging- Nested SEH (try - catch) to Decrypt and Load its Payload/ —
2021-02-22 - MassLogger v3- a .NET stealer with serious obfuscation/ —
2021-02-22 - The NCCC at the NSDC of Ukraine warns of a new mechanism of attacks on Ukrainian infrastructure/ —
2021-02-22 - The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day/ —
2021-02-23 - A Cyber Threat Intelligence Self-Study Plan- Part 1/ —
2021-02-23 - An Analysis of the Nefilim Ransomware/ —
2021-02-23 - DNS Hijacking Attacks on Home Routers in Brazil/ —
2021-02-23 - Gamaredon - When nation states don’t pay all the bills/ —
2021-02-23 - New Mysterious Operators Usurp Elite Russian Hacker Forum “Verified”/ —
2021-02-23 - Return of the MINEBRIDGE RAT With New TTPs and Social Engineering Lures/ —
2021-02-23 - Surge in ZLoader Attacks Observed/ —
2021-02-24 - Alert (AA21-055A)- Exploitation of Accellion File Transfer Appliance/ —
2021-02-24 - Click and Bait - Vietnamese Human Rights Defenders Targeted with Spyware Attacks/ —
2021-02-24 - LazyScripter - From Empire to double RAT/ —
2021-02-24 - Malware Analysis Report (AR21-055A)- Accellion FTA/ —
2021-02-24 - NASA and the FAA were also breached by the SolarWinds hackers/ —
2021-02-24 - Overview of Ocean Lotus Samples used to target Vietnamese Human Rights Defenders/ —
2021-02-25 - APT10 - Tracking down the stealth activity of the A41APT campaign/ —
2021-02-25 - DarkWorld Ransomware/ —
2021-02-25 - Emotet Disruption and Outreach to Affected Users/ —
2021-02-25 - Lazarus targets defense industry with ThreatNeedle/ —
2021-02-25 - Lazarus Threat Needle/ —
2021-02-25 - Light in the Dark- Hunting for SUNBURST/ —
2021-02-25 - Microsoft open sources CodeQL queries used to hunt for Solorigate activity/ —
2021-02-25 - Preventing AgentTelsa Infiltration/ —
2021-02-25 - So Unchill Melting UNC2198 ICEDID to Ransomware Operations/ —
2021-02-25 - So Unchill- Melting UNC2198 ICEDID to Ransomware Operations/ —
2021-02-25 - TA413 Leverages New FriarFox Browser Extension to Target the Gmail Accounts of Global Tibetan Organizations/ —
2021-02-25 - The Continuous Conundrum of Cloud Atlas/ —
2021-02-26 - Hypervisor Jackpotting - CARBON SPIDER and SPRITE SPIDER Target ESXi Servers with Ransomware/ —
2021-02-26 - Hypervisor Jackpotting- CARBON SPIDER and SPRITE SPIDER Target ESXi Servers With Ransomware to Maximize Impact/ —
2021-02-26 - New Advanced Android Malware Posing as “System Update”/ —
2021-02-27 - Nice to meet you too My name is Ryuk/ —
2021-02-28 - China-linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions/ —
2021-02-28 - Deobfuscating Emotet Macro Document and Powershell Command/ —
2021-02-28 - Finding Evil Go Packages/ —
2021-02-28 - Laravel Apps Leaking Secrets/ —
2021-02-28 - RedEcho APT - China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions/ —
2021-03 - Ransomware negotiations- An inside look at the process/ —
2021-03-01 - First Fully Weaponized Spectre Exploit Discovered Online/ —
2021-03-01 - Newly Identified Dependency Confusion Packages Target Amazon, Zillow, and Slack; Go Beyond Just Bug Bounties/ —
2021-03-01 - Povlsomware Ransomware Features Cobalt Strike Compatibility/ —
2021-03-01 - “Gootloader” expands its payload delivery options/ —
2021-03-02 - An Exhaustively-Analyzed IDB for FlawedGrace/ —
2021-03-02 - HAFNIUM APT targeting Exchange Servers with 0-day exploits/ —
2021-03-02 - HAFNIUM targeting Exchange Servers with 0-day exploits/ —
2021-03-02 - Malware in images/ —
2021-03-02 - Microsoft-365-Defender-Hunting-Queries for hunting Gootkit malware delivery and C2/ —
2021-03-02 - Multiple Security Updates Released for Exchange Server – updated March 8, 2021/ —
2021-03-02 - New nation-state cyberattacks (HAFNIUM)/ —
2021-03-02 - ObliqueRAT returns with new campaign using hijacked websites/ —
2021-03-02 - Operation Exchange Marauder- Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities/ —
2021-03-02 - Operation Exchange Marauder/ —
2021-03-02 - Ploutus is back, targeting Itautec ATMs in Latin America/ —
2021-03-02 - Rapid7’s InsightIDR Enables Detection And Response to Microsoft Exchange Zero-Day/ —
2021-03-02 - The Egregor Ransomware/ —
2021-03-02 - When Viruses Mutate- Did SunCrypt Ransomware Evolve from QNAPCrypt-/ —
2021-03-03 - 'Mild' update on Microsoft Exchange 0day security vulnerability being used to attack organizations in Vietnam/ —
2021-03-03 - Alert (AA21-062A)- Mitigate Microsoft Exchange Server Vulnerabilities/ —
2021-03-03 - Centreon to Exim and Back- On the Trail of Sandworm/ —
2021-03-03 - Detecting HAFNIUM Exchange Server Zero-Day Activity in Splunk/ —
2021-03-03 - Fbot is now riding the traffic and transportation smart devices/ —
2021-03-03 - HAFNIUM/ —
2021-03-03 - Lazarus Group’s MATA Framework Leveraged to Deploy TFlower Ransomware/ —
2021-03-03 - Mass exploitation of on-prem Exchange servers -(/ —
2021-03-03 - Mitigate Microsoft Exchange On-Premises Product Vulnerabilities/ —
2021-03-03 - New targeted RTM attacks/ —
2021-03-03 - Please leave an exploit after the beep/ —
2021-03-03 - Rapid Response- Mass Exploitation of On-Prem Exchange Servers/ —
2021-03-04 - Breaking- Elite Cybercrime Forum “Maza” Breached by Unknown Attacker/ —
2021-03-04 - Deception Engineering- exploring the use of Windows Service Canaries against ransomware/ —
2021-03-04 - Detection and Response for HAFNIUM Activity/ —
2021-03-04 - Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities/ —
2021-03-04 - Falcon Complete Stops Microsoft Exchange Server Zero-Day Exploits/ —
2021-03-04 - Gafgtyt_tor and Necro are on the move again/ —
2021-03-04 - GoldMax, GoldFinder, and Sibot- Analyzing NOBELIUM’s layered persistence/ —
2021-03-04 - IcedID Banking Trojan Uses COVID-19 Pandemic to Lure New Victims/ —
2021-03-04 - Malpedia Page for family Sidewinder/ —
2021-03-04 - New in Ransomware- AlumniLocker, Humble Feature Different Extortion Techniques/ —
2021-03-04 - New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452/ —
2021-03-04 - The Compact Campaign/ —
2021-03-05 - A look at an Android bot from unpacking to DGA/ —
2021-03-05 - Advancements in Invoicing - A highly sophisticated way to distribute ZLoader/ —
2021-03-05 - Chinese Hacking Spree Hit an ‘Astronomical’ Number of Victims/ —
2021-03-05 - Detect webshells dropped on Microsoft Exchange servers after 0day compromises/ —
2021-03-05 - Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East/ —
2021-03-05 - Exchange Server IIS dropping web shells and other artifacts/ —
2021-03-05 - Hafnium Exchange Vuln Detection - KQL/ —
2021-03-05 - HAFNIUM- Advice about the new nation-state attack/ —
2021-03-05 - New steganography attack targets Azerbaijan/ —
2021-03-05 - QNAP NAS users, make sure you check your system/ —
2021-03-05 - Sarbloh- The Ransomware With NO Demand/ —
2021-03-05 - ZeroLogon to Ransomware/ —
2021-03-06 - Microsoft Exchange Zero Days - Mitigations and Detections/ —
2021-03-06 - oleObject1.bin – OLe10nATive – shellcode/ —
2021-03-06 - Russian and Chinese hackers gained access to EMA/ —
2021-03-06 - Scan for HAFNIUM Exploitation Evidence with THOR Lite/ —
2021-03-06 - Security scripts/ —
2021-03-07 - Australian Mining Companies and Cybercriminals Digging for the Gold/ —
2021-03-07 - PCAPs and Beacons/ —
2021-03-07 - Russian Disinformation Campaign Aims to Undermine Confidence in Pfizer, Other Covid-19 Vaccines, U.S. Officials Say/ —
2021-03-08 - Analyzing Attacks Against Microsoft Exchange Server With China Chopper Webshells/ —
2021-03-08 - Attack Chain Overview- Emotet in December 2020 and January 2021/ —
2021-03-08 - Bazar Drops the Anchor/ —
2021-03-08 - FluBot Malware Gang Arrested in Barcelona/ —
2021-03-08 - HelloKitty Ransomware Lacks Stealth, But Still Strikes Home/ —
2021-03-08 - How Symantec Stops Microsoft Exchange Server Attacks/ —
2021-03-08 - Investigating the Print Spooler EoP exploitation/ —
2021-03-08 - Renewed SideWinder Activity in South Asia/ —
2021-03-08 - Sunshuttle Malware/ —
2021-03-08 - SUPERNOVA Web Shell Deployment Linked to SPIRAL Threat Group/ —
2021-03-09 - Clast82 – A new Dropper on Google Play Dropping the AlienBot Banker and MRAT/ —
2021-03-09 - Cloud Federated Credential Abuse & Cobalt Strike- Threat Research February 2021/ —
2021-03-09 - Hafnium Update- Continued Microsoft Exchange Server Exploitation/ —
2021-03-09 - Hafnium – Active Exploitation of Microsoft Exchange and Lateral Movement/ —
2021-03-09 - Kinsing- The Malware with Two Faces/ —
2021-03-09 - Microsoft Exchange attacks cause panic as criminals go shell collecting/ —
2021-03-09 - Microsoft Exchange server exploitation- how to detect, mitigate, and stay calm/ —
2021-03-09 - Microsoft Exchange Server Vulnerabilities Mitigations – updated March 9, 2021/ —
2021-03-09 - MineBridge Is on the Rise, With a Sophisticated Delivery Mechanism/ —
2021-03-09 - Remediation Steps for the Microsoft Exchange Server Vulnerabilities/ —
2021-03-09 - Reproducing the Microsoft Exchange Proxylogon Exploit Chain/ —
2021-03-09 - Threat Alert- z0Miner Is Spreading quickly by Exploiting ElasticSearch and Jenkins Vulnerabilities/ —
2021-03-10 - Azure Sentinel and Sysmon 4 B!ue T3amer$/ —
2021-03-10 - Examining Exchange Exploitation and its Lessons for Defenders/ —
2021-03-10 - Exchange servers under siege from at least 10 APT groups/ —
2021-03-10 - FIN8 Returns with Improved BADHATCH Toolkit/ —
2021-03-10 - IoT Malware Journals- Prometei (Linux)/ —
2021-03-10 - Monitoring the Software Supply Chain with Azure Sentinel/ —
2021-03-10 - New Linux Backdoor RedXOR Likely Operated by Chinese Nation-State Actor/ —
2021-03-10 - NimzaLoader- TA800’s New Initial Access Malware/ —
2021-03-10 - Norway parliament data stolen in Microsoft Exchange attack/ —
2021-03-10 - Remediating Networks Affected by the SolarWinds and Active Directory-M365 Compromise/ —
2021-03-10 - Tactics, Techniques, and Procedures (TTPs) Used by HAFNIUM to Target Microsoft Exchange Servers/ —
2021-03-10 - 日本を標的としたPseudoGateキャンペーンによるSpelevo Exploit Kitを用いた攻撃について/ —
2021-03-11 - 2020 Vulnerability Intelligence Report/ —
2021-03-11 - Academics AI and APTs/ —
2021-03-11 - AutoHotKey Leveraged by Metamorfo-Mekotio Banking Trojan/ —
2021-03-11 - CL0P and REvil Escalate Their Ransomware Tactics/ —
2021-03-11 - Detection and Investigation Using Devo- HAFNIUM 0-day Exploits on Microsoft Exchange Service/ —
2021-03-11 - Dridex Campaign Propelled by Cutwail Botnet and Poisonous PowerShell Scripts/ —
2021-03-11 - Exploits on Organizations Worldwide Tripled after Microsoft’s Revelation of Four Zero-days/ —
2021-03-11 - Formbook Reversing - Part1 [Formbook .NET loader-injector analyzing, decrypting, unpacking, patching]/ —
2021-03-11 - Image File Trickery Part II- Fake Icon Delivers NanoCore/ —
2021-03-11 - Microsoft Exchange Server Attack Timeline/ —
2021-03-11 - Myanmar – Multi-stage malware attack targets elected lawmakers/ —
2021-03-11 - Playing in the (Windows) Sandbox/ —
2021-03-11 - Ransomware now attacks Microsoft Exchange servers with ProxyLogon exploits/ —
2021-03-11 - Update - Detection and Response for HAFNIUM Activity/ —
2021-03-11 - Whitelist Me, Maybe- “Netbounce” Threat Actor Tries A Bold Approach To Evade Detection/ —
2021-03-11 - You Don't Know the HAFNIUM of it/ —
2021-03-12 - Detecting Microsoft Exchange Vulnerabilities - 0 + 8 Days Later…/ —
2021-03-12 - DotNET Loaders/ —
2021-03-12 - Good old malware for the new Apple Silicon platform/ —
2021-03-12 - IcedID GZIPLOADER Analysis/ —
2021-03-12 - Spear-Phishing Campaign Distributes Nim-Based Malware/ —
2021-03-14 - How China’s Devastating Microsoft Hack Puts Us All at Risk/ —
2021-03-15 - Conficker - One of the Most Prevalent & Complex Windows Worms/ —
2021-03-15 - DearCry ransomware attacks exploit Exchange server vulnerabilities/ —
2021-03-15 - FIN8- BADHATCH Threat Indicator Enrichmen/ —
2021-03-15 - HAFNIUM, China Chopper and ASP.NET Runtime/ —
2021-03-15 - Incorporating the Cyberspace Domain- How Russia and China Exploit Asymmetric Advantages in Great Power Competition/ —
2021-03-15 - JavaScript sniffers' new tricks- Analysis of the E1RB JS sniffer family/ —
2021-03-15 - New Mirai Variant Targeting New IoT Vulnerabilities, Including in Network Security Devices/ —
2021-03-15 - One-Click Microsoft Exchange On-Premises Mitigation Tool – March 2021/ —
2021-03-15 - Taurus Stealer's Evolution/ —
2021-03-15 - The Iran-Russia Cyber Agreement and U.S. Strategy in the Middle East/ —
2021-03-16 - Detecting Cobalt Strike with memory signatures/ —
2021-03-16 - France’s lead cybercrime investigator on the Egregor arrests, cybercrime/ —
2021-03-16 - Incident Report/ —
2021-03-16 - The Brief Glory of Cabassous-FluBot — a private Android banking botnet/ —
2021-03-16 - Threatening within Budget- How WSH-RAT is abused by Cyber-Crooks/ —
2021-03-16 - Tracking HCrypt- An Active Crypter as a Service/ —
2021-03-16 - ‘I scrounged through the trash heaps… now I’m a millionaire-’ An interview with REvil’s Unknown/ —
2021-03-17 - Alert (AA21-076A)- TrickBot Malware/ —
2021-03-17 - Automatic Gobfuscator Deobfuscation with EKANS Ransomware/ —
2021-03-17 - China-linked TA428 Continues to Target Russia and Mongolia IT Companies/ —
2021-03-17 - China’s Five-Year Plan- A Pursuit for GDP Growth & Technological Self-Sufficiency/ —
2021-03-17 - Hidden menace- Peeling back the secrets of OnionCrypter/ —
2021-03-17 - INDRIK SPIDER Supersedes WastedLocker with Hades Ransomware to Circumvent OFAC Sanctions/ —
2021-03-17 - Missed opportunity- Bug in LockBit ransomware allowed free decryptions/ —
2021-03-17 - Satori- Mirai Botnet Variant Targeting Vantage Velocity Field Unit RCE Vulnerability/ —
2021-03-18 - [RE021] Qakbot analysis – Dangerous malware has been around for more than a decade/ —
2021-03-18 - Alert (AA21-077A)- Detecting Post-Compromise Threat Activity Using the CHIRP IOC Detection Tool/ —
2021-03-18 - Beware Android trojan posing as Clubhouse app/ —
2021-03-18 - Buer Loader Found in an Unusual Email Attachment/ —
2021-03-18 - CISA Hunt and Incident Response Program (CHIRP)/ —
2021-03-18 - Cobalt Strike – Post-Exploitation Attackers Toolkit/ —
2021-03-18 - Communiqué de presse- 400 systèmes informatique belges infiltrés dans le cadre d'une vulnérabilité des serveurs Microsoft Exchange/ —
2021-03-18 - Convuster- macOS adware now in Rust/ —
2021-03-18 - Cybereason Exposes Campaign Targeting US Taxpayers with NetWire and Remcos Malware/ —
2021-03-18 - DGA and decoder scripts for n3cr0morph IRC malware/ —
2021-03-18 - Eduskunnan tietojärjestelmiin kohdistuneen tietomurron tutkinnassa selvitetään yhteyttä APT31-toimijaan/ —
2021-03-18 - Github repository for STOWAWAY/ —
2021-03-18 - HelloKitty- When Cyberpunk met cy-purr-crime/ —
2021-03-18 - Hunting for Lateral Movement using Event Query Language/ —
2021-03-18 - Necro upgrades again, using Tor + dynamic domain DGA and aiming at both Windows & Linux/ —
2021-03-18 - New macOS malware XcodeSpy Targets Xcode Developers with EggShell Backdoor/ —
2021-03-18 - Now You See It, Now You Don’t- CopperStealer Performs Widespread Theft/ —
2021-03-18 - Return of the Darkside- Analysis of a Large-Scale Data Theft Campaign/ —
2021-03-18 - Server Side Data Exfiltration via Telegram API/ —
2021-03-18 - SilverFish Group Threat Actor Report/ —
2021-03-18 - Supo identified the cyber espionage operation against the parliament as APT31/ —
2021-03-18 - The “Kek Security” Network/ —
2021-03-19 - REvil ransomware has a new ‘Windows Safe Mode’ encryption mode/ —
2021-03-19 - TA551/ —
2021-03-21 - In the eye of our CyberSOC- Campo Loader, analysis and detection perspectives/ —
2021-03-22 - Lazarus Attack Activities Targeting Japan (VSingle-ValeforBeta)/ —
2021-03-22 - MalSpam Campaigns Download njRAT from Paste Sites/ —
2021-03-22 - New Spear Phishing Campaign using Army Welfare Education Society’s Scholarship form/ —
2021-03-22 - 대북관련 본문 내용의 External 링크를 이용한 악성 워드 문서/ —
2021-03-23 - Black Kingdom ransomware begins appearing on Exchange servers/ —
2021-03-23 - Low-volume multi-stage attack leveraging AzureEdge and Shopify CDNs/ —
2021-03-23 - ModPipe Malware has a new module that siphons Credit Card Data/ —
2021-03-23 - RemRAT- Android spyware that has been lurking in the Middle East for many years/ —
2021-03-23 - Zloader- Entailing Different Office Files/ —
2021-03-24 - A .NET rat targets Mongolia/ —
2021-03-24 - Anti-Analysis Techniques Used in Excel 4.0 Macros/ —
2021-03-24 - APT Encounters of the Third Kind/ —
2021-03-24 - Black Kingdom ransomware begins appearing on Exchange servers/ —
2021-03-24 - Fake Websites Used in COVID-19 Themed Phishing Attacks, Impersonating Brands Like Pfizer and BioNTech/ —
2021-03-24 - Golang Bot Starts Targeting WordPress Websites/ —
2021-03-24 - OAuth Abuse- Think SolarWinds-Solorigate Campaign with Focus on Cloud Applications/ —
2021-03-24 - Purple Fox Rootkit Now Propagates as a Worm/ —
2021-03-24 - Quarterly Report- Incident Response trends from Winter 2020-21/ —
2021-03-24 - Software renewal scammers unmasked/ —
2021-03-24 - Taking Action Against Hackers in China/ —
2021-03-25 - Analyzing attacks taking advantage of the Exchange Server vulnerabilities/ —
2021-03-25 - CVE-2021-26855- Microsoft Exchange Server-Side Request Forgery/ —
2021-03-25 - Evil Corp switches to Hades ransomware to evade sanctions/ —
2021-03-25 - Insurance giant CNA hit by new Phoenix CryptoLocker ransomware/ —
2021-03-25 - Perkiler malware turns to SMB brute force to spread/ —
2021-03-25 - Web Shell Threat Hunting with Azure Sentinel/ —
2021-03-26 - 20 Million Miners- Finding Malicious Cryptojacking Images in Docker Hub/ —
2021-03-26 - Alleged Members of Egregor Ransomware Cartel Arrested/ —
2021-03-26 - China’s “Winnti” Spyder Module/ —
2021-03-26 - Google Shuts Down Western Active Counter-Terrorism Operation/ —
2021-03-26 - Google’s top security teams unilaterally shut down a counterterrorism operation/ —
2021-03-26 - Imperva Observes Hive of Activity Following Hafnium Microsoft Exchange Disclosures/ —
2021-03-26 - It's getting hot in here! Unknown threat group using Hades ransomware to turn up the heat on their victims/ —
2021-03-26 - Ransomware gang urges victims’ customers to demand a ransom payment/ —
2021-03-26 - Russian group -Ghostwriters- apparently attacked parliamentarians/ —
2021-03-26 - Securing our approach to domain fronting within Azure/ —
2021-03-26 - Threat Assessment Matrix Ransomware/ —
2021-03-27 - Malware Analysis with elastic-agent and Microsoft Sandbox/ —
2021-03-27 - Terraloader- Congrats, you have a new fake job!/ —
2021-03-28 - No, I Did Not Hack Your MS Exchange Server/ —
2021-03-28 - SunCrypt, PowerShell obfuscation, shellcode and more yara/ —
2021-03-29 - Android-Flubot- preparing for a new campaign-/ —
2021-03-29 - AP sources- SolarWinds hack got emails of top DHS officials/ —
2021-03-29 - Jumping into Shellcode/ —
2021-03-29 - Malspam Campaign Delivers Burkina Trojan/ —
2021-03-29 - New ICS Threat Activity Group- STIBNITE/ —
2021-03-29 - RedEcho group parks domains after public exposure/ —
2021-03-29 - Sg- Vhive alerts consumers to cyberattack/ —
2021-03-29 - Sodinokibi (aka REvil) Ransomware/ —
2021-03-29 - The Unseen One- Hades Ransomware Gang or Hafnium/ —
2021-03-29 - Zloader email campaign using MHTML to download and decrypt XLS/ —
2021-03-30 - APT10 - sophisticated multi-layered loader Ecipekac discovered in A41APT campaign/ —
2021-03-30 - Ares Malware- The Grandson of the Kronos Banking Trojan/ —
2021-03-30 - BadBlood - TA453/ —
2021-03-30 - BadBlood- TA453 Targets US and Israeli Medical Research Personnel in Credential Phishing Campaigns/ —
2021-03-30 - Campo Loader - Simple but effective/ —
2021-03-31 - Attack of the -chaos troops- (Ghostwriter)/ —
2021-03-31 - Back in a Bit- Attacker Use of the Windows Background Intelligent Transfer Service/ —
2021-03-31 - Bahamut Possibly Responsible for Multi-Stage Infection Chain Campaign/ —
2021-03-31 - Dissecting a RAT. Analysis of the AndroRAT/ —
2021-03-31 - Financial Cyberthreats in 2020/ —
2021-03-31 - IcedID Command and Control Infrastructure/ —
2021-03-31 - Quick Analysis of a Modular InfoStealer/ —
2021-03-31 - Sophos MTR in Real Time- What is Astro Locker Team-/ —
2021-03-31 - Update on campaign targeting security researchers/ —
2021-04-01 - Automating threat actor tracking- Understanding attacker behavior for intelligence and contextual alerting/ —
2021-04-01 - Avaddon RaaS - Breaks Public Decryptor, Continues On Rampage/ —
2021-04-01 - Code Reuse Across Packers and DLL Loaders/ —
2021-04-01 - COVID-19 Phishing With a Side of Cobalt Strike/ —
2021-04-01 - Cybereason vs. DarkSide Ransomware/ —
2021-04-01 - Hancitor’s Use of Cobalt Strike and a Noisy Network Ping Tool/ —
2021-04-01 - Wireshark Tutorial- Decrypting RDP Traffic/ —
2021-04-02 - A “txt file” can steal all your secrets/ —
2021-04-02 - Browser lockers- extortion disguised as a fine/ —
2021-04-02 - The cesspool of the internet is to be found in a village in North Holland/ —
2021-04-02 - The “Fair” Upgrade Variant of Phobos Ransomware/ —
2021-04-03 - Hubnr Botnet/ —
2021-04-03 - SG- Vhive attackers escalate, take control of furniture retailer’s email server/ —
2021-04-04 - Technical report of AgentTesla/ —
2021-04-05 - 2020 Phishing Trends With PDF Files/ —
2021-04-05 - CruLoader Analysis/ —
2021-04-05 - From PowerShell to Payload- An Analysis of Weaponized Malware/ —
2021-04-05 - Hackers Spearphish Professionals on LinkedIn with Fake Job Offers, Infecting them with Malware, Warns eSentire/ —
2021-04-05 - Kremlin RATs from Nigeria/ —
2021-04-05 - The leap of a Cycldek-related threat actor/ —
2021-04-05 - Thwarting Loaders- From SocGholish to BLISTER’s LockBit Payload/ —
2021-04-05 - TrickBot Crews New CobaltStrike Loader/ —
2021-04-06 - A deep dive into Saint Bot, a new downloader/ —
2021-04-06 - Aurora campaign- Attacking Azerbaijan using multiple RATs/ —
2021-04-06 - Dridex Loader Analysis/ —
2021-04-06 - EtterSilent the undergrounds new favorite maldoc builder/ —
2021-04-06 - Github Repository- RATel/ —
2021-04-06 - Janeleiro, the time traveler- A new old banking trojan in Brazil/ —
2021-04-06 - Malicious Cyber Activity Targeting Critical SAP Applications/ —
2021-04-06 - Malspam with Lokibot vs. Outlook and RFCs/ —
2021-04-06 - Rocke Group Actively Targeting the Cloud- Wants Your SSH Keys/ —
2021-04-06 - Threat Group Uses Voice Changing Software in Espionage Attempt/ —
2021-04-07 - IcedID - A New Threat In Office Attachments/ —
2021-04-07 - IcedID campaign spotted being spiced with Excel 4 Macros/ —
2021-04-07 - New Wormable Android Malware Spreads by Creating Auto-Replies to Messages in WhatsApp/ —
2021-04-07 - Ransom Mafia - Analysis of the World's First Ransomware Cartel/ —
2021-04-07 - Sowing Discord- Reaping the benefits of collaboration app abuse/ —
2021-04-07 - Sowing Discord/ —
2021-04-07 - Threat Intelligence- Analysis of the SBIDIOT IoT Malware/ —
2021-04-07 - Wireshark Tutorial- Examining Traffic from Hancitor Infections/ —
2021-04-07 - Yanbian Gang Malware Continues with Wide-Scale Distribution and C2/ —
2021-04-08 - (Are you) afreight of the dark- Watch out for Vyveva, new Lazarus backdoor/ —
2021-04-08 - Attackers Conducting Cryptojacking Operation Against U.S. Education Organizations/ —
2021-04-08 - Breaking the Ice- Detecting IcedID and Cobalt Strike Beacon with Network Detection and Response (NDR)/ —
2021-04-08 - Iran’s APT34 Returns with an Updated Arsenal/ —
2021-04-08 - Sysrv Botnet Expands and Gains Persistence/ —
2021-04-08 - Vyveva - Lazarus's backdoor/ —
2021-04-09 - Detecting Exposed Cobalt Strike DNS Redirectors/ —
2021-04-09 - Dissemination of Korean document (HWP) titled inquiries related to North Korea/ —
2021-04-09 - Emotet Command and Control Case Study/ —
2021-04-09 - IcedID Analysis/ —
2021-04-09 - Investigating a unique “form” of email delivery for IcedID malware/ —
2021-04-09 - Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware/ —
2021-04-09 - Malicious code in APKPure app/ —
2021-04-11 - IcedID on my neck Im the coolest/ —
2021-04-12 - A chat with DarkSide/ —
2021-04-12 - A Different Kind of Zoombomb/ —
2021-04-12 - A Spike in BazarCall and IcedID Activity Detected in March/ —
2021-04-12 - Analysis Report (AR21-102B)- DearCry Ransomware/ —
2021-04-12 - APT SideWinder's latest attack on a certain region in South Asia/ —
2021-04-12 - Deep Analysis- New FormBook Variant Delivered in Phishing Campaign – Part I/ —
2021-04-12 - Deep water- exploring phishing kits/ —
2021-04-12 - Nitro Ransomware - Proof of Concept/ —
2021-04-12 - PaaS, or how hackers evade antivirus software/ —
2021-04-12 - Unpacking RAGNARLOCKER via emulation/ —
2021-04-13 - Alert Number I-041321-PSA- Rise In Use of Cryptocurrency In Business Email Compromise Schemes/ —
2021-04-13 - Compromised Exchange server hosting cryptojacker targeting other Exchange servers/ —
2021-04-13 - Detecting Clop Ransomware/ —
2021-04-13 - From Cracks to Empty Wallets – How Popular Cracks Lead to Digital Currency and Data Theft/ —
2021-04-13 - Hackers Flood the Web with 100,000 Malicious Pages, Promising Professionals Free Business Forms, But Delivering Malware, Reports eSentire/ —
2021-04-13 - Hackers Flood the Web with 100,000 Malicious Pages/ —
2021-04-13 - Justice Department announces court-authorized effort to disrupt exploitation of Microsoft Exchange Server vulnerabilities/ —
2021-04-13 - Keeping an eye on CloudEyE (GuLoader) - Reverse engineering the loader/ —
2021-04-13 - Malicious infrastructure as a service/ —
2021-04-13 - Moobot updates its infrastructure and targets vulnerable Tenda routers/ —
2021-04-13 - Sweden drops Russian hacking investigation due to legal complications/ —
2021-04-13 - Threat Assessment- Clop Ransomware/ —
2021-04-13 - Zero-day vulnerability in Desktop Window Manager (CVE-2021-28310) used in the wild/ —
2021-04-14 - A look at HydroJiin campaign/ —
2021-04-14 - An Update- The COVID-19 Vaccine’s Global Cold Chain Continues to Be a Target/ —
2021-04-14 - April 2021 Forensic Quiz- Answers and Analysis/ —
2021-04-14 - From PoC to Exploit Kit- Purple Fox now exploits CVE-2021-26411/ —
2021-04-14 - Lazarus BTC Changer Back in action with JS sniffers redesigned to steal crypto/ —
2021-04-14 - Meet The Ransomware Gang Behind One of the Biggest Supply Chain Hacks Ever/ —
2021-04-15 - A Letter on Blocking Property with Respect to Specified Harmful Foreign Activities of the Government of the Russian Federation/ —
2021-04-15 - Actor Exploits Microsoft Exchange Server Vulnerabilities, Cortex XDR Blocks Harvesting of Credentials/ —
2021-04-15 - BazarLoader deploys a pair of novel spam vectors/ —
2021-04-15 - Declaration by the High Representative on behalf of the European Union expressing solidarity with the United States on the impact of the SolarWinds cyber operation/ —
2021-04-15 - Executive Order on Blocking Property with Respect to Specified Harmful Foreign Activities of the Government of the Russian Federation/ —
2021-04-15 - Exploit Kit still sharpens a sword/ —
2021-04-15 - FACT SHEET- Imposing Costs for Harmful Foreign Activities by the Russian Government/ —
2021-04-15 - HackBoss- A cryptocurrency-stealing malware distributed through Telegram/ —
2021-04-15 - Holding Russia To Account/ —
2021-04-15 - Malware Analysis Report (AR21-105A)- SUNSHUTTLE/ —
2021-04-15 - Mirai code re-use in Gafgyt/ —
2021-04-15 - North Atlantic Council Statement following the announcement by the United States of actions with regard to Russia/ —
2021-04-15 - Russia- UK and US expose global campaign of malign activity by Russian intelligence services/ —
2021-04-15 - Russia- UK exposes Russian involvement in SolarWinds cyber compromise/ —
2021-04-15 - Statement on Solar Winds Orion cyberattacks/ —
2021-04-15 - Statement on SolarWinds Cyber Compromise/ —
2021-04-15 - The $1 billion Russian cyber company that the US says hacks for Moscow/ —
2021-04-15 - The rise of QakBot/ —
2021-04-15 - Threat Actors Pair Tax-Themed Lures With COVID-19, Healthcare Themes/ —
2021-04-15 - Treasury Escalates Sanctions Against the Russian Government’s Attempts to Influence U.S. Elections/ —
2021-04-15 - Treasury Sanctions Russia with Sweeping New Sanctions Authority/ —
2021-04-15 - Treasury Sanctions Russian Persons in the Crimea Region of Ukraine/ —
2021-04-15 - U.S. Puts Fresh Sanctions on Russia Over Hacking, Election Interference/ —
2021-04-16 - A 'Worst Nightmare' Cyberattack- The Untold Story Of The SolarWinds Hack/ —
2021-04-16 - A Worst Nightmare Cyberattack - The Untold Story Of The SolarWinds Hack/ —
2021-04-16 - Combating Sleeper Threats With MTTD/ —
2021-04-16 - Could the Microsoft Exchange breach be stopped-/ —
2021-04-16 - FIN7 'technical guru' sentenced to 10 years in prison/ —
2021-04-16 - High-level organizer of notorious hacking group FIN7 sentenced to ten years in prison for scheme that compromised tens of millions of debit and credit cards/ —
2021-04-16 - How the Kremlin provides a safe harbor for ransomware/ —
2021-04-16 - Ransomware micro-criminals are still out here (and growing)/ —
2021-04-16 - Russia’s Cyber Operations Groups/ —
2021-04-16 - Sanctioned Firm Accused of Helping Russian Intelligence Was Part of Microsoft’s Early Vuln Access Program — MAPP/ —
2021-04-16 - Sanctioned Russian IT firm was partner with Microsoft, IBM/ —
2021-04-16 - Transparent Tribe APT Infrastructure Mapping Part 1- A High-Level Study of CrimsonRAT Infrastructure October 2020 – March 2021/ —
2021-04-16 - Unearthing Hancitor Infrastructure/ —
2021-04-16 - XCSSET Quickly Adapts to macOS 11 and M1-based Macs/ —
2021-04-17 - Adversary Dossier- Ryuk Ransomware Anatomy of an Attack in 2021/ —
2021-04-17 - SVR snaps back at Biden/ —
2021-04-18 - 1. Hacking Hollywood/ —
2021-04-18 - Discord Nitro gift codes now demanded as ransomware payments/ —
2021-04-18 - Recover your files with StrongPity/ —
2021-04-18 - US Cyber Operations Groups/ —
2021-04-19 - A Deep Dive into Zebrocy’s Dropper Docs/ —
2021-04-19 - Analysing a malware PCAP with IcedID and Cobalt Strike traffic/ —
2021-04-19 - Great Power Cyber Party/ —
2021-04-19 - How Chinas cybercrime underground is making money off big data/ —
2021-04-19 - How to analyze mobile malware- a Cabassous-FluBot Case study/ —
2021-04-19 - Hunting phishing websites with favicon hashes/ —
2021-04-19 - Inside the CIA and NSA disagreement over Russian bounties story/ —
2021-04-19 - Lazarus APT conceals malicious code within BMP image to drop its RAT/ —
2021-04-19 - PRIMITIVE BEAR (Gamaredon) Targets Ukraine with Timely Themes/ —
2021-04-19 - The Incredible Rise of North Korea’s Hacking Army/ —
2021-04-19 - Zebrocys Dropper/ —
2021-04-19 - ZLoader Returns Through Spelevo Exploit Kit & Phishing Campaign/ —
2021-04-20 - Alert (AA21-110A)- Exploitation of Pulse Connect Secure Vulnerabilities/ —
2021-04-20 - Carbanak and FIN7 Attack Techniques/ —
2021-04-20 - Check Your Pulse- Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day/ —
2021-04-20 - Chinese Cyber Operations Groups/ —
2021-04-20 - CobaltStrike Stager Utilizing Floating Point Math/ —
2021-04-20 - Fake Microsoft Store, Spotify sites spread info-stealing malware/ —
2021-04-20 - FireEye Mandiant PulseSecure Exploitation Countermeasures/ —
2021-04-20 - HabitsRAT Used to Target Linux and Windows Servers/ —
2021-04-20 - How attackers abuse Access Token Manipulation (ATT&CK T1134)/ —
2021-04-20 - Pulse Secure Zero Day/ —
2021-04-20 - REvil gang tries to extort Apple, threatens to sell stolen blueprints/ —
2021-04-20 - Transparent Tribe uses the new crown vaccine hotspot to analyze the targeted attacks on the Indian medical industry/ —
2021-04-20 - Zero-Day Exploits in SonicWall Email Security Lead to Enterprise Compromise/ —
2021-04-21 - A year of Fajan evolution and Bloomberg themed campaigns/ —
2021-04-21 - Codecov hackers breached hundreds of restricted customer sites - sources/ —
2021-04-21 - Donot Team APT Group Is Back To Using Old Malicious Patterns/ —
2021-04-21 - Logins for 1.3 million Windows RDP servers collected from hacker market/ —
2021-04-21 - Massive Qlocker ransomware attack uses 7zip to encrypt QNAP devices/ —
2021-04-21 - Monitoring Pulse Connect Secure With Splunk (CISA Emergency Directive 21-03)/ —
2021-04-21 - Nearly half of malware now use TLS to conceal communications/ —
2021-04-21 - Taking Action Against Hackers in Palestine/ —
2021-04-21 - ZLoader Dominates Email Payloads in Q1/ —
2021-04-22 - A gentle introduction to building a threat intelligence team/ —
2021-04-22 - An Undersea Royal Road- Exploring Malicious Documents and Associated Malware/ —
2021-04-22 - AR21-112A- CISA Identifies SUPERNOVA Malware During Incident Response/ —
2021-04-22 - Binary Data Hiding in VB6 Executables/ —
2021-04-22 - Deep Analysis- FormBook New Variant Delivered in Phishing Campaign – Part II/ —
2021-04-22 - Der Mann in Merkels Rechner - Jagd auf Putins Hacker/ —
2021-04-22 - EMOTET- a State-Machine reversing exercise/ —
2021-04-22 - Nightmare week for security vendors- Now a Trend Micro bug is being exploited in the wild/ —
2021-04-22 - Prometei Botnet Exploiting Microsoft Exchange Vulnerabilities/ —
2021-04-22 - Ransomware gang wants to short the stock price of their victims/ —
2021-04-22 - SUPERNOVA Redux, with a Generous Portion of Masquerading/ —
2021-04-22 - Sysrv-Hello Expands Infrastructure/ —
2021-04-22 - Tor-Based Botnet Malware Targets Linux Systems, Abuses Cloud Management Tools/ —
2021-04-22 - Turning Telegram toxic- ‘ToxicEye’ RAT is the latest to use Telegram for command & control/ —
2021-04-23 - Analysis of the CardingMafia March 2021 data breach/ —
2021-04-23 - APT35 ‘Charming Kitten' discovered in a pre-infected environment/ —
2021-04-23 - Axis of REvil- What we know about the hacker collective taunting Apple/ —
2021-04-23 - Charming Kitten discovered in a pre-infected environment/ —
2021-04-23 - NAIKON - Traces from a Military Cyber-Espionage Operation/ —
2021-04-23 - Russia's Disinformation Ecosystem - A Snapshot/ —
2021-04-23 - Supply chain attack on the password manager Clickstudios - PASSWORDSTATE/ —
2021-04-24 - A ransomware gang made $260,000 in 5 days using the 7zip utility/ —
2021-04-24 - Anatomy of a simple and popular packer/ —
2021-04-24 - HashiCorp is the latest victim of Codecov supply-chain attack/ —
2021-04-24 - Initial analysis of PasswordState supply chain attack backdoor code/ —
2021-04-24 - North Korea (DPRK) Cyber Operations Groups/ —
2021-04-25 - 2. Disaster movie/ —
2021-04-25 - Hacking campaign targets FileZen file-sharing network appliances/ —
2021-04-25 - Ransomware and Data Leak Site Publication Time Analysis/ —
2021-04-25 - Supply Chain Attacks via GitHub.com Releases/ —
2021-04-25 - VPN Hacks Are a Slow-Motion Disaster/ —
2021-04-26 - All Your Macs Are Belong To Us- bypassing macOS's file quarantine, gatekeeper, and notarization requirements/ —
2021-04-26 - Anatomy of Cobalt Strike’s DLL Stager/ —
2021-04-26 - Despite arrests in Spain, FluBot operations explode across Europe and Japan/ —
2021-04-26 - Linux Servers Hijacked to Implant SSH Backdoor/ —
2021-04-26 - New ICS Threat Activity Group- TALONITE/ —
2021-04-26 - Ransomware Attack Vectors Shift as New Software Vulnerability Exploits Abound/ —
2021-04-26 - Shlayer malware abusing Gatekeeper bypass on macOS/ —
2021-04-26 - The cybercriminal underground hasnt forgotten about financial services/ —
2021-04-27 - 'Cock.li' Admin Says He’s Not Surprised Russian Intelligence Uses His Site/ —
2021-04-27 - Abusing Replication- Stealing AD FS Secrets Over the Network/ —
2021-04-27 - APT trends report Q1 2021/ —
2021-04-27 - FluBot Android Malware Spreading Rapidly Through Europe, May Hit U.S. Soon/ —
2021-04-27 - How law enforcement can stay a step ahead of hackers/ —
2021-04-27 - Lazarus Group Recruitment - Threat Hunters vs Head Hunters/ —
2021-04-27 - Ransomware Preparedness- A Call to Action/ —
2021-04-27 - RedLine Stealer Masquerades as Telegram Installer/ —
2021-04-27 - Winter Vivern- A Look At Re-Crafted Government MalDocs Targeting Multiple Languages/ —
2021-04-28 - Cyberspies target military organizations with new Nebulae backdoor/ —
2021-04-28 - EU Cyber Operations Groups/ —
2021-04-28 - QBot Malware Spotted Using Windows Defender Antivirus Lure/ —
2021-04-28 - RotaJakiro- A long live secret backdoor with 0 VT detection/ —
2021-04-28 - Spotting malicious Excel4 macros/ —
2021-04-28 - The Rage of Android Banking Trojans/ —
2021-04-28 - The Sodinokibi Chronicles- A (R)Evil Cybercrime Gang Disrupts Organizations for Trade Secrets and Cash/ —
2021-04-28 - UK rail network Merseyrail likely hit by Lockbit ransomware/ —
2021-04-28 - Un sospetto attacco telematico blocca le filiali della Bcc di Roma/ —
2021-04-28 - UNC1151 Likely Conducts Ghostwriter Influence Activity/ —
2021-04-28 - VB6 P-Code Obfuscation/ —
2021-04-28 - Water Pamola Attacked Online Shops Via Malicious Orders/ —
2021-04-29 - Chimera APT updates on its OwlProxy malware/ —
2021-04-29 - Chinese Cyberspies Target Military Organizations in Asia With New Malware/ —
2021-04-29 - CISA Identifies SUPERNOVA Malware During Incident Response/ —
2021-04-29 - DomainTools And Digital Archeology- A Look At RotaJakiro/ —
2021-04-29 - Information Gathering as a Researcher- a use case/ —
2021-04-29 - Investigating TA413 Threat Actor Group Using OpenCTI in Maltego/ —
2021-04-29 - Leaping Down a Rabbit Hole of Fraud and Misdirection/ —
2021-04-29 - New Shameless Commodity Cryptocurrency Stealer (WeSteal) and Commodity RAT (WeControl)/ —
2021-04-29 - QNAP warns of AgeLocker ransomware attacks against NAS devices/ —
2021-04-29 - Saving World Health Day- UNICC and Group-IB Take Down Scam Campaign Impersonating the World Health Organization/ —
2021-04-29 - The Story of FakeChat/ —
2021-04-29 - Threat Alert- New update from Sysrv-hello, now infecting victims‘ webpages to push malicious exe to end users/ —
2021-04-29 - Udało nam się zrealizować wywiad z grupą ransomware (Babuk), która zaszyfrowała policję metropolitarną w Waszyngtonie/ —
2021-04-29 - UNC2447 SOMBRAT and FIVEHANDS Ransomware- A Sophisticated Financial Threat/ —
2021-04-29 - Whistler resort municipality hit by new ransomware operation/ —
2021-04-30 - A Second Iranian State-Sponsored Ransomware Operation “Project Signal” Emerges/ —
2021-04-30 - Cybercrime Featured DarkPath scam group loses 134 domains impersonating the WHO/ —
2021-04-30 - Detecting network beacons via KQL using simple spread stats functions/ —
2021-04-30 - How Cybercriminals Abuse OpenBullet for Credential Stuffing/ —
2021-04-30 - Qbot- Analyzing PHP Proxy Scripts from Compromised Web Server/ —
2021-04-30 - Transparent Tribe Operating with a New Variant of Crimson RAT/ —
2021-05-01 - Attributing Attacks Against Crypto Exchanges to LAZARUS/ —
2021-05-01 - Guy's 30 Reverse Engineering Tips & Tricks/ —
2021-05-01 - Muddywater- Binder Project/ —
2021-05-02 - 3. Superdollars/ —
2021-05-02 - DOJ hiring new liaison prosecutor to hunt cybercriminals in Eastern Europe/ —
2021-05-02 - Mobile Malware App Anubis Strikes Again, Continues to Lure Users Disguised as a Fake Antivirus/ —
2021-05-02 - Sodinokibi Ransomware Analysis/ —
2021-05-02 - Trickbot Brief- Creds and Beacons/ —
2021-05-03 - Apple fixes 2 iOS zero-day vulnerabilities actively used in attacks/ —
2021-05-03 - BuerLoader Updates/ —
2021-05-03 - Clop Ransomware Detection- Threat Research Release, April 2021/ —
2021-05-03 - Exploitation of data breaches for executive protection/ —
2021-05-03 - N3TW0RM ransomware emerges in wave of cyberattacks in Israel/ —
2021-05-03 - New Variant of Buer Loader Written in Rust/ —
2021-05-03 - Rewterz Threat Alert – Financially Motivated Aggressive Group Carrying Out Ransomware Campaigns – Active IOCs/ —
2021-05-03 - Spearphishing Attack Uses COVID-21 Lure to Target Ukrainian Government/ —
2021-05-03 - Tween on new RaaS Galaxy Ransomware/ —
2021-05-04 - A taste of the latest release of QakBot/ —
2021-05-04 - Alien Mobile Malware Evades Detection, Increases Targets/ —
2021-05-04 - Cr4sh - MicroBackdoor - Small and convenient C2 tool for Windows targets/ —
2021-05-04 - Detecting Lateral Movement via WinRM Using KQL/ —
2021-05-04 - Grab your own copy of Phenakite iOS malware today/ —
2021-05-04 - New Panda Stealer Targets Cryptocurrency Wallets/ —
2021-05-04 - Pingback- Backdoor At The End Of The ICMP Tunnel/ —
2021-05-04 - RM3 – Curiosities of the wildest banking malware/ —
2021-05-04 - The UNC2529 Triple Double- A Trifecta Phishing Campaign/ —
2021-05-04 - Transferring leverage in a ransomware attack/ —
2021-05-05 - Are The Notorious Cyber Criminals Evil Corp actually Russian Spies-/ —
2021-05-05 - Catching RATs Over Custom Protocols Analysis of top non-HTTP-S threats/ —
2021-05-05 - China’s PLA Unit 61419 Purchasing Foreign Antivirus Products, Likely for Exploitation/ —
2021-05-05 - Flubot vs. Zimperium/ —
2021-05-05 - Intervention halts a ProxyLogon-enabled attack/ —
2021-05-05 - Joker/ —
2021-05-05 - Malware group leaks millions of stolen authentication cookies/ —
2021-05-05 - Multi-Factor Authentication- Headache for Cyber Actors Inspires New Attack Techniques/ —
2021-05-05 - Ousaban- Private photo collection hidden in a CABinet/ —
2021-05-05 - Roaming Mantis Amplifies Smishing Campaign with OS-Specific Android Malware/ —
2021-05-05 - Smishing campaign in NL spreading Cabassous and Anatsa/ —
2021-05-05 - VB6 P-Code Disassembly/ —
2021-05-06 - An APT with no name/ —
2021-05-06 - Analysis Report- FiveHands Ransomware/ —
2021-05-06 - Darkside Ransomware/ —
2021-05-06 - GrelosGTM group abuses Google Tag Manager to attack e-commerce websites/ —
2021-05-06 - How China turned a prize-winning iPhone hack against the Uyghurs/ —
2021-05-06 - Iran Cyber Operations Groups/ —
2021-05-06 - MAR-10324784-1.v1- FiveHands Ransomware/ —
2021-05-06 - MTR in Real Time- Pirates pave way for Ryuk ransomware/ —
2021-05-06 - Operation TunnelSnake/ —
2021-05-06 - Proxylogon- A Coinminer, a Ransomware, and a Botnet Join the Party/ —
2021-05-06 - Ransomware- Hunting for Inhibiting System Backup or Recovery/ —
2021-05-06 - RotaJakiro, the Linux version of the OceanLotus/ —
2021-05-06 - Threat Thursday- Dr. REvil Ransomware Strikes Again, Employs Double Extortion Tactics/ —
2021-05-07 - An In-Depth analysis of the new Taurus Stealer/ —
2021-05-07 - An Investigative Update of the Cyberattack/ —
2021-05-07 - Connecting the Bots Hancitor fuels Cuba Ransomware Operations/ —
2021-05-07 - Data leak marketplaces aim to take over the extortion economy/ —
2021-05-07 - Four Individuals Plead Guilty to RICO Conspiracy Involving “Bulletproof Hosting” for Cybercriminals/ —
2021-05-07 - Further TTPs associated with SVR cyber actors/ —
2021-05-07 - Human operated ransomware/ —
2021-05-07 - Lemon Duck spreads its wings- Actors target Microsoft Exchange servers, incorporate new TTPs/ —
2021-05-07 - MuddyWater- Binder Project (Part 2)/ —
2021-05-07 - New Lemon Duck variants exploiting Microsoft Exchange Server/ —
2021-05-07 - Revealing the Snip3 Crypter a Highly Evasive RAT Loader/ —
2021-05-07 - Revealing the ‘Snip3’ Crypter, a Highly Evasive RAT Loader/ —
2021-05-07 - Stats from Hunting Cobalt Strike Beacons/ —
2021-05-08 - Cyber attack shuts down top U.S. fuel pipeline network/ —
2021-05-08 - SolarWinds says fewer than 100 customers were impacted by supply chain attack/ —
2021-05-08 - When Karma Comes Back- The rise and fall of illicit cardshop breached twice in two years/ —
2021-05-10 - Analysis of U.S. Oil Products Pipeline Operators Suspended by Ransomware Attacks/ —
2021-05-10 - APT Threat Landscape of Taiwan in 2020/ —
2021-05-10 - City of Tulsa's online services disrupted in ransomware incident/ —
2021-05-10 - Cobaltstrike-Beacons analyzed/ —
2021-05-10 - Dissecting a RAT. Analysis of the HawkShaw/ —
2021-05-10 - Heres what we know about DarkSide ransomware/ —
2021-05-10 - How one of the largest hacker networks in the world was paralyzed/ —
2021-05-10 - IcedID Malware Technical Analysis Report/ —
2021-05-10 - Intelligence Report on Ransomware Gangs on the DarkWeb- List of victim organizations attacked by ransomware gangs released on the DarkWeb/ —
2021-05-10 - Meet DarkSide and Their Ransomware – SentinelOne Customers Protected/ —
2021-05-10 - Overview of Campo, a new attack campaign targeting Japan/ —
2021-05-10 - Prelude to Ransomware- SystemBC/ —
2021-05-10 - Prometheus Ransomware Haron Ransomware/ —
2021-05-10 - Rise of the Chief Intelligence Officer (CINO)/ —
2021-05-10 - Russian spy unit suspected of directed-energy attacks on U.S. personnel/ —
2021-05-10 - Shedding Light on the DarkSide Ransomware Attack/ —
2021-05-10 - TeaBot- a new Android malware emerged in Italy, targets banks in Europe/ —
2021-05-11 - 15% of 2020 ransomware payments carried a sanctions violations risk/ —
2021-05-11 - A Closer Look at the DarkSide Ransomware Gang/ —
2021-05-11 - A defender’s view inside a DarkSide ransomware attack/ —
2021-05-11 - Alert (AA21-131A) DarkSide Ransomware- Best Practices for Preventing Business Disruption from Ransomware Attacks/ —
2021-05-11 - Analysis of a series of attacks by the suspected Lazarus organization using Daewoo Shipyard as relevant bait/ —
2021-05-11 - Android overlay attacks on Belgian financial applications/ —
2021-05-11 - Campo, a New Attack Campaign Targeting Japan/ —
2021-05-11 - DarkSide Ransomware Links to REvil Group Difficult to Dismiss/ —
2021-05-11 - Osiris banking trojan shuts down as new Ares variant emerges/ —
2021-05-11 - Quick analysis note about DealPly (Adware)/ —
2021-05-11 - Reasonable IR Team Expectations/ —
2021-05-11 - Recommendations Following the Colonial Pipeline Cyber Attack/ —
2021-05-11 - Response When Minutes Matter- Rising Up Against Ransomware/ —
2021-05-11 - Shining a Light on DARKSIDE Ransomware Operations/ —
2021-05-11 - The DarkSide of the Ransomware Pipeline/ —
2021-05-11 - Threat Bulletin- Exploring the Differences and Similarities of Agent Tesla v2 & v3/ —
2021-05-12 - Agents raid home of Kansas man seeking info on botnet that infected DOD network/ —
2021-05-12 - Anatomy of a $2 Million Darkside Ransomware Breach/ —
2021-05-12 - Conti Ransomware/ —
2021-05-12 - DarkSide Ransomware Gang- An Overview/ —
2021-05-12 - Encrypted Chat Apps Doubling as Illegal Marketplaces/ —
2021-05-12 - Executive Order on Improving the Nation’s Cybersecurity/ —
2021-05-12 - Incident response playbooks/ —
2021-05-12 - Nefilim Ransomware/ —
2021-05-12 - New Evidence Supports Assessment that DarkSide Likely Responsible for Colonial Pipeline Ransomware Attack; Others Targeted/ —
2021-05-12 - Ransomware world in 2021- who, how and why/ —
2021-05-12 - What We Know About Darkside Ransomware and the US Pipeline Attack/ —
2021-05-12 - Writing a VB6 P-Code Debugger/ —
2021-05-13 - 'Don't panic,' Biden tells Americans facing gasoline shortages from pipeline attack/ —
2021-05-13 - APT attack for domestic companies using library files/ —
2021-05-13 - Catching the White Stork in Flight/ —
2021-05-13 - Chemical distributor pays $4.4 million to DarkSide ransomware/ —
2021-05-13 - Colonial Pipeline Paid Hackers Nearly $5 Million in Ransom/ —
2021-05-13 - Domain Blooms- Identifying Domain Name Themes Targeted By Threat Actors/ —
2021-05-13 - Meet Lorenz — A new ransomware gang targeting the enterprise/ —
2021-05-13 - Mind the (Air) Gap/ —
2021-05-13 - Newly observed PHP-based skimmer shows ongoing Magecart Group 12 activity/ —
2021-05-13 - Popular hacking forum bans ransomware ads/ —
2021-05-13 - Popular Russian hacking forum XSS bans all ransomware topics/ —
2021-05-13 - Ransomware Groups Use Tor-Based Backdoor for Persistent Access/ —
2021-05-13 - Threat Actors Use MSBuild to Deliver RATs Filelessly/ —
2021-05-13 - Threat Thursday- SombRAT — Always Leave Yourself a Backdoor/ —
2021-05-13 - Transparent Tribe APT expands its Windows malware arsenal/ —
2021-05-13 - Who is Mr. Zhao-/ —
2021-05-14 - AHK RAT Loader Used in Unique Delivery Campaigns/ —
2021-05-14 - Analysis Report (AR21-134A)- Eviction Guidance for Networks Affected by the SolarWinds and Active Directory-M365 Compromise/ —
2021-05-14 - DarkSide Ransomware Gang Quits After Servers, Bitcoin Stash Seized/ —
2021-05-14 - Darkside ransomware gang says it lost control of its servers & money a day after Biden threat/ —
2021-05-14 - DarkSide Ransomware Operations - Preventions and Detections/ —
2021-05-14 - DarkSide ransomware servers reportedly seized, REvil restricts targets/ —
2021-05-14 - Darkside Ransomware Victims Sold Short/ —
2021-05-14 - Elliptic Follows the Bitcoin Ransoms Paid by Colonial Pipeline and Other DarkSide Ransomware Victims/ —
2021-05-14 - From Dawn to -Silent Night-- -DarkSide Ransomware- Initial Attack Vector Evolution/ —
2021-05-14 - How Flubot targets Android phone users and their money/ —
2021-05-14 - QNAP warns of eCh0raix ransomware attacks, Roon Server zero-day/ —
2021-05-14 - Slides & Recordings for Mobile security trainings/ —
2021-05-14 - The moral underground Ransomware operators retreat after Colonial Pipeline hack/ —
2021-05-16 - HSE Conti 40521 UPDATE/ —
2021-05-16 - Japan lashes out against alleged Chinese military cyberattacks/ —
2021-05-17 - Analysis of NoCry- A variant of the Judge ransomware/ —
2021-05-17 - Bizarro banking Trojan expands its attacks to Europe/ —
2021-05-17 - Case Study- Incident Response is a relationship-driven business/ —
2021-05-17 - DarkSide Ransomware- Splunk Threat Update and Detections/ —
2021-05-17 - Discovery of Simps Botnet Leads To Ties to Keksec Group/ —
2021-05-17 - Icedid Analysis/ —
2021-05-17 - Investigating the Watering Hole Linked to the Oldsmar Water Treatment Facility Breach/ —
2021-05-17 - Let’s set ice on fire- Hunting and detecting IcedID infections/ —
2021-05-17 - Literature lover targeting Colombia with LimeRAT/ —
2021-05-17 - Mustang Panda PlugX - 45.251.240.55 Pivot/ —
2021-05-17 - Newly Discovered Function in DarkSide Ransomware Variant Targets Disk Partitions/ —
2021-05-17 - Three major hacking forums ban ransomware ads as some ransomware gangs shut down/ —
2021-05-17 - Tracking DarkSide and Ransomware- The Network View/ —
2021-05-17 - VMProtect 2 - Detailed Analysis of the Virtual Machine Architecture/ —
2021-05-17 - W3 May - EN - Story of the week- Code Signing Certificate on the Darkweb/ —
2021-05-18 - A native packer for Android-MoqHao/ —
2021-05-18 - An Encounter With TA551-Shathak/ —
2021-05-18 - Analysis of MountLocker/ —
2021-05-18 - Darkside gang estimated to have made over $90 million from ransomware attacks/ —
2021-05-18 - DarkSide Goes Dark- How CrowdStrike Falcon Customers Were Protected/ —
2021-05-18 - DarkSide Ransomware Behavior and Techniques/ —
2021-05-18 - DarkSide Ransomware has Netted Over $90 million in Bitcoin/ —
2021-05-18 - DarkSide ransomware made $90 million in just nine months/ —
2021-05-18 - Examining Russian-language Cybercriminal Marketplaces/ —
2021-05-18 - ProblemChild- Detecting living-off-the-land attacks using the Elastic Stack/ —
2021-05-18 - Strong ARMing with MacOS- Adventures in Cross-Platform Emulation/ —
2021-05-18 - TeamTNT’s Extended Credential Harvester Targets Cloud Services, Other Software/ —
2021-05-18 - The Active Adversary Playbook 2021/ —
2021-05-19 - Aanhouding in onderzoek naar cybercrime/ —
2021-05-19 - BazarCall- Call Centers Help Spread BazarLoader Malware/ —
2021-05-19 - Binary Reuse of VB6 P-Code Functions/ —
2021-05-19 - Colonial Pipeline CEO Tells Why He Paid Hackers a $4.4 Million Ransom/ —
2021-05-19 - Colonial Pipeline Ransomware Attack- Revealing How DarkSide Works/ —
2021-05-19 - Look how many cybercriminals love Cobalt Strike/ —
2021-05-19 - May Android security updates patch 4 zero-days exploited in the wild/ —
2021-05-19 - Python stealer distribution via excel maldoc/ —
2021-05-19 - Qlocker ransomware shuts down after extorting hundreds of QNAP users/ —
2021-05-19 - SolarWinds CEO apologizes for blaming an intern, says attack may have started in January 2019/ —
2021-05-19 - Tracking BokBot Infrastructure Mapping a Vast and Currently Active BokBot Network/ —
2021-05-20 - Caught in the Cloud - How a Monero Cryptominer Exploits Docker Containers/ —
2021-05-20 - Microsoft 365 Defender Hunting Queries for hunting multiple threat actors' TTPs and malwares/ —
2021-05-20 - Phorpiex morphs- How a longstanding botnet persists and thrives in the current threat environment/ —
2021-05-20 - Ransomware-as-a-Service, Rogue Affiliates, and What’s Next/ —
2021-05-20 - Response When Minutes Matter- When Good Tools Are Used for (R)Evil/ —
2021-05-20 - The Full Story of the Stunning RSA Hack Can Finally Be Told/ —
2021-05-21 - DarkSide affiliates claim gang's bitcoins in deposit on hacker forum/ —
2021-05-21 - DarkSide’s Targeted Ransomware Analysis Report for Critical U.S. Infrastructure/ —
2021-05-21 - FSB NKTsKI- Foreign ‘cyber mercenaries’ breached Russian federal agencies/ —
2021-05-21 - Leveraging Microsoft Teams to persist and cover up Cobalt Strike traffic/ —
2021-05-21 - Targeted attack by 'Cobalt Strike loader' that exploits Microsoft's digital signature-Attacker group APT41/ —
2021-05-23 - MountLocker Ransomware/ —
2021-05-24 - [RE022] Part 1- Quick analysis of malicious sample forging the official dispatch of the Central Inspection Committee/ —
2021-05-24 - SCOTCH- A framework for rapidly assessing influence operations/ —
2021-05-24 - The Colonial pipeline ransomware hackers had a secret weapon- self-promoting cybersecurity firms/ —
2021-05-24 - Tracking StrongPity with Yara/ —
2021-05-24 - Vidar Info-Stealer Abusing Game Platform/ —
2021-05-24 - Zero-Day TCC bypass discovered in XCSSET malware/ —
2021-05-25 - Agrius - From Wiper to Ransomware/ —
2021-05-25 - Cobalt Strikes Again- An Analysis of Obfuscated Malware/ —
2021-05-25 - Crimes of Opportunity- Increasing Frequency of Low Sophistication Operational Technology Compromises/ —
2021-05-25 - Evolution of JSWorm ransomware/ —
2021-05-25 - Indicators Over Cocktails- Exporting Indicators from Iris (UNC1151)/ —
2021-05-25 - TeamTNT Targets Kubernetes, Nearly 50,000 IPs Compromised in Worm-like Attack/ —
2021-05-25 - W4 May - EN - Story of the week- Ransomware on the Darkweb/ —
2021-05-26 - A Deep Dive into Packing Software CryptOne/ —
2021-05-26 - Belgium uproots cyber-espionage campaign with suspected ties to China/ —
2021-05-26 - Elizabethan England has nothing on modern-day Russia/ —
2021-05-26 - Melting Ice – Tracking IcedID Servers with a few simple steps/ —
2021-05-26 - New Version of Kido (Conficker) (Kaspersky Lab)/ —
2021-05-26 - PSChain/ —
2021-05-27 - Another Nobelium Cyberattack/ —
2021-05-27 - Apostle Ransomware Analysis/ —
2021-05-27 - Attacks Embedding XMRig on Compromised Servers/ —
2021-05-27 - Financial spear-phishing campaigns pushing RATs/ —
2021-05-27 - Mustang Panda PlugX - Reused Mutex and Folder Found in the Extracted Config/ —
2021-05-27 - New sophisticated email-based attack from NOBELIUM/ —
2021-05-27 - Re-Checking Your Pulse- Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices/ —
2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/ —
2021-05-27 - Trapping A Fat Quasar RAT/ —
2021-05-27 - Uyghurs, a Turkic ethnic minority in China, targeted via fake foundations - Check Point Research/ —
2021-05-28 - A new ransomware enters the fray- Epsilon Red/ —
2021-05-28 - Alert (AA21-148A)- Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs/ —
2021-05-28 - Breaking down NOBELIUM’s latest early-stage toolset/ —
2021-05-28 - DarkSide on Linux- Virtual Machines Targeted/ —
2021-05-28 - Deep Analysis of Vidar Stealer/ —
2021-05-28 - Malware Analysis Report (AR21-148A)- Cobalt Strike Beacon/ —
2021-05-28 - WooCommerce Credit Card Skimmer Hides in Plain Sight/ —
2021-05-30 - Defend and deter/ —
2021-05-31 - Babuk re-organizes as Payload Bin, offers its first leak/ —
2021-05-31 - Hacker Lexicon- What Is a Supply Chain Attack-/ —
2021-06-01 - A Contrarian View on SolarWinds/ —
2021-06-01 - Backdoors, RATs, Loaders evasion techniques/ —
2021-06-01 - Critical 0-day in Fancy Product Designer Under Active Attack/ —
2021-06-01 - Critical WordPress plugin zero-day under active exploitation/ —
2021-06-01 - Detecting Initial Access- HTML Smuggling and ISO Images — Part 1/ —
2021-06-01 - Detecting Initial Access- HTML Smuggling and ISO Images — Part 2/ —
2021-06-01 - Dissecting a RAT. Analysis of the Command-line AndroRAT/ —
2021-06-01 - Evadere Classifications/ —
2021-06-01 - Ex-US ambassador, anti-corruption activists in Ukraine were targets of suspected Russian phishing/ —
2021-06-01 - Hex-Rays, GetProcAddress, and Malware Analysis/ —
2021-06-01 - Inside commercial malware sandboxes/ —
2021-06-01 - Justice Department Announces Court-Authorized Seizure of Domain Names Used in Furtherance of Spear-Phishing Campaign Posing as U.S. Agency for International Development/ —
2021-06-01 - Kimsuky APT continues to target South Korean government using AppleSeed backdoor/ —
2021-06-01 - New sophisticated email-based attack from NOBELIUM/ —
2021-06-01 - NobleBaron - New Poisoned Installers Could Be Used In Supply Chain Attacks/ —
2021-06-01 - PE Reflection- The King is Dead, Long Live the King/ —
2021-06-01 - Rising warning- APT organizes Lazarus Group to launch an attack on China/ —
2021-06-01 - Threat Actors Use Mockups of Popular Apps to Spread Teabot and Flubot Malware on Android/ —
2021-06-02 - AMSI bypasses remain tricks of the malware trade/ —
2021-06-02 - Analysis of Lazarus's recent targeted attacks against military industry and other industries/ —
2021-06-02 - Call for crimes- Russian-language forum runs contest for cryptocurrency hacks/ —
2021-06-02 - China-Linked Threat Group Targets Taiwan Critical Infrastructure, Smokescreen Ransomware/ —
2021-06-02 - FUJIFILM shuts down network after suspected ransomware attack/ —
2021-06-02 - Google PPC Ads Deliver Redline, Taurus, and mini-Redline Infostealers/ —
2021-06-02 - Introducing The Most Profitable Ransomware REvil/ —
2021-06-02 - Lemon-Duck Cryptominer Technical Analysis/ —
2021-06-02 - NOBELIUM Campaigns and Malware/ —
2021-06-02 - RedDelta PlugX Undergoing Changes and Overlapping Again with Mustang Panda PlugX Infrastructure/ —
2021-06-02 - SharpPanda- Chinese APT Group Targets Southeast Asian Government With Previously Unknown Backdoor/ —
2021-06-02 - Two Carbanak hackers sentenced to eight years in prison in Kazakhstan/ —
2021-06-02 - Under Attack- Protecting Against Conti, DarkSide, REvil and Other Ransomware/ —
2021-06-03 - Chinese threat actors hacked NYC MTA using Pulse Secure zero-day/ —
2021-06-03 - FontPack- A dangerous update Attribution secrets- Who is behind stealing credentials and bank card data by asking to install fake Flash Player, browser or font updates-/ —
2021-06-03 - Necro Python bot adds new exploits and Tezos mining to its bag of tricks/ —
2021-06-03 - OAuth’s Device Code Flow Abused in Phishing Attacks/ —
2021-06-03 - SharpPanda - Chinese APT Group Targets Southeast Asian Government With Previously Unknown Backdoor/ —
2021-06-03 - W1 Jun - EN - Story of the week- Ransomware on the Darkweb/ —
2021-06-03 - WebLogic RCE Leads to XMRig/ —
2021-06-04 - Analysis of Ragnar Locker Ransomware (Acronis)/ —
2021-06-04 - APT Attacks on Domestic Companies Using Library Files/ —
2021-06-04 - Colonial Pipeline Ransomware Hack Unleashes Flood of Related Phishing Attempts/ —
2021-06-04 - EpsilonRed ransomware group hits one of India’s financial software powerhouses/ —
2021-06-04 - FreakOut malware worms its way into vulnerable VMware servers/ —
2021-06-04 - Glupteba back on track spreading via EternalBlue exploits/ —
2021-06-04 - Latvian National Charged for Alleged Role in Transnational Cybercrime Organization/ —
2021-06-04 - MercurialGrabber Github Repository/ —
2021-06-04 - Phishing Malware Hijacks Bitcoin Addresses and Delivers New Agent Tesla Variant/ —
2021-06-04 - PHP Malware Used in Lucky Visitor Scam/ —
2021-06-04 - TeamTNT Actively Enumerating Cloud Environments to Infiltrate Organizations/ —
2021-06-04 - The Ransomware Conundrum – A Look into DarkSide/ —
2021-06-04 - The SBU blocked a mass cyberattack by Russian special services on the computer networks of the Ukrainian authorities/ —
2021-06-04 - The Sysrv-hello Cryptojacking Botnet- Here’s What’s New/ —
2021-06-04 - US arrests Latvian woman who worked on Trickbot malware source code/ —
2021-06-05 - Geopolitical nation-state threat actor overview May 2021/ —
2021-06-05 - Prometheus- An Emerging Ransomware Group Using Thanos Ransomware To Target Organizations/ —
2021-06-05 - The Gh0st remain the same/ —
2021-06-06 - New Evil Corp ransomware mimics PayloadBin gang to evade US sanctions/ —
2021-06-07 - Adventures in Contacting the Russian FSB/ —
2021-06-07 - Avaddon Ransomware Analysis/ —
2021-06-07 - Department of Justice Seizes $2.3 Million in Cryptocurrency Paid to the Ransomware Extortionists Darkside/ —
2021-06-07 - Gootkit- the cautious Trojan/ —
2021-06-07 - Inside the SystemBC Malware-As-A-Service/ —
2021-06-07 - Malware family naming hell is our own fault/ —
2021-06-07 - Ransomware Struck Another Pipeline Firm—and 70GB of Data Leaked/ —
2021-06-07 - Siloscape- First Known Malware Targeting Windows Containers to Compromise Cloud Environments/ —
2021-06-08 - Another Brick in the Wall- eCrime Groups Leverage SonicWall VPN Vulnerability/ —
2021-06-08 - From QBot...with REvil Ransomware- Initial Attack Exposure of JBS/ —
2021-06-08 - LOKIBOT - A commodity malware/ —
2021-06-08 - Microsoft patches six Windows zero-days, including a commercial exploit/ —
2021-06-08 - New large-scale campaign targets Kubeflow/ —
2021-06-08 - Picture this- Malware Hides in Steam Profile Images/ —
2021-06-08 - PuzzleMaker attacks with Chrome zero-day exploit chain/ —
2021-06-08 - TeamTNT Using WatchDog TTPs to Expand Its Cryptojacking Footprint/ —
2021-06-08 - The blurry boundaries between nation-state actors and the cybercrime underground/ —
2021-06-08 - ThunderCats Hack the FSB - Your Taxes Didn’t Pay For This Op/ —
2021-06-08 - UAL Thank Us Later- Leveraging User Access Logging for Forensic Investigations/ —
2021-06-09 - Gelsemium- When threat actors go gardening/ —
2021-06-09 - Prometheus Ransomware Gang- A Group of REvil-/ —
2021-06-09 - Russian hackers breached Dutch police systems in 2017/ —
2021-06-10 - Are Virtual Machines the New Gold for Cyber Criminals-/ —
2021-06-10 - BackdoorDiplomacy- Upgrading from Quarian to Turian/ —
2021-06-10 - Big airline heist - APT41 likely behind massive supply chain attack/ —
2021-06-10 - Big airline heist APT41 likely behind massive supply chain attack/ —
2021-06-10 - Cloud Atlas Navigates Us Into New Waters/ —
2021-06-10 - CrowdStrike Falcon Protects Customers from Recent COZY BEAR Sophisticated Phishing Campaign/ —
2021-06-10 - Detecting Password Spraying Attacks- Threat Research Release May 2021/ —
2021-06-10 - Hiding your syscalls/ —
2021-06-10 - June 2021 Patch Tuesday- Six Actively Exploited Zero-Day Vulnerabilities and More Critical CVEs/ —
2021-06-10 - LokiBot Technical Analysis Report/ —
2021-06-10 - NetWire Technical Analysis Report/ —
2021-06-10 - QakBot Technical Analysis Report/ —
2021-06-10 - Ransom DDoS Extortion Actor “Fancy Lazarus” Returns/ —
2021-06-10 - REvil- the usage of legitimate remote admin tooling/ —
2021-06-10 - Schadsoftware Emotet- BKA befragt Schlüsselfigur/ —
2021-06-10 - SmokeLoader Technical Analysis Report/ —
2021-06-11 - Avaddon ransomware shuts down and releases decryption keys/ —
2021-06-11 - Cybercrime Featured Avaddon ransomware operation shuts down and releases decryption keys/ —
2021-06-11 - Google Play store applications laced with Joker malware yet again/ —
2021-06-11 - Relentless REvil, revealed- RaaS as variable as the criminals who use it/ —
2021-06-13 - Blue Team Detection- DarkSide Ransomware/ —
2021-06-14 - A Step-by-Step Analysis of a New Version of DarkSide Ransomware/ —
2021-06-14 - Apple patches two iOS zero-days in old-gen devices/ —
2021-06-14 - Behind the scenes of business email compromise- Using cross-domain threat data to disrupt a large BEC campaign/ —
2021-06-14 - Digital artists targeted in RedLine infostealer campaign/ —
2021-06-14 - G7 calls on Russia to crack down on ransomware gangs/ —
2021-06-14 - Incremental Machine Learning by Example- Detecting Suspicious Activity with Zeek Data Streams, River, and JA3 Hashes/ —
2021-06-14 - Introducing Script Watch- Detect Magecart style attacks, fast!/ —
2021-06-14 - Malware hosting domain Cyberium fanning out Mirai variants/ —
2021-06-14 - The Allegedly Ryuk Ransomware builder- #RyukJoke/ —
2021-06-15 - A Defender's Perspective of SSL VPN Exploitation/ —
2021-06-15 - Andariel evolves to target South Korea with ransomware/ —
2021-06-15 - Detecting UEFI Bootkits in the Wild (Part 1)/ —
2021-06-15 - Hades Ransomware Operators Use Distinctive Tactics and Infrastructure/ —
2021-06-15 - Handy guide to a new Fivehands ransomware variant/ —
2021-06-15 - How to Protect Active Directory Against Ransomware Attacks/ —
2021-06-15 - Infra-Tagging -a new tool in Cyber Threat Intelligence/ —
2021-06-15 - Insights Into an Excel 4.0 Macro Attack using Qakbot Malware/ —
2021-06-15 - Ransomware Gang Turns to Revenge Porn/ —
2021-06-15 - Source code for Paradise ransomware leaked on hacking forums/ —
2021-06-15 - TargetCompany Ransomware/ —
2021-06-15 - Use YARA math Module Extension in THOR TechPreview and THOR Lite/ —
2021-06-15 - What you need to know about Process Ghosting, a new executable image tampering attack/ —
2021-06-16 - Cerberus Analysis - Android Banking Trojan/ —
2021-06-16 - DirtyMoe- Introduction and General Overview of Modularized Malware/ —
2021-06-16 - Emotet campaign analysis/ —
2021-06-16 - Evilnum organizes recent attacks against European financial companies/ —
2021-06-16 - Ferocious Kitten - 6 years of covert surveillance in Iran/ —
2021-06-16 - Ferocious Kitten- 6 years of covert surveillance in Iran/ —
2021-06-16 - Gootloader- ‘Initial Access as a Service’ Platform Expands Its Search for High Value Targets/ —
2021-06-16 - Matanbuchus- Malware-as-a-Service with Demonic Intentions/ —
2021-06-16 - Removing Coordinated Inauthentic Behavior From Ethiopia/ —
2021-06-16 - Russian National Convicted of Charges Relating to Kelihos Botnet/ —
2021-06-16 - Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise/ —
2021-06-16 - The First Step- Initial Access Leads to Ransomware/ —
2021-06-16 - The Rise & Demise of Multi-Million Ransomware Business Empire/ —
2021-06-16 - Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010/ —
2021-06-16 - Ukrainian police arrest Clop ransomware members, seize server infrastructure/ —
2021-06-16 - Ukrainian Police Nab Six Tied to CLOP Ransomware/ —
2021-06-16 - US convicts Russian national behind Kelihos botnet crypting service/ —
2021-06-17 - Analysis of Hancitor – When Boring Begets Beacon/ —
2021-06-17 - Bash Ransomware DarkRadiation Targets Red Hat- and Debian-based Linux Distributions/ —
2021-06-17 - Black Kingdom ransomware/ —
2021-06-17 - Etterforskningen av datanettverksoperasjonen mot statsforvalterembeter henlegges/ —
2021-06-17 - For the first time, PST says that China (APT31) is behind a computer attack/ —
2021-06-17 - Hold the Door- Examining Exfiltration Activity and Applying Countermeasures/ —
2021-06-17 - Klingon RAT Holding on for Dear Life/ —
2021-06-17 - New TA402 Molerats Malware Targets Governments in the Middle East/ —
2021-06-17 - Teabot - Android Banking Trojan Targets Banks in Europe/ —
2021-06-17 - The investigation of the computer network operation (by APT31) against public administration offices is closed/ —
2021-06-17 - Vigilante malware rats out software pirates while blocking ThePirateBay/ —
2021-06-18 - 0xxx Ransomware/ —
2021-06-18 - Conti Ransomware Gang- An Overview/ —
2021-06-18 - Poland blames Russia for breach, theft of Polish officials' emails/ —
2021-06-18 - Ransomware Actors Evolved Their Operations in 2020/ —
2021-06-18 - Ryuk Botnet, Simps Botnet, Gods of Destny Botnet/ —
2021-06-18 - SecurityScorecard Finds USAID Hack Much Larger Than Initially Thought/ —
2021-06-18 - Statement by the Vice-President of the Council of Ministers, Chairman of the Committee for National Security and Defense Affairs, Jarosław Kaczyński (about UNC1151)/ —
2021-06-19 - Alert (AA21-200A)- Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department/ —
2021-06-19 - Android FluBot enters Switzerland/ —
2021-06-20 - Dangerous Phishing Campaign for Harvesting Credentials using an HTML Attachment/ —
2021-06-20 - From Word to Lateral Movement in 1 Hour/ —
2021-06-20 - Mars-Deimos- From Jupiter to Mars and Back again (Part Two)/ —
2021-06-20 - The Sorcery of Malware Reverse Engineering/ —
2021-06-20 - Unpacking UPX Manually/ —
2021-06-21 - An Encounter With Ransomware-as-a-Service- MEGAsync Analysis/ —
2021-06-21 - DarkRadiation - Abusing Bash For Linux and Docker Container Ransomware/ —
2021-06-21 - Darkside RaaS in Linux version/ —
2021-06-21 - Dissecting a RAT. Analysis of the Saefko RAT/ —
2021-06-21 - DJVU Malware of STOP Ransomware Family Back with New Variant/ —
2021-06-21 - Lolifox – kto za nim stał i co się z nim stało-/ —
2021-06-21 - Ready for (nearly) anything- Five things to prepare for a cyber security incident/ —
2021-06-21 - Sload Targeting Europe Again/ —
2021-06-21 - Sonatype Catches New PyPI Cryptomining Malware/ —
2021-06-21 - Threat Hunting SSH Keys – Bash Script Feature Pivoting/ —
2021-06-21 - VMProtect 2 - Part Two, Complete Static Analysis/ —
2021-06-22 - Android Application Disguised as Dating App Targets Indian Military Personnel/ —
2021-06-22 - Attackers in Executive Clothing - BEC continues to separate orgs from their money/ —
2021-06-22 - Attacks against media in the Philippines continue/ —
2021-06-22 - Chasing DarkSide Affiliates- Identifying Threat Actors Connected to Darkside Ransomware Using Maltego & Intel 471/ —
2021-06-22 - Crypto-mining on a DNS server/ —
2021-06-22 - Darkside RaaS in Linux version/ —
2021-06-22 - How to Dissect Unusual Protocols for Troubleshooting OT Security/ —
2021-06-22 - LV Ransomware/ —
2021-06-22 - NukeSped Copies Fileless Code From Bundlore, Leaves It Unused/ —
2021-06-22 - Polish intelligence agencies link cyberattack to Russia (UNC1151)/ —
2021-06-22 - Preventing Exploitation of the ZIP File Format/ —
2021-06-22 - Response When Minutes Matter- Falcon Complete Disrupts WIZARD SPIDER eCrime Operators/ —
2021-06-22 - Suspected Pakistani Actor Compromises Indian Power Company with New ReverseRat/ —
2021-06-23 - Cybercriminals shop around for schemes targeting retail/ —
2021-06-23 - Deep analysis of REvil Ransomware/ —
2021-06-23 - Java Plug-Ins Delivering Zloader/ —
2021-06-23 - Kimsuky APT organization's targeted attacks on South Korean defense and security related departments/ —
2021-06-23 - PYSA Loves ChaChi- a New GoLang RAT/ —
2021-06-23 - Ransomware- Growing Number of Attackers Using Virtual Machines/ —
2021-06-23 - Ursnif Leverages Cerberus to Automate Fraudulent Bank Transfers in Italy/ —
2021-06-24 - Binance Helps Take Down Cybercriminal Ring Laundering $500M in Ransomware Attacks/ —
2021-06-24 - Crackonosh- A New Malware Distributed in Cracked Software/ —
2021-06-24 - Demystifying the full attack chain of MineBridge RAT/ —
2021-06-24 - Evasive Maneuvers - Massive IcedID Campaign Aims For Stealth with Benign Macros/ —
2021-06-24 - High-Level Member of Hacking Group Sentenced to Prison for Scheme that Compromised Tens of Millions of Debit and Credit Cards/ —
2021-06-24 - JSSLoader- Recoded and Reloaded/ —
2021-06-24 - Lu0bot – An unknown NodeJS malware using UDP/ —
2021-06-24 - Malicious spam campaigns delivering banking Trojans/ —
2021-06-24 - Operation Eagle Eye/ —
2021-06-24 - The Ghosts of Mirai/ —
2021-06-24 - Threat Thursday- Agent Tesla Infostealer/ —
2021-06-24 - Yet Another Archive Format Smuggling Malware/ —
2021-06-25 - Investigating and Mitigating Malicious Drivers/ —
2021-06-25 - Lorenz ransomware- analysis and a free decryptor/ —
2021-06-25 - Microsoft signed a malicious Netfilter rootkit/ —
2021-06-25 - New Nobelium activity/ —
2021-06-26 - MODeflattener - Miasm's OLLVM Deflattener/ —
2021-06-27 - Spear Phishing Campaign with New Techniques Aimed at Aviation Companies/ —
2021-06-28 - Analysis of the new P2P botnet PBot/ —
2021-06-28 - Hackers Tricked Microsoft Into Certifying Malware That Could Spy on Users/ —
2021-06-28 - Hancitor Continues to Push Cobalt Strike/ —
2021-06-28 - Lil' skimmer, the Magecart impersonator - Malwarebytes Labs/ —
2021-06-28 - Nefilim Ransomware Attack Through a MITRE Att&ck Lens/ —
2021-06-28 - New Ransomware Variant Uses Golang Packer/ —
2021-06-28 - Snake Keylogger’s Many Skins- Analysing Code Reuse Among Infostealers/ —
2021-06-29 - Cobalt Strike- Favorite Tool from APT to Crimeware/ —
2021-06-29 - Combating E-Commerce Scams and Account Takeover Attacks/ —
2021-06-29 - Danmarks National Bank hacked as part of 'the world's most sophisticated hacker attack' (NOBELIUM)/ —
2021-06-29 - HADES ransomware operators continue attacks/ —
2021-06-29 - Not Laughing- Malicious Office Documents using LoLBins/ —
2021-06-29 - The -WayBack” Campaign- a Large Scale Operation Hiding in Plain Sight/ —
2021-06-30 - Automation in Reverse Engineering- String Decryption/ —
2021-06-30 - Leaked Babuk Locker ransomware builder used in new attacks/ —
2021-06-30 - MTR in Real Time- Hand-to-hand combat with REvil ransomware chasing a $2.5 million pay day/ —
2021-06-30 - Ransomware-&-CVE- Industry Insights Into Exclusive High-Value Target Adversarial Datasets/ —
2021-06-30 - REvil Twins Deep Dive into Prolific RaaS Affiliates' TTPs/ —
2021-06-30 - Shelob Moonlight – Spinning a Larger Web From IcedID to CONTI, a Trojan and Ransomware collaboration/ —
2021-06-30 - SMB Worm “Indexsinas” Uses Lateral Movement to Infect Whole Networks/ —
2021-06-30 - What to expect when you’ve been hit with REvil ransomware/ —
2021-07-01 - Android trojans steal Facebook users’ logins and passwords/ —
2021-07-01 - Babuk ransomware is back, uses new version on corporate networks/ —
2021-07-01 - Backdoored Client from Mongolian CA MonPass/ —
2021-07-01 - Diavol - A New Ransomware Used By Wizard Spider-/ —
2021-07-01 - IndigoZebra APT continues to attack Central Asia with evolving tools/ —
2021-07-01 - Linux Variant of REvil Ransomware Targets VMware’s ESXi, NAS Devices/ —
2021-07-01 - Malware Masquerades as Privacy Tool/ —
2021-07-01 - Mirai_ptea Botnet is Exploiting Undisclosed KGUARD DVR Vulnerability/ —
2021-07-01 - Mongolian certificate authority hacked eight times, compromised with malware/ —
2021-07-01 - PurpleFox Using WPAD to Target Indonesian Users/ —
2021-07-01 - REvil’s new Linux version/ —
2021-07-01 - Suspected HADES organization launched an attack on Ukraine with military themes/ —
2021-07-01 - The Most Prolific Ransomware Families- A Defenders Guide/ —
2021-07-01 - TrickBot and Zeus/ —
2021-07-01 - WARZONE RAT – Beware Of The Trojan Malware Stealing Data Triggering From Various Office Documents/ —
2021-07-02 - Crticial Ransomware Incident in Progress/ —
2021-07-02 - Dissemination of malicious word documents for 'Korean Political Science and Diplomacy' and 'Biography of Policy Advisor' (kimsuky)/ —
2021-07-02 - Geopolitical nation-state threat actor overview June 2021/ —
2021-07-02 - New Ransomware “Diavol” Being Dropped by Trickbot/ —
2021-07-02 - Ransomware attack/ —
2021-07-02 - REvil configuration dump used in Kaseya attack/ —
2021-07-02 - REvil ransomware hits 1,000+ companies in MSP supply-chain attack/ —
2021-07-02 - Rewterz Threat Intel – IndigoZebra APT Group Targeting Central Asia – Active IOCs/ —
2021-07-02 - Skip the Middleman- Dridex Document to Cobalt Strike/ —
2021-07-02 - The Brothers Grim - The reversing tale of GrimAgent malware used by Ryuk/ —
2021-07-02 - Transparent Tribe APT Infrastructure Mapping Part 2- A Deeper Dive into the Identification of CrimsonRAT Infrastructure/ —
2021-07-02 - TrickBot- New attacks see the botnet deploy new banking module, new ransomware/ —
2021-07-03 - [RE023] Quick analysis and removal tool of a series of new malware variant of Panda group that has recently targeted to Vietnam VGCA/ —
2021-07-03 - Kaseya Ransomware Supply Chain Attack- What You Need To Know/ —
2021-07-03 - Kaseya VSA Detection Tool/ —
2021-07-03 - Threat Brief Kaseya VSA Ransomware Attack/ —
2021-07-03 - Uncensored Interview with REvil - Sodinokibi Ransomware Operators/ —
2021-07-03 - Updates Regarding VSA Security Incident/ —
2021-07-03 - US chemical distributor shares info on DarkSide ransomware data theft/ —
2021-07-04 - Babuk Ransomware- The Builder/ —
2021-07-04 - CISA-FBI Guidance for MSPs and their Customers Affected by the Kaseya VSA Supply-Chain Ransomware Attack/ —
2021-07-04 - Independence Day- REvil uses supply chain exploit to attack hundreds of businesses/ —
2021-07-04 - Kaseya supply chain attack targeting MSPs to deliver REvil ransomware/ —
2021-07-05 - Analysis of -Bitter Elephant- organization's attack activities against my country in the first half of the year/ —
2021-07-05 - Kaseya supply chain attack delivers mass ransomware/ —
2021-07-05 - Kaseya, Sera. What REvil Shall Encrypt, Shall Encrypt/ —
2021-07-05 - Quick review of Babuk ransomware builder/ —
2021-07-05 - Real-Time Prevention of the Kaseya VSA Supply Chain REvil Ransomware Attack/ —
2021-07-05 - REvil Linux Configuration Extractor/ —
2021-07-05 - REvil ransomware attack against MSPs and its clients around the world/ —
2021-07-05 - Tracking Cobalt Strike- A Trend Micro Vision One Investigation/ —
2021-07-05 - Tracking Cobalt Strike/ —
2021-07-06 - AvosLocker Ransomware/ —
2021-07-06 - Cybereason vs. REvil Ransomware- The Kaseya Chronicles/ —
2021-07-06 - How the Kaseya VSA Zero Day Exploit Worked/ —
2021-07-06 - Is Diavol Ransomware Connected to Wizard Spider-/ —
2021-07-06 - Kaseya Supply Chain Ransomware Attack - Technical Analysis of the REvil Payload/ —
2021-07-06 - Lazarus campaign TTPs and evolution/ —
2021-07-06 - Mars-Deimos- SolarMarker-Jupyter Infostealer (Part 1)/ —
2021-07-06 - Moroccan hacker Dr HeX arrested for phishing attacks, malware distribution/ —
2021-07-06 - New TA402-MOLERATS Malware – Decrypting .NET Reactor Strings/ —
2021-07-06 - Operation Lyrebird- Group-IB assists INTERPOL in identifying suspect behind numerous cybercrimes worldwide/ —
2021-07-06 - REvil Ransomware Threat Research Update and Detections/ —
2021-07-06 - TA505 adds GoLang crypter for delivering miners and ServHelper/ —
2021-07-06 - The Evolution of PINCHY SPIDER from GandCrab to REvil/ —
2021-07-06 - Understanding REvil- The Ransomware Gang Behind the Kaseya Attack/ —
2021-07-06 - Understanding Russia’s Cyber Strategy/ —
2021-07-07 - Bandidos at large- A spying campaign in Latin America/ —
2021-07-07 - BIOPASS RAT- New Malware Sniffs Victims via Live Streaming/ —
2021-07-07 - Crackonosh - The Hidden Crypto Mining Malware/ —
2021-07-07 - Deep analysis of KPOT Stealer/ —
2021-07-07 - Diving Deeper Into the Kaseya VSA Attack- REvil Returns and Other Hackers Are Riding Their Coattails/ —
2021-07-07 - Elastic Security prevents 100% of REvil ransomware samples/ —
2021-07-07 - Global Phishing Campaign Targets Energy Sector and its Suppliers/ —
2021-07-07 - How CrowdStrike Falcon Stops REvil Ransomware Used in the Kaseya Attack/ —
2021-07-07 - InSideCopy - How this APT continues to evolve its arsenal/ —
2021-07-07 - InSideCopy- How this APT continues to evolve its arsenal (IOCs)/ —
2021-07-07 - InSideCopy- How this APT continues to evolve its arsenal (Network IOCs)/ —
2021-07-07 - InSideCopy- How this APT continues to evolve its arsenal/ —
2021-07-07 - Israeli Government Seizes Cryptocurrency Addresses Associated with Hamas Donation Campaigns/ —
2021-07-07 - Magecart Swiper Uses Unorthodox Concatenation/ —
2021-07-07 - Netskope Threat Coverage- REvil/ —
2021-07-07 - WildPressure targets the macOS platform/ —
2021-07-08 - Amadey stealer plugin adds Mikrotik and Outlook harvesting/ —
2021-07-08 - Analysis of Lazarus malware abusing Non-ActiveX Module in South Korea/ —
2021-07-08 - Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling/ —
2021-07-08 - Conti Unpacked- Understanding Ransomware Development as a Response to Detection - A Detailed Technical Analysis/ —
2021-07-08 - Decoding Cobalt Strike- Understanding Payloads/ —
2021-07-08 - Enriching Threat Intelligence for the Carbine Loader Crypto-jacking Campaign/ —
2021-07-08 - Hancitor Making Use of Cookies to Prevent URL Scraping/ —
2021-07-08 - Inside the FBI, Russia, and Ukraine’s failed cybercrime investigation/ —
2021-07-08 - Malware Analysis Report (AR21-189A)- DarkSide Ransomware/ —
2021-07-08 - Morgan Stanley reports data breach after vendor Accellion hack/ —
2021-07-08 - Observations and Recommendations from the Ongoing REvil-Kaseya Incident/ —
2021-07-08 - Ransomware Gangs are Starting to Look Like Ocean’s 11/ —
2021-07-08 - Threat Thursday- Redline Infostealer/ —
2021-07-08 - Zloader With a New Infection Technique/ —
2021-07-09 - Dark Web User Known As “The Bull” Charged In Insider Trading Scheme/ —
2021-07-09 - Hancitor tries XLL as initial malware file/ —
2021-07-09 - REvil-ution – A Persistent Ransomware Operation/ —
2021-07-09 - Serv-U Remote Memory Escape Vulnerability CVE-2021-35211 (exploited in the wild)/ —
2021-07-09 - Watering hole threat analysis in the public sector of Kazakhstan/ —
2021-07-12 - Attack Exploiting XSS Vulnerability in E-commerce Websites/ —
2021-07-12 - Operation SpoofedScholars- A Conversation with TA453/ —
2021-07-12 - Over 780,000 email accounts compromised by Emotet have been secured/ —
2021-07-12 - PJobRAT/ —
2021-07-12 - RoboSki and Global Recovery- Automation to Combat Evolving Obfuscation/ —
2021-07-12 - SolarWinds patches critical Serv-U vulnerability (CVE-2021-35211) exploited in the wild/ —
2021-07-13 - Guess Fashion Brand Deals With Data Loss After Ransomware Attack/ —
2021-07-13 - Joker Is Still No Laughing Matter/ —
2021-07-13 - Microsoft discovers threat actor (DEV-0322) targeting SolarWinds Serv-U software with 0-day exploit/ —
2021-07-13 - Prometheus Ransomware Decryptor/ —
2021-07-13 - Ransomware Giant REvil’s Sites Disappear/ —
2021-07-13 - Resources for Investigating Cloud and Container Penetration Testing Tools/ —
2021-07-13 - REvil ransomware gang's web sites mysteriously shut down/ —
2021-07-14 - BazarBackdoor sneaks in through nested RAR and ZIP archives/ —
2021-07-14 - How cybercriminals create turbulence for the transportation industry/ —
2021-07-14 - How We Protect Users From 0-Day Attacks (CVE-2021-21166, CVE-2021-30551, CVE-2021-33742, CVE-2021-1879)/ —
2021-07-14 - How We Tracked a Threat Group Running an Active Cryptojacking Campaign/ —
2021-07-14 - Investigating a Suspicious Service/ —
2021-07-14 - LOCKDATA Auction – Another leak marketplace showing the recent shift of ransomware operators/ —
2021-07-14 - LuminousMoth APT- Sweeping attacks for the chosen few/ —
2021-07-14 - Microsoft delivers comprehensive solution to battle rise in consent phishing emails/ —
2021-07-14 - Old trees and new flowers- Analysis of the new version of KGH spy components used by Kimsuky/ —
2021-07-14 - REvil Vanishes From Underground - Infrastructure Down/ —
2021-07-14 - Spain arrests 16 for working with the Mekotio and Grandoreiro malware gangs/ —
2021-07-14 - Targeted Phishing Attack against Ukrainian Government Expands to Georgia/ —
2021-07-14 - The Civil Guard dismantles an important network dedicated to committing scams through the Internet/ —
2021-07-14 - Threat of the Month- IcedID Malware/ —
2021-07-14 - Triage analysis of Serv-U FTP user backdoor deployed by CVE-2021-35211 (DEV-0322)/ —
2021-07-14 - XLS Entanglement/ —
2021-07-15 - Adjusting the Anchor/ —
2021-07-15 - American Rescue Plan Act Lures in the Wild/ —
2021-07-15 - APT attack (by Kimsuky) attempt on a specific person using a word document/ —
2021-07-15 - cybereason vs. prometheus ransomware/ —
2021-07-15 - Data Exfiltrator - A New Tactic for Ransomware Adversaries/ —
2021-07-15 - Fighting cyberweapons built by private businesses/ —
2021-07-15 - Hooking Candiru Another Mercenary Spyware Vendor Comes into Focus/ —
2021-07-15 - Linux version of HelloKitty ransomware targets VMware ESXi servers/ —
2021-07-15 - Mespinoza Ransomware Gang Calls Victims “Partners,” Attacks with Gasket, -MagicSocks- Tools/ —
2021-07-15 - Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware/ —
2021-07-15 - Taking Action Against Hackers in Iran/ —
2021-07-15 - Vidar Stealer C&C Server List/ —
2021-07-15 - Visual investigations - Speed up your IR, Forensic Analysis and Hunting/ —
2021-07-15 - What is Cyber Threat Intelligence-/ —
2021-07-16 - APT-C-61 attacks against South Asia/ —
2021-07-16 - Attacks Are Tailored to You—Your Intelligence Should Be, Too/ —
2021-07-16 - Mars-Deimos- From Jupiter to Mars and Back again (Part Two)/ —
2021-07-16 - Vidar and GandCrab- stealer and ransomware combo observed in the wild/ —
2021-07-17 - Candiru's Spyware- How It Works And Attacking Journalists, Activists And Many More/ —
2021-07-17 - Ecuador's state-run CNT telco hit by RansomEXX ransomware/ —
2021-07-17 - HelloKitty Linux version malware analysis/ —
2021-07-17 - HelloKitty ransomware is targeting vulnerable SonicWall devices/ —
2021-07-17 - Meet WiFiDemon – iOS WiFi RCE 0-Day Vulnerability, and a Zero-Click Vulnerability That Was Silently Patched/ —
2021-07-18 - About The Pegasus Project/ —
2021-07-18 - Digital Forensics Show S.A.R. Geelani’s Phone Was Hacked, Likely With Zero-Click Exploit/ —
2021-07-18 - Forensic Methodology Report- How to catch NSO Group’s Pegasus/ —
2021-07-18 - Forensic Methodology Report- Pegasus Forensic Traces per Target/ —
2021-07-18 - From Rabat to Paris, Morocco does not let go of journalists/ —
2021-07-18 - Independent Peer Review of Amnesty International’s Forensic Methods for Identifying Pegasus Spyware/ —
2021-07-18 - Massive data leak reveals Israeli NSO Group's spyware used to target activists, journalists, and political leaders globally/ —
2021-07-18 - Mobile Verification Toolkit/ —
2021-07-18 - NSO Group Pegasus Indicator of Compromise/ —
2021-07-18 - Pegasus Project- How Phones of Journalists, Ministers, Activists May Have Been Used to Spy On Them/ —
2021-07-18 - Pegasus- The new global weapon for silencing journalists/ —
2021-07-18 - Revealed- leak uncovers global abuse of cyber-surveillance weapon/ —
2021-07-18 - Revealed- murdered journalist’s number selected by Mexican NSO client/ —
2021-07-18 - Saudis behind NSO spyware attack on Jamal Khashoggi’s family, leak suggests/ —
2021-07-18 - Snoop List Has 40 Indian Journalists, Forensic Tests Confirm Presence of Pegasus Spyware on Some/ —
2021-07-18 - The Guardian's covereage on Pegasus Project/ —
2021-07-18 - The Pegasus Project- A Worldwide Collaboration to Counter a Global Crime/ —
2021-07-18 - The WIre's covereage on Pegasus Project/ —
2021-07-18 - Viktor Orbán using NSO spyware in assault on media, data suggests/ —
2021-07-19 - Alert (AA21-200B)- Chinese State-Sponsored Cyber Operations- Observed TTPs/ —
2021-07-19 - Amazon Shuts Down NSO Group Infrastructure/ —
2021-07-19 - Australia joins international partners in attribution of malicious cyber activity to China/ —
2021-07-19 - Cases of cyberattacks including those by a group known as APT40 which the Chinese government is behind (Statement by Press Secretary YOSHIDA Tomoyuki)/ —
2021-07-19 - China- Declaration by the High Representative on behalf of the European Union urging Chinese authorities to take action against malicious cyber activities undertaken from its territory/ —
2021-07-19 - CSA TTPs of Indicted APT40 Actors Associated with China/ —
2021-07-19 - Evade Sandboxes With a Single Bit – the Trap Flag/ —
2021-07-19 - FickerStealer- A New Rust Player in the Market/ —
2021-07-19 - Fighting an emerging cybercrime trend/ —
2021-07-19 - Fresh Malware Hunts for Crypto Wallet and Credentials/ —
2021-07-19 - IcedID and Cobalt Strike vs Antivirus/ —
2021-07-19 - iPhones running latest iOS hacked to deploy NSO Group spyware/ —
2021-07-19 - New Threat Actor Uses Spanish Language Lures to Distribute Seldom Observed Bandook Malware/ —
2021-07-19 - Remcos RAT delivered via Visual Basic/ —
2021-07-19 - REvil Revealed - Tracking a Ransomware Negotiation and Payment/ —
2021-07-19 - Shlayer Malvertising Campaigns Still Using Flash Update Disguise/ —
2021-07-19 - Signed, Sealed, and Delivered – Signed XLL File Delivers Buer Loader/ —
2021-07-19 - Statement on China’s cyber campaigns/ —
2021-07-19 - The United States, Joined by Allies and Partners, Attributes Malicious Cyber Activity and Irresponsible State Behavior to the People’s Republic of China/ —
2021-07-19 - UK and allies hold Chinese state responsible for a pervasive pattern of hacking/ —
2021-07-19 - UK and allies hold Chinese state responsible for pervasive pattern of hacking/ —
2021-07-20 - Alert (AA21-201A)- Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013/ —
2021-07-20 - Data exfiltration in Latin America/ —
2021-07-20 - Government points finger at China over cyber attacks/ —
2021-07-20 - Hancitor’s Multi-Step Delivery Process/ —
2021-07-20 - Ongoing Campaign Leveraging Exchange Vulnerability Potentially Linked to Iran/ —
2021-07-20 - Researchers- NSO Group’s Pegasus Spyware Should Spark Bans, Apple Accountability/ —
2021-07-20 - Security Researchers’ Hunt to Discover Origins of the Kaseya VSA Mass Ransomware Incident/ —
2021-07-20 - Some URL shortener services distribute Android malware, including banking or SMS trojans/ —
2021-07-20 - The growing threat of ransomware/ —
2021-07-20 - Tracking the Activities of TeamTNT/ —
2021-07-21 - -Le- is not tired of this, IE is really naughty/ —
2021-07-21 - Analysis of malware (wiper) with Japanese file names related to the Tokyo Olympics/ —
2021-07-21 - Detecting Trickbot with Splunk/ —
2021-07-21 - Estonian Citizen Pleads Guilty to Computer Fraud and Abuse (Pavel Tsurkan)/ —
2021-07-21 - FormBook Malware Returns- New Variant Uses Steganography and In-Memory Loading of multiple stages to steal data/ —
2021-07-21 - Groundhog day- NPM package caught stealing browser passwords/ —
2021-07-21 - INDICATEURS DE COMPROMISSION DU CERT-FR/ —
2021-07-21 - LuminousMoth – PlugX, File Exfiltration and Persistence Revisited/ —
2021-07-21 - Malware Targeting Pulse Secure Devices/ —
2021-07-21 - Notorious Cybercrime Gang, FIN7, Lands Malware in Law Firm Using Fake Legal Complaint Against Jack Daniels’ Owner, Brown-Forman Inc/ —
2021-07-21 - StrongPity APT Group Deploys Android Malware for the First Time/ —
2021-07-21 - The Coper―a new Android banking trojan targeting Colombian users/ —
2021-07-21 - The life and death of the ZeuS Trojan/ —
2021-07-21 - This Chat is Being Recorded- Egregor Ransomware Negotiations Uncovered/ —
2021-07-21 - Top prevalent malware with a thousand campaigns migrates to macOS/ —
2021-07-22 - Analysis of -[Urgent] Damage report regarding the occurrence of cyber attacks, etc. associated with the Tokyo Olympics.exe-/ —
2021-07-22 - Behavorial xbits with Suricata/ —
2021-07-22 - Cyber ​​attack with PHOBOS ransomware application/ —
2021-07-22 - DoNot APT Group Delivers A Spyware Variant Of Chat App/ —
2021-07-22 - Incident report- Spotting SocGholish WordPress injection/ —
2021-07-22 - Kaseya obtains universal decryptor for REvil ransomware victims/ —
2021-07-22 - Malware increasingly targets Discord for abuse/ —
2021-07-22 - Quick analysis of Haron Ransomware (feat. Avaddon and Thanos)/ —
2021-07-22 - Ransomware gang breached CNA’s network via fake browser update/ —
2021-07-22 - Taurus Loader- User-Guided Infection/ —
2021-07-22 - The Fraud Family Fraud-as-a-Service operation targeting Dutch residents/ —
2021-07-22 - Updated XCSSET Malware Targets Telegram, Other Apps/ —
2021-07-22 - W4 July - EN - Story of the week- Ransomware on the Darkweb/ —
2021-07-22 - When coin miners evolve, Part 1- Exposing LemonDuck and LemonCat, modern mining malware infrastructure/ —
2021-07-23 - AvosLocker enters the ransomware scene, asks for partners/ —
2021-07-24 - Agent.Tesla Dropped via a .daa Image and Talking to Telegram/ —
2021-07-24 - Quack Quack- Analysing Qakbot’s Browser Hooking Module – Part 1/ —
2021-07-25 - Ghidra script to decrypt a string array in XOR DDoS/ —
2021-07-25 - Scanning your iPhone for Pegasus, NSO Group's malware/ —
2021-07-26 - Detecting XLoader - A macOS ‘Malware-as-a-Service’ Info Stealer and Keylogger/ —
2021-07-26 - OSX.XLoader hides little except its main purpose- What we learned in the installation process/ —
2021-07-26 - Portable Executable Injection Study/ —
2021-07-26 - WhiteBlackGroup Ransomware (.encrpt3d)/ —
2021-07-26 - Wiper Malware Riding the 2021 Tokyo Olympic Games/ —
2021-07-27 - bDeep dive into a FIN8 attack A forensic investigation/ —
2021-07-27 - BlackMatter Ransomware Emerges As Successor to DarkSide, REvil/ —
2021-07-27 - Chatter Indicates BlackMatter as REvil Successor/ —
2021-07-27 - Collecting and operationalizing threat data from the Mozi botnet/ —
2021-07-27 - Deep dive into a FIN8 attack – A forensic investigation/ —
2021-07-27 - Diamondfox Technical Analysis Report/ —
2021-07-27 - Ghosts on the Wire- Expanding Conceptions of Network Anomalies/ —
2021-07-27 - Iran's Secret Cyber Files/ —
2021-07-27 - LockBit ransomware now encrypts Windows domains using group policies/ —
2021-07-27 - Oscorp evolves into UBEL- an advanced Android malware spreading across the globe/ —
2021-07-27 - Oski Stealer Technical Analysis Report/ —
2021-07-27 - Summary of Kimsuky's secret stealing activities in the first half of 2021/ —
2021-07-27 - THOR - Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group/ —
2021-07-27 - THOR- Previously Unseen PlugX Variant Deployed During Microsoft Exchange Server Attacks by PKPLUG Group/ —
2021-07-27 - Threat Actors Exploit Misconfigured Apache Hadoop YARN/ —
2021-07-27 - Time-proven tricks in a new environment- the macOS evolution of Formbook/ —
2021-07-27 - UC San Diego Health discloses data breach after phishing attack/ —
2021-07-28 - BlackMatter & Haron- Evil Ransomware Newborns or Rebirths/ —
2021-07-28 - Cert Safari- Leveraging TLS Certificates to Hunt Evil/ —
2021-07-28 - Crimea “manifesto” deploys VBA Rat using double attack vectors/ —
2021-07-28 - DoppelPaymer Continues to Cause Grief Through Rebranding/ —
2021-07-28 - Finding AnchorDNS C2s With Iris Investigate/ —
2021-07-28 - I Knew You Were Trouble - TA456 Targets Defense Contractor with Alluring Social Media Persona/ —
2021-07-28 - I Knew You Were Trouble- TA456 Targets Defense Contractor with Alluring Social Media Persona/ —
2021-07-28 - New Russian-Speaking Forum – A New Place for RaaS-/ —
2021-07-28 - REvil- Analysis of Competing Hypotheses/ —
2021-07-28 - Stylish Magento Card Stealer loads Without Script Tags/ —
2021-07-28 - Telegram Zeek, you’re my main notice/ —
2021-07-28 - Top Routinely Exploited Vulnerabilities/ —
2021-07-28 - Vultur, with a V for VNC/ —
2021-07-29 - An (in)Competent Cyber Program – A brief cyber history of the 'CCP'/ —
2021-07-29 - BazaCall- Phony call centers lead to exfiltration and ransomware/ —
2021-07-29 - GhostEmperor- Chinese-speaking APT targets high-profile victims using unknown rootkit/ —
2021-07-29 - Magnitude Exploit Kit- Still Alive and Kicking/ —
2021-07-29 - MeteorExpress - Mysterious Wiper Paralyzes Iranian Trains with Epic Troll/ —
2021-07-29 - NTLM Relaying via Cobalt Strike/ —
2021-07-29 - Talos Spotlight- Solarmarker/ —
2021-07-29 - Using the Silent Push app and API to find punycode domains/ —
2021-07-29 - When coin miners evolve, Part 2- Hunting down LemonDuck and LemonCat attacks/ —
2021-07-29 - “Netfilter Rootkit II ” Continues to Hold WHQL Signatures/ —
2021-07-30 - Aberebot on the Rise- New Banking Trojan Targeting Users Through Phishing/ —
2021-07-30 - Decrypting BazarLoader strings with a Unicorn/ —
2021-07-30 - Detecting TA551 domains/ —
2021-07-30 - DOJ- SolarWinds hackers breached emails from 27 US Attorneys’ offices/ —
2021-07-30 - ISOMorph Infection- In-Depth Analysis of a New HTML Smuggling Campaign/ —
2021-07-30 - Novel Meteor Wiper Used in Attack that Crippled Iranian Train System/ —
2021-07-31 - BlackMatter ransomware gang rises from the ashes of DarkSide, REvil/ —
2021-07-31 - DarkSide ransomware gang returns as new BlackMatter operation/ —
2021-08-01 - BazarCall to Conti Ransomware via Trickbot and Cobalt Strike/ —
2021-08-01 - BlackMatter Ransomware/ —
2021-08-02 - A Deep-Dive Analysis Of A New Wiper Malware Disguised As Tokyo Olympics Document/ —
2021-08-02 - All Access Pass- Five Trends with Initial Access Brokers/ —
2021-08-02 - New sophisticated RAT in town- FatalRat analysis/ —
2021-08-02 - Operation Hunting - The latest attack by the CNC (APT-C-48) has been revealed/ —
2021-08-02 - TG1021 - Praying Mantis Threat Actor/ —
2021-08-03 - A step-by-step analysis of the new malware used by APT28-Sofacy called SkinnyBoy/ —
2021-08-03 - APT31 new dropper. Target destinations_ Mongolia, Russia, the U.S., and elsewhere/ —
2021-08-03 - DeadRinger - Exposing Chinese Threat Actors Targeting Major Telcos/ —
2021-08-03 - DeadRinger- Exposing Chinese Threat Actors Targeting Major Telcos/ —
2021-08-03 - Python script for recovering the hashes hardcoded in different samples of the BlackMatter ransomware/ —
2021-08-03 - Ransomware attack hits Italy's Lazio region, affects COVID-19 site/ —
2021-08-03 - Squashing SPIDERS- Threat Intelligence, Threat Hunting and Rapid Response Stops SQL Injection Campaign/ —
2021-08-03 - The Art of Cyberwarfare Chinese APTs attack Russia/ —
2021-08-03 - The Art of Cyberwarfare/ —
2021-08-03 - The Pegasus Project/ —
2021-08-03 - Trash Panda as a Service- Raccoon Stealer steals cookies, cryptocoins, and more/ —
2021-08-04 - [QuickNote] MountLocker – Some pseudo-code snippets/ —
2021-08-04 - A Deep-dive Analysis of VENOMOUS Ransomware/ —
2021-08-04 - Cloudy with a Chance of APTNovel Microsoft 365 Attacks in the Wild/ —
2021-08-04 - Detecting Cobalt Strike- Cybercrime Attacks (GOLD LAGOON)/ —
2021-08-04 - Energy group ERG reports minor disruptions after ransomware attack/ —
2021-08-04 - Hotcobalt – New Cobalt Strike DoS Vulnerability That Lets You Halt Operations/ —
2021-08-04 - ITG18- Operational Security Errors Continue to Plague Sizable Iranian Threat Group/ —
2021-08-04 - LockBit ransomware recruiting insiders to breach corporate networks/ —
2021-08-04 - Pegasus Spyware- How It Works and What It Collects/ —
2021-08-04 - PROPHET SPIDER Exploits Oracle WebLogic to Facilitate Ransomware Activity/ —
2021-08-04 - S-W Download Camouflage, Spreading Various Kinds of Malware/ —
2021-08-04 - See Ya Sharp- A Loader’s Tale/ —
2021-08-04 - Spotting brand impersonation with Swin transformers and Siamese neural networks/ —
2021-08-04 - Supply Chain Attacks from a Managed Detection and Response Perspective/ —
2021-08-04 - Understanding BlackMatter's API Hashing/ —
2021-08-05 - Analysis of the BlackMatter ransomware/ —
2021-08-05 - Angry Conti ransomware affiliate leaks gang's attack playbook/ —
2021-08-05 - BlackMatter Under the Lens- An Emerging Ransomware Group Looking for Affiliates/ —
2021-08-05 - Cryptominer ELFs Using MSR to Boost Mining Process/ —
2021-08-05 - Detecting Cobalt Strike- Government-Sponsored Threat Groups (APT32)/ —
2021-08-05 - Linux version of BlackMatter ransomware targets VMware ESXi servers/ —
2021-08-05 - Prometheus TDS The key to success for Campo Loader, Hancitor, IcedID, and QBot/ —
2021-08-05 - Ransomware Gangs and the Name Game Distraction/ —
2021-08-05 - The clandestine Horus Eyes RAT- From the underground to criminals’ arsenal/ —
2021-08-05 - The Trystero Project/ —
2021-08-05 - When Dridex and Cobalt Strike give you Grief/ —
2021-08-06 - Anatomy of native IIS malware/ —
2021-08-06 - Angry Affiliate Leaks Conti Ransomware Gang Playbook/ —
2021-08-06 - Bold ad campaign/ —
2021-08-06 - Conti ransomware affiliate goes rogue, leaks “gang data”/ —
2021-08-06 - IIStealer- A server‑side threat to e‑commerce transactions/ —
2021-08-06 - Inside DarkSide, the ransomware that attacked Colonial Pipeline/ —
2021-08-06 - Redosdru.v Malware that hides in encrypted DLL Files to avoid Detection by Firewalls/ —
2021-08-08 - Legal and cooperation frameworks between CSIRTs and law enforcement agencies/ —
2021-08-09 - A BazarLoader DGA that Breaks Down in the Summer/ —
2021-08-09 - APT Cobalt Strike Campaign targeting Slovakia (DEF CON talk)/ —
2021-08-09 - BlackMatter ransomware emerges from the shadow of DarkSide/ —
2021-08-09 - Cinobi Banking Trojan Targets Cryptocurrency Exchange Users via Malvertising/ —
2021-08-09 - CryptBot Infostealer Constantly Changing and Being Distributed/ —
2021-08-09 - FlyTrap Android Malware Compromises Thousands of Facebook Accounts/ —
2021-08-09 - IISpy- A complex server‑side backdoor with anti‑forensic features/ —
2021-08-09 - Synology warns of malware infecting NAS devices with ransomware/ —
2021-08-09 - Thwarting Jupyter Stealer/ —
2021-08-10 - Chaos Ransomware- A Proof of Concept With Potentially Dangerous Applications/ —
2021-08-10 - Crytek confirms Egregor ransomware attack, customer data theft/ —
2021-08-10 - Fast Insights for a Microsoft-Signed Netfilter Rootkit/ —
2021-08-10 - New eCh0raix Ransomware Variant Targets QNAP and Synology Network-Attached Storage Devices/ —
2021-08-10 - REvil Master Key for Kaseya Attack Posted to XSS/ —
2021-08-10 - UNC215 - Spotlight on a Chinese Espionage Campaign in Israel/ —
2021-08-10 - UNC215- Spotlight on a Chinese Espionage Campaign in Israel/ —
2021-08-11 - Amid Boom in Phishing, Fraudsters Target Customers of Small and Mid-sized Banks/ —
2021-08-11 - DirtyMoe- Rootkit Driver/ —
2021-08-11 - IISerpent- Malware‑driven SEO fraud as a service/ —
2021-08-11 - Kaseya's universal REvil decryption key leaked on a hacking forum/ —
2021-08-11 - MoqHao Part 1.5- High-Level Trends of Recent Campaigns Targeting Japan/ —
2021-08-11 - ReverseRat Reemerges With A (Night)Fury New Campaign And New Developments, Same Familiar Side-Actor/ —
2021-08-11 - Secret -Backdoor- Behind Conti Ransomware Operation- Introducing Atera Agent/ —
2021-08-11 - Teaching an Old Dog New Tricks- 2017 Magniber Ransomware Uses PrintNightmare Vulnerability to Infect Victims in South Korea/ —
2021-08-11 - The Rising Threat from LockBit Ransomware/ —
2021-08-12 - Gootloader’s “mothership” controls malicious content/ —
2021-08-12 - Netskope Threat Coverage- LockBit/ —
2021-08-12 - PrintNightmare vulnerability weaponized by Magniber ransomware gang/ —
2021-08-12 - Signed MSI files, Raccoon and Amadey are used for installing ServHelper RAT/ —
2021-08-12 - Threat Thursday- Ficker Infostealer Malware/ —
2021-08-12 - Uncovering Tetris - a Full Surveillance Kit Running in your Browser/ —
2021-08-12 - Uncovering Tetris – a Full Surveillance Kit Running in your Browser/ —
2021-08-12 - Vice Society Leverages PrintNightmare In Ransomware Attacks/ —
2021-08-13 - The Ghostwriter Scenario (UNC1151)/ —
2021-08-13 - When Malware Changes Its Mind - A Study of Variable Program Behaviors/ —
2021-08-14 - Indra - Hackers Behind Recent Attacks on Iran/ —
2021-08-14 - Indra — Hackers Behind Recent Attacks on Iran/ —
2021-08-16 - A Deep-dive Analysis of LOCKBIT 2.0/ —
2021-08-16 - LockBit Resurfaces With Version 2.0 Ransomware Detections in Chile, Italy, Taiwan, UK/ —
2021-08-16 - Statically unpacking a simple .NET dropper/ —
2021-08-17 - An insider insights into Conti operations – Part one/ —
2021-08-17 - Analysis of Diavol Ransomware Reveals Possible Link to TrickBot Gang/ —
2021-08-17 - Cobalt Strike Hunting — DLL Hijacking-Attack Analysis/ —
2021-08-17 - Confucius Uses Pegasus Spyware-related Lures to Target Pakistani Military/ —
2021-08-17 - Hunting for Corporate Insurance Policies- Indicators of [Ransom] Exfiltration/ —
2021-08-17 - LockBit Ransomware Analysis Notes/ —
2021-08-17 - New Iranian Espionage Campaign/ —
2021-08-17 - North Korean APT InkySquid Infects Victims Using Browser Exploits/ —
2021-08-17 - North Korean APT37 - InkySquid Infects Victims Using Browser Exploits/ —
2021-08-17 - Resurgent FluBot malware targets German and Polish banks/ —
2021-08-17 - Secrets behind the Lazarus’s VHD ransomware/ —
2021-08-17 - Snakes on a Domain- An Analysis of a Python Malware Loader/ —
2021-08-18 - China Propaganda Network Targets BBC Media, UK in Large-Scale Influence Campaign/ —
2021-08-18 - Cobalt Strike- Detect this Persistent Threat/ —
2021-08-18 - Diavol ransomware sample shows stronger connection to TrickBot gang/ —
2021-08-18 - Infostealer Malware Azorult Being Distributed Through Spam Mails/ —
2021-08-19 - An insider insights into Conti operations – Part two/ —
2021-08-19 - BlackBerry Prevents- Threat Actor Group TA575 and Dridex Malware/ —
2021-08-19 - How to proactively defend against Mozi IoT botnet/ —
2021-08-19 - Malicious Campaign Targets Latin America- The seller, The operator and a curious link/ —
2021-08-19 - Microsoft Exchange Servers Still Vulnerable to ProxyShell Exploit/ —
2021-08-19 - Ragnar Locker – Malware analysis/ —
2021-08-19 - ShadowPad - A Masterpiece of Privately Sold Malware in Chinese Espionage/ —
2021-08-19 - Shadowpad/ —
2021-08-19 - ShinyHunters Selling Alleged AT&T Database with 70 million SSN and Date of birth; AT&T Denies it originated from their systems/ —
2021-08-20 - An Overview of FinTech Threat Landscape/ —
2021-08-20 - LockFile- Ransomware Uses PetitPotam Exploit to Compromise Windows Domain Controllers/ —
2021-08-20 - New variant of Konni malware used in campaign targetting Russia/ —
2021-08-20 - See REvil again-! See how hackers use the same encryption ransomware program REvil to annihilate the attack evidence/ —
2021-08-20 - Singapore real estate firm breached by ALTDOS/ —
2021-08-22 - PEB- Where Magic Is Stored/ —
2021-08-22 - The Bangladesh cyber bank robbery- Tracking down major criminals with malware analysis/ —
2021-08-23 - Heres how to guard your enterprise against ShinyHunters/ —
2021-08-23 - Hive Attacks - Analysis of the Human-Operated Ransomware Targeting Healthcare/ —
2021-08-23 - Kimsuky Espionage Campaign/ —
2021-08-23 - Netskope Threat Coverage- BlackMatter/ —
2021-08-23 - Paradise Ransomware- The Builder/ —
2021-08-23 - PRISM attacks fly under the radar/ —
2021-08-23 - ProxyShell vulnerabilities in Microsoft Exchange- What to do/ —
2021-08-24 - Earth Baku Returns/ —
2021-08-24 - From Pearl to Pegasus Bahraini Government Hacks Activists with NSO Group Zero-Click iPhone Exploits/ —
2021-08-24 - How Data Brokers Sell Access to the Backbone of the Internet/ —
2021-08-24 - LockBit 2.0 Interview with Russian OSINT/ —
2021-08-24 - North Korean BLUELIGHT Special- InkySquid Deploys RokRAT/ —
2021-08-24 - Ransomware gang's script shows exactly the files they're after/ —
2021-08-24 - Ransomware Groups to Watch- Emerging Threats/ —
2021-08-24 - The SideWalk may be as dangerous as the CROSSWALK/ —
2021-08-24 - Triada Trojan in WhatsApp MOD/ —
2021-08-24 - ​A Deep-dive Analysis of KARMA Ransomware/ —
2021-08-25 - Advisories are published, but are enough entities reading them and taking precautions-/ —
2021-08-25 - FIN7 still active/ —
2021-08-25 - FIN8 Threat Actor Goes Agile with New Sardonic Backdoor/ —
2021-08-25 - GrowtopiaStealer/ —
2021-08-25 - New Campaign Sees LokiBot Delivered Via Multiple Methods/ —
2021-08-25 - Reverse Engineering Crypto Functions- RC4 and Salsa20/ —
2021-08-25 - ​LockFile Ransomware- Exploiting Microsoft Exchange Vulnerabilities Using ProxyShell/ —
2021-08-26 - Become A VIP Victim With New Discord Distributed Malware/ —
2021-08-26 - China's Microsoft Hack May Have Had A Bigger Purpose Than Just Spying/ —
2021-08-26 - From Russia With… LockBit Ransomware- Inside Look & Preventive Solutions/ —
2021-08-26 - Hackers are trying to topple Belarus’s dictator, with help from the inside/ —
2021-08-26 - NTLM Keeps Haunting Microsoft/ —
2021-08-26 - Ragnarok ransomware releases master decryptor after shutdown/ —
2021-08-26 - Spies for Hire- China’s New Breed of Hackers Blends Espionage and Entrepreneurship/ —
2021-08-26 - Widespread credential phishing campaign abuses open redirector links/ —
2021-08-27 - Anubis Android Malware Analysis/ —
2021-08-27 - Cobalt Strike Configuration Extractor and Parser/ —
2021-08-27 - Fraude personificando a marca Continente espalha-se através do WhatsApp- Não se deixe enganar!/ —
2021-08-27 - LockFile ransomware’s box of tricks- intermittent encryption and evasion/ —
2021-08-27 - Phorpiex botnet shuts down, source code goes up for sale/ —
2021-08-27 - ProxyShell Exchange Exploitation Now Leads To An Increasing Amount Of Cobaltstrike Backdoors/ —
2021-08-27 - RealTek CVE-2021-35394 Exploited in the Wild/ —
2021-08-28 - LockFile Ransomware Bypasses Protection Using Intermittent File Encryption/ —
2021-08-29 - Cobalt Strike, a Defender’s Guide/ —
2021-08-30 - CARBON SPIDER Embraces Big Game Hunting, Part 1/ —
2021-08-30 - Hypervisor Jackpotting, Part 2- eCrime Actors Increase Targeting of ESXi Servers with Ransomware/ —
2021-08-30 - LockFile ransomware uses intermittent encryption to evade detection/ —
2021-08-30 - New Mirai Variant Targets WebSVN Command Injection Vulnerability (CVE-2021-32305)/ —
2021-08-30 - ProxyToken- An Authentication Bypass in Microsoft Exchange Server/ —
2021-08-31 - Analysis of suspected Russian-speaking attackers using COVID-19 vaccine bait to attack the Middle East/ —
2021-08-31 - Attracting flies with Honey(gain)- Adversarial abuse of proxyware/ —
2021-08-31 - Bassterlord (FishEye) Networking Manual (X)/ —
2021-08-31 - BlackMatter - The New Star Of Ransomware/ —
2021-08-31 - Cobalt Strike and Ransomware – Tracking An Effective Ransomware Campaign/ —
2021-08-31 - Financial Institutions in the Sight of New JsOutProx Attack Waves/ —
2021-08-31 - Phishing+Telegram- Solicitação de reembolso da Autoridade Tributária-/ —
2021-08-31 - Sidoh- WIZARD SPIDER’s Mysterious Exfiltration Tool/ —
2021-09-01 - Analysis of a Phishing Kit (that targets Chase Bank)/ —
2021-09-01 - APT-C-56 (Transparent Tribe) Latest Attack Analysis and Associated Suspected Gorgon Group Attack Analysis Alert/ —
2021-09-01 - Confluence enterprise servers targeted with recent vulnerability/ —
2021-09-01 - Diving Deep into UNC1151’s Infrastructure- Ghostwriter and beyond/ —
2021-09-01 - Fake pirated software sites serve up malware droppers as a service/ —
2021-09-01 - LOLBins Are No Laughing Matter- How Attackers Operate Quietly/ —
2021-09-01 - STRRAT- a Java-based RAT that doesn't care if you have Java/ —
2021-09-01 - The Incredible Rise of DPRK’s Cyber Warfare/ —
2021-09-01 - WatchTower - August 2021 TLP- WHITE - Intelligence-Driven Threat Hunting/ —
2021-09-02 - A deep-dive into the SolarWinds Serv-U SSH vulnerability (DEV-0322)/ —
2021-09-02 - Advanced Persistent Threats (APTs)/ —
2021-09-02 - Anatomy and Disruption of Metasploit Shellcode/ —
2021-09-02 - Attacks Continue Against Realtek Vulnerabilities/ —
2021-09-02 - Attacks using metasploit meterpreter/ —
2021-09-02 - Autodesk reveals it was targeted by Russian SolarWinds hackers/ —
2021-09-02 - Cross-Platform Java Dropper- Snake and XLoader (Mac Version)/ —
2021-09-02 - Cybercrime Group FIN7 Using Windows 11 Alpha-Themed Docs to Drop Javascript Backdoor/ —
2021-09-02 - Juniper Breach Mystery Starts to Clear With New Details on Hackers and U.S. Role (APT5)/ —
2021-09-02 - QakBot Technical Analysis/ —
2021-09-02 - Translated- Talos' insights from the recently leaked Conti ransomware playbook/ —
2021-09-03 - Conti affiliates use ProxyShell Exchange exploit in ransomware attacks/ —
2021-09-03 - Dissecting Sodinokibi Ransomware Attacks- Bringing Incident Response and Intelligence Together in the Fight/ —
2021-09-03 - Netwalker ransomware full analysis/ —
2021-09-03 - Phishing Android Malware Targets Taxpayers in India/ —
2021-09-03 - Spyware Variant Disguised as Korean Video App Targets Multiple Asian Countries/ —
2021-09-05 - BlackMatter Ransomware v2.0/ —
2021-09-06 - Quick analysis CobaltStrike loader and shellcode/ —
2021-09-06 - The Ideal Ransomware Victim- What Attackers Are Looking For/ —
2021-09-06 - TrickBot gang developer arrested when trying to leave Korea/ —
2021-09-07 - Analysis of recent attacks by the Lazarus APT organization on the blockchain finance and energy industries/ —
2021-09-07 - BladeHawk group- Android espionage against Kurdish ethnic group/ —
2021-09-07 - Cobalt Strike C2 Hunting with Shodan/ —
2021-09-07 - Fake Income Tax Application Targets Indian Taxpayers/ —
2021-09-07 - Microsoft shares temp fix for ongoing Office 365 zero-day attacks ( CVE-2021-40444)/ —
2021-09-07 - REvil ransomware's servers mysteriously come back online/ —
2021-09-07 - Shellcode Detection Using Real-Time Kernel Monitoring/ —
2021-09-07 - Threat Alert- Mirai-Gafgyt Fork with New DDoS Modules Discovered/ —
2021-09-08 - Advance Fee Fraud- The Emergence of Elaborate Crypto Schemes/ —
2021-09-08 - Aggah Malware Campaign Expands to Zendesk and GitHub to Host Its Malware/ —
2021-09-08 - Groove’s thoughts on Blackmatter, Babuk, and cheese shortages in the Netherlands/ —
2021-09-08 - How Groove Gang is Shaking up the Ransomware-as-a-Service Market to Empower Affiliates/ —
2021-09-08 - Muhstik Takes Aim at Confluence CVE 2021-26084/ —
2021-09-08 - Pro-PRC Influence Campaign/ —
2021-09-08 - Rapidly Evolving BlackMatter Ransomware Tactics/ —
2021-09-08 - TeamTNT with new campaign aka “Chimaera”/ —
2021-09-08 - Ukrainian Cyber Criminal Extradited For Decrypting The Credentials Of Thousands Of Computers Across The World And Selling Them On A Dark Web Website (Glib Oleksandr Ivanov-Tolpintsev)/ —
2021-09-08 - Zoho patches actively exploited critical ADSelfService Plus bug (CVE-2021-40539)/ —
2021-09-09 - A Spectrum of State Ransomware Responsibility/ —
2021-09-09 - Case Analysis of Suncrypt Ransomware Negotiation and Bitcoin Transaction/ —
2021-09-09 - CloudFall Targets Researchers and Scientists Invited to International Military Conferences in Central Asia and Eastern Europe/ —
2021-09-09 - Dark Covenant - Connections Between the Russian State and Criminal Actors/ —
2021-09-09 - FluBot Variant Masquerading As The Default Android Voicemail App/ —
2021-09-09 - Grayfly- Chinese Threat Actor Uses Newly-discovered Sidewalk Malware/ —
2021-09-09 - Groove VS Babuk; Groove Ransom Manifesto & RAMP Underground Platform Secret Inner Workings/ —
2021-09-09 - Hancitor Loader - RE & Config Extraction/ —
2021-09-09 - LockBit 2.0- Ransomware Attacks Surge After Successful Affiliate Recruitment/ —
2021-09-09 - Mēris botnet, climbing to the record/ —
2021-09-09 - PYSA Ransomware Gang adds Linux Support/ —
2021-09-09 - Remote Code Execution 0-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs/ —
2021-09-09 - Threat Thursday- Get Your Paws Off My Data, Raccoon Infostealer/ —
2021-09-10 - Hive Ransomware- Actively Targeting Hospitals/ —
2021-09-10 - Indonesian intelligence agency compromised in suspected Chinese hack/ —
2021-09-10 - New Dridex Variant Being Spread By Crafted Excel Document/ —
2021-09-10 - PhishingJS- A Deep Learning Model for JavaScript-Based Phishing Detection/ —
2021-09-10 - Rendering Threats- A Network Perspective/ —
2021-09-10 - S.O.V.A. - A new Android Banking trojan with fowl intentions/ —
2021-09-10 - The new maxtrilha trojan is being disseminated and targeting several banks/ —
2021-09-13 - Android malware distributed in Mexico uses Covid-19 to steal financial credentials/ —
2021-09-13 - APT-C-36 Updates Its Long-term Spam Campaign Against South American Entities With Commodity RATs/ —
2021-09-13 - APT-C-36 Updates Its Spam Campaign Against South American Entities With Commodity RATs (IOCs)/ —
2021-09-13 - APT-C-36 Updates Its Spam Campaign Against South American Entities With Commodity RATs/ —
2021-09-13 - Attackers exploit CVE-2021-26084 for XMRig crypto mining on affected Confluence servers/ —
2021-09-13 - BazarLoader to Conti Ransomware in 32 Hours/ —
2021-09-13 - Beware of this Lock Screen App/ —
2021-09-13 - FORCEDENTRY NSO Group iMessage Zero-Click Exploit Captured in the Wild (CVE-2021-30860)/ —
2021-09-13 - Hide and Seek - New Zloader Infection Chain Comes With Improved Stealth and Evasion Mechanisms/ —
2021-09-13 - The many tentacles of Magecart Group 8/ —
2021-09-13 - Vermilion Strike- Linux and Windows Re-implementation of Cobalt Strike/ —
2021-09-14 - APT Group Targets Indian Defense Officials Through Enhanced TTPs/ —
2021-09-14 - Big Game Hunting TTPs Continue to Shift After DarkSide Pipeline Attack/ —
2021-09-14 - Deep-dive Analysis of S.O.V.A. Android Banking Trojan/ —
2021-09-14 - Flubot’s Smishing Campaigns under the Microscope/ —
2021-09-14 - More ProxyShell- Web Shells Lead to ZeroLogon and Application Impersonation Attacks/ —
2021-09-14 - North Korea-linked account poses as KBS scriptwriter to dupe DPRK watchers/ —
2021-09-14 - Operation Harvest/ —
2021-09-14 - Operation ‘Harvest’- A Deep Dive into a Long-term Campaign/ —
2021-09-14 - OSX.ZuRu- trojanized apps spread malware, via sponsored search results/ —
2021-09-14 - Russia is fully capable of shutting down cybercrime/ —
2021-09-14 - TeamTNT Script Employed to Grab AWS Credentials/ —
2021-09-14 - The Recent iOS 0-Click, CVE-2021-30860, Sounds Familiar. An Unreleased Write-up- One Year Later/ —
2021-09-15 - Analyzing attacks that exploit the CVE-2021-40444 MSHTML vulnerability/ —
2021-09-15 - Analyzing The ForcedEntry Zero-Click iPhone Exploit Used By Pegasus (CVE-2021-30860)/ —
2021-09-15 - APT-C-23 Using New Variant Of Android Spyware To Target Users In The Middle East/ —
2021-09-15 - Bad ASes/ —
2021-09-15 - Mēris botnet/ —
2021-09-15 - Phishing Eager Travelers/ —
2021-09-15 - Shining a Light on DarkOxide/ —
2021-09-16 - Analysis of CVE-2021-30860 the flaw and fix of a zero-click vulnerability, exploited in the wild/ —
2021-09-16 - APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus/ —
2021-09-16 - Exploitation of the CVE-2021-40444 vulnerability in MSHTML/ —
2021-09-16 - No Longer Just Theory- Black Lotus Labs Uncovers Linux Executables Deployed as Stealth Windows Loaders/ —
2021-09-16 - Operation Layover How we tracked an attack on the aviation industry to five years of compromise/ —
2021-09-16 - Operation Layover- How we tracked an attack on the aviation industry to five years of compromise/ —
2021-09-16 - Pointer- Hunting Cobalt Strike globally/ —
2021-09-16 - RUNLIR - phishing campaign targeting Netherlands/ —
2021-09-16 - Threat Thursday- NetWire RAT is Coming Down the Line/ —
2021-09-17 - 2021-09-17 - SQUIRRELWAFFLE Loader with Cobalt Strike/ —
2021-09-17 - DirtyMoe- Code Signing Certificate/ —
2021-09-17 - Falcon OverWatch Hunts Down Adversaries Where They Hide/ —
2021-09-17 - Joker/ —
2021-09-17 - Numando- Count once, code twice/ —
2021-09-17 - Scamdemic outbreak Scammers attack users in Middle Eastern countries/ —
2021-09-17 - Sophisticated Spyware Posing as a Banking Application To Target Korean Users/ —
2021-09-18 - Hunting for OMI Vulnerability Exploitation with Azure Sentinel/ —
2021-09-18 - “Squirrelwaffle” Maldoc Analysis/ —
2021-09-19 - Alaska discloses ‘sophisticated’ nation-state cyberattack on health service/ —
2021-09-19 - Discovering Linux ELF Beacon of Cobalt Strike Tool/ —
2021-09-19 - MirrorBlast and TA505- Examining Similarities in Tactics, Techniques and Procedures/ —
2021-09-20 - A guide to combatting human-operated ransomware- Part 1/ —
2021-09-20 - ALTDOS claims to have hacked one of Malaysia’s biggest conglomerates/ —
2021-09-20 - BluStealer- from SpyEx to ThunderFox/ —
2021-09-20 - Building an Open Source IDS IPS service for Gateway Load Balancer/ —
2021-09-20 - Chainalysis in Action- OFAC Sanctions Russian Cryptocurrency OTC Suex that Received Over $160 million from Ransomware Attackers, Scammers, Darknet Markets, and Seized Exchange BTC-e/ —
2021-09-20 - DanaBot Communications Update/ —
2021-09-20 - Defeating macOS Malware Anti-Analysis Tricks with Radare2/ —
2021-09-20 - Hello Lionel Richie – Intrusion Truth/ —
2021-09-20 - How we searched for a connection between Mēris and Glupteba, and gained control over 45 thousand MikroTik devices/ —
2021-09-20 - Water Basilisk Uses New HCrypt Variant to Flood Victims with RAT Payloads/ —
2021-09-21 - BlackMatter Ransomware Technical Analysis and Tools from Nozomi Networks Labs/ —
2021-09-21 - Capturing and Detecting AndroidTester Remote Access Trojan with the Emergency VPN/ —
2021-09-21 - Catching the big fish- Analyzing a large-scale phishing-as-a-service operation/ —
2021-09-21 - Cring ransomware group exploits ancient ColdFusion server/ —
2021-09-21 - Cryptominer z0Miner Uses Newly Discovered Vulnerability CVE-2021-26084 to Its Advantage/ —
2021-09-21 - New Jupyter Evasive Delivery through MSI Installer/ —
2021-09-21 - Publication of Updated Ransomware Advisory; Cyber-related Designation (25 cryptocurrency accounts operated by Suex is sanctioned)/ —
2021-09-21 - Ransomware Hackers Attack a Top Safety Testing Org. Using Tactics and Techniques Borrowed from Chinese Espionage Groups/ —
2021-09-21 - Scanning VirusTotal's firehose/ —
2021-09-21 - TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines/ —
2021-09-21 - Using Zeek to track communication state/ —
2021-09-22 - Alert (AA21-265A) Conti Ransomware/ —
2021-09-22 - BlackMatter Ransomware Analysis; The Dark Side Returns/ —
2021-09-22 - ERMAC - another Cerberus reborn/ —
2021-09-22 - GoSecure Titan Labs Technical Report- BluStealer Malware Threat/ —
2021-09-22 - Intelligence Insights- September 2021/ —
2021-09-22 - REvil Ransomware Reemerges After Shutdown; Universal Decryptor Released/ —
2021-09-22 - The Sysrv Botnet and How It Evolved/ —
2021-09-22 - Threat Analysis Report- PrintNightmare and Magniber Ransomware/ —
2021-09-23 - Detecting and Hunting for the PetitPotam NTLM Relay Attack/ —
2021-09-23 - FamousSparrow - A suspicious hotel guest/ —
2021-09-23 - FamousSparrow- A suspicious hotel guest/ —
2021-09-23 - Financially motivated actor breaks certificate parsing to avoid detection/ —
2021-09-23 - HCRootkit - Sutersu Linux Rootkit Analysis/ —
2021-09-23 - New ZE Loader Targets Online Banking Users/ —
2021-09-23 - Operation “Armor Piercer-” Targeted attacks in the Indian subcontinent using commercial RATs/ —
2021-09-23 - Phishing and malware actors abuse Google Forms for credentials, data exfiltration/ —
2021-09-23 - Raccoon Stealer Pivots Towards Self-Protection/ —
2021-09-23 - REVil ransomware devs added a backdoor to cheat affiliates/ —
2021-09-23 - RTL was victim ransomware attack, cyber criminals make 8500 euro loot/ —
2021-09-23 - TangleBot- New Advanced SMS Malware Targets Mobile Users Across U.S. and Canada with COVID-19 Lures/ —
2021-09-23 - Threat Thursday- BlackMatter RaaS - Darker Than DarkSide-/ —
2021-09-23 - Vidar Stealer Evasion Arsenal/ —
2021-09-24 - Daily Ruleset Update Summary 2021-09-24/ —
2021-09-24 - Declaration by the High Representative on behalf of the European Union on respect for the EU’s democratic processes/ —
2021-09-24 - Examining the Cring Ransomware Techniques/ —
2021-09-24 - Flash Report- Colossus Ransomware/ —
2021-09-24 - Hunting the LockBit Gang's Exfiltration Infrastructures/ —
2021-09-26 - Desorden Group claims to have stolen 200 GB of data from ABX Express/ —
2021-09-26 - Insights into Ransomware Spread Using Exchange 1-Day Vulnerabilities 1-2/ —
2021-09-27 - A guide to combatting human-operated ransomware- Part 2/ —
2021-09-27 - A Virtual Baffle to Battle Squirrelwaffle/ —
2021-09-27 - BloodyStealer and gaming assets for sale/ —
2021-09-27 - Deobfuscating PowerShell Malware Droppers/ —
2021-09-27 - DoppelDridex Delivered via Slack and Discord/ —
2021-09-27 - Fake Installers Drop Malware and Open Doors for Opportunistic Attackers/ —
2021-09-27 - FoggyWeb Targeted NOBELIUM malware leads to persistent backdoor/ —
2021-09-27 - FoggyWeb- Targeted NOBELIUM malware leads to persistent backdoor/ —
2021-09-27 - RedLine Infostealer - Detailed Reverse Engineering/ —
2021-09-27 - Threat Analysis Report- Inside the Destructive PYSA Ransomware/ —
2021-09-28 - 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan/ —
2021-09-28 - FinSpy unseen findings/ —
2021-09-28 - FinSpy- unseen findings/ —
2021-09-28 - Learning to ChaCha with APT41/ —
2021-09-28 - Mirai_ptea_Rimasuta variant is exploiting a new RUIJIE router 0 day to spread/ —
2021-09-28 - REvil’s “Cryptobackdoor” Con- Ransomware Group’s Tactics Roil Affiliates, Sparking a Fallout/ —
2021-09-28 - Squirrelwaffle- New Loader Delivering Cobalt Strike/ —
2021-09-28 - Winter Vivern – all Summer/ —
2021-09-28 - Zircolite vs Defense Evasion & Nobellium FoggyWeb/ —
2021-09-29 - Aria-Body Loader- Is that you-/ —
2021-09-29 - Backup “Removal” Solutions - From Conti Ransomware With Love/ —
2021-09-29 - DarkHalo after SolarWinds- the Tomiris connection (UNC2849)/ —
2021-09-29 - Evaluating the Value of Security Intelligence Feeds with Silent Push/ —
2021-09-29 - Federal Indictment in Chicago Charges Turkish National With Directing Cyber Attack on Multinational Hospitality Company/ —
2021-09-29 - FormBook Adds Latest Office 365 0-Day Vulnerability (CVE-2021-40444) to Its Arsenal/ —
2021-09-29 - Google Drive abused in document exfiltration operation against Afghanistan/ —
2021-09-29 - GriftHorse Android Trojan Steals Millions from Over 10 Million Victims Globally GriftHorse Android Trojan Steals Millions from Over 10 Million Victims Globally/ —
2021-09-29 - How to defeat the Russian Dukes- A step-by-step analysis of MiniDuke used by APT29-Cozy Bear/ —
2021-09-29 - PixStealer- a new wave of Android banking Trojans abusing Accessibility Services/ —
2021-09-29 - Russian hacker Q&A- An Interview With REvil-Affiliated Ransomware Contractor/ —
2021-09-29 - TA544 Targets Italian Organizations with Ursnif Malware/ —
2021-09-29 - Zloader Campaigns at a Glance (IOCs)/ —
2021-09-29 - Zloader Campaigns at a Glance/ —
2021-09-30 - A wolf in sheep's clothing- Actors spread malware by leveraging trust in Amnesty International and fear of Pegasus/ —
2021-09-30 - All your hashes are belong to us- An overview of malware hashing algorithms/ —
2021-09-30 - Credential Harvesting at Scale Without Malware/ —
2021-09-30 - GhostEmperor technical details/ —
2021-09-30 - GhostEmperor- From ProxyLogon to kernel mode/ —
2021-09-30 - Hunting for the Confluence Exploitation- When Falcon OverWatch Becomes the First Line of Defense/ —
2021-09-30 - Mac Users Targeted by Trojanized iTerm2 App/ —
2021-09-30 - Mirai goes Stealth – TLS & IoT Malware/ —
2021-09-30 - New Version Of Apostle Ransomware Reemerges In Targeted Attack On Higher Education/ —
2021-09-30 - Ranion Ransomware - Quiet and Persistent RaaS/ —
2021-09-30 - Threat Thursday- xLoader Infostealer/ —
2021-10-01 - Babuk Ransomware Variant Delta Plus Used in Live Attacks After Source Code Leaked/ —
2021-10-01 - Made In America- Green Lambert for OS X/ —
2021-10-01 - SQUIRRELWAFFLE – Analysing the Custom Packer/ —
2021-10-02 - PUA.Win32.Adload.AI/ —
2021-10-03 - Using Windows Sandbox for Malware Analysis/ —
2021-10-04 - Atom Silo ransomware actors use Confluence exploit, DLL side-load for stealthy attack/ —
2021-10-04 - BazarLoader and the Conti Leaks/ —
2021-10-04 - How to Write a Hancitor Extractor in Go/ —
2021-10-04 - Malware Gh0stTimes Used by BlackTech/ —
2021-10-04 - Mobile Malware- TangleBot Untangled/ —
2021-10-04 - Phish, Phished, Phisher- A Quick Peek Inside a Telegram Harvester/ —
2021-10-04 - Reverse engineered the Hancitor DLL and built a static config extractor/ —
2021-10-04 - Threat hunting in large datasets by clustering security events/ —
2021-10-05 - Analyzing Ransomware Negotiations with CONTI (X)/ —
2021-10-05 - Chinese Influence Operations A Machiavellian Moment/ —
2021-10-05 - Drawing a Dragon- Connecting the Dots to Find APT41/ —
2021-10-05 - Malware analysis- Details on LockBit ransomware/ —
2021-10-05 - Prometheus x Spook- Prometheus ransomware rebranded Spook ransomware/ —
2021-10-05 - Python ransomware script targets ESXi server for encryption/ —
2021-10-05 - Ransomware as a Service- Enabler of Widespread Attacks/ —
2021-10-05 - Regarding the Threats Posed by Encrypted Office Files/ —
2021-10-05 - The REBOL Yell- A New Novel REBOL Exploit/ —
2021-10-05 - UEFI threats moving to the ESP Introducing ESPecter bootkit/ —
2021-10-05 - UEFI threats moving to the ESP- Introducing ESPecter bootkit/ —
2021-10-06 - Inside TeamTNT’s Impressive Arsenal- A Look Into A TeamTNT Server/ —
2021-10-06 - Operation GhostShell - Novel RAT Targets Global Aerospace and Telecoms Firms/ —
2021-10-06 - To the moon and hack- Fake SafeMoon app drops malware to spy on you/ —
2021-10-07 - FIN12- The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets/ —
2021-10-07 - FontOnLake- Previously unknown malware family targeting Linux/ —
2021-10-07 - Google notifies 14,000 Gmail users of targeted APT28 attacks/ —
2021-10-07 - Netherlands can use intelligence or armed forces to respond to ransomware attacks/ —
2021-10-07 - Operation Newton- Hi Kimsuky- Did an Apple(seed) really fall on Newton’s head-/ —
2021-10-07 - Ransomware in the CIS/ —
2021-10-07 - Russian cyberattacks pose greater risk to governments and other insights from our annual report/ —
2021-10-07 - SilverTerrier – Nigerian Business Email Compromise/ —
2021-10-07 - SquirrelWaffle- New Malware Loader Delivering Cobalt Strike and QakBot/ —
2021-10-07 - Team TNT Deploys Malicious Docker Image On Docker Hub/ —
2021-10-07 - Threat Thursday- BluStealer Infostealer/ —
2021-10-08 - Actors Target Huawei Cloud Using Upgraded Linux Malware/ —
2021-10-08 - Malware Flagpro used by targeted attack group BlackTech/ —
2021-10-08 - New Trickbot and BazarLoader campaigns use multiple delivery vectorsi/ —
2021-10-08 - SQUIRRELWAFFLE – Analysing The Main Loader/ —
2021-10-11 - ESET FontOnLake/ —
2021-10-11 - Iran-linked DEV-0343 targeting defense, GIS, and maritime sectors/ —
2021-10-11 - Moving Left of the Ransomware Boom/ —
2021-10-11 - Necro Python Botnet Goes After Vulnerable VisualTools DVR/ —
2021-10-11 - SnapMC skips ransomware, steals data/ —
2021-10-12 - Continued Exploitation of CVE-2021-26084/ —
2021-10-12 - Defining Cobalt Strike Components So You Can BEA-CONfident in Your Analysis/ —
2021-10-12 - ECX- Big Game Hunting on the Rise Following a Notable Reduction in Activity/ —
2021-10-12 - Going Coast to Coast - Climbing the Pyramid with the Deimos Implant/ —
2021-10-12 - Malspam Campaign Delivers Dark Crystal RAT (dcRAT)/ —
2021-10-12 - MysterySnail attacks with Windows zero-day/ —
2021-10-12 - The King is Dead, Long Live MyKings! (Part 1 of 2)/ —
2021-10-13 - AtomSilo Ransomware/ —
2021-10-13 - BlackBerry Shines Spotlight on Evolving Cobalt Strike Threat in New Book/ —
2021-10-13 - CetaRAT APT Group – Targeting the Government Agencies/ —
2021-10-13 - The ad blocker that injects ads/ —
2021-10-13 - Trickbot Rising — Gang Doubles Down on Infection Efforts to Amass Network Footholds/ —
2021-10-13 - Trouble in Asia and the Middle East. Tracking the TransparentTribe threat actor/ —
2021-10-13 - We analyzed 80 million ransomware samples – here’s what we learned/ —
2021-10-13 - “Spytech Necro” – Keksec’s Latest Python Malware/ —
2021-10-14 - A Handshake with MySQL Bots/ —
2021-10-14 - Alert (AA21-287A) Ongoing Cyber Threats to U.S. Water and Wastewater Systems/ —
2021-10-14 - Analyzing Email Services Abused for Business Email Compromise/ —
2021-10-14 - Attackers Are Taking Advantage of the Open-Source Service Interactsh for Malicious Purposes/ —
2021-10-14 - Countering threats from Iran (APT35)/ —
2021-10-14 - Explosive New MirrorBlast Campaign Targets Financial Companies/ —
2021-10-14 - New Yanluowang ransomware used in targeted attacks/ —
2021-10-14 - Phishers Get Clever, Use Math Symbols for Verizon Logo/ —
2021-10-15 - AtomSilo Ransomware Enters the League of Double Extortion/ —
2021-10-15 - BlackByte Ransomware – Pt 2. Code Obfuscation Analysis/ —
2021-10-15 - BlackByte Ransomware – Pt. 1 In-depth Analysis/ —
2021-10-15 - Memory Forensics R&D Illustrated- Detecting Mimikatz's Skeleton Key Attack/ —
2021-10-15 - Ransomware Operators Found Using New -Franchise- Business Model/ —
2021-10-15 - Recovering registry hives encrypted by LockBit 2.0/ —
2021-10-17 - Building highly interactive honeypots- CVE-2021-41773 case study/ —
2021-10-17 - REvil ransomware shuts down again after Tor sites were hijacked/ —
2021-10-18 - Alert (AA21-291A)- BlackMatter Ransomware/ —
2021-10-18 - Case Study- From BazarLoader to Network Reconnaissance/ —
2021-10-18 - Harvester - Nation-state-backed group uses new toolset to target victims in South Asia/ —
2021-10-18 - Harvester- Nation-state-backed group uses new toolset to target victims in South Asia/ —
2021-10-18 - IcedID to XingLocker Ransomware in 24 hours/ —
2021-10-18 - Is There Really Such a Thing as a Low-Paid Ransomware Operator-/ —
2021-10-18 - Karma Ransomware - An Emerging Threat With A Hint of Nemty Pedigree/ —
2021-10-18 - Profiling hackers using the Malvertising Attack Matrix by Confiant/ —
2021-10-18 - REvil Disappears Again- ‘Something Is Rotten in the State of Ransomware’/ —
2021-10-18 - Suspected Chinese hackers behind attacks on ten Israeli hospitals/ —
2021-10-18 - ZLoader Reversing/ —
2021-10-19 - A Roaming Threat to Telecommunications Companies/ —
2021-10-19 - Cybercriminals cash in on black market vaccine schemes/ —
2021-10-19 - Good for Evil- DeepBlueMagic Ransomware Group Abuses Legit Encryption Tools/ —
2021-10-19 - LightBasin- A Roaming Threat to Telecommunications Companies/ —
2021-10-19 - Malicious campaign uses a barrage of commodity RATs to target Afghanistan and India/ —
2021-10-19 - PurpleFox Adds New Backdoor That Uses WebSockets/ —
2021-10-19 - q-logger skimmer keeps Magecart attacks going/ —
2021-10-19 - Social Network Account Stealers Hidden in Android Gaming Hacking Tool/ —
2021-10-19 - STRRAT, ZLoader, and HoneyGain/ —
2021-10-19 - The layered infrastructure operated by APT29/ —
2021-10-19 - Trickbot module descriptions/ —
2021-10-19 - WeTheNorth- A New Canadian Dark Web Marketplace/ —
2021-10-19 - Whatta TA - TA505 Ramps Up Activity, Delivers New FlawedGrace Variant/ —
2021-10-19 - Whatta TA- TA505 Ramps Up Activity, Delivers New FlawedGrace Variant/ —
2021-10-20 - Digitally-Signed Rootkits are Back – A Look at FiveSys and Companions/ —
2021-10-20 - Hidden in Plain Sight- Identifying Cryptography in BLACKMATTER Ransomware/ —
2021-10-20 - New Espionage Campaign Targets South East Asia/ —
2021-10-20 - Newly Found npm Malware Mines Cryptocurrency on Windows, Linux, macOS Devices/ —
2021-10-20 - Persistence and Privilege Escalation on Windows via Print Processors/ —
2021-10-20 - Phishing campaign targets YouTube creators with cookie theft malware/ —
2021-10-20 - Russian-speaking cybercrime evolution- What changed from 2016 to 2021/ —
2021-10-20 - TA551 Uses ‘SLIVER’ Red Team Tool in New Activity/ —
2021-10-20 - TM Follow-Up (TAG_APT35_14-10-21)/ —
2021-10-20 - Two Individuals (Pavel Stassi & Aleksandr Skorodumov) Sentenced for Providing “Bulletproof Hosting” for Cybercriminals/ —
2021-10-20 - VNC Malware (TinyNuke, TightVNC) Used by Kimsuky Group/ —
2021-10-20 - VNC Malware TinyNuke TightVNC Used by Kimsuky Group/ —
2021-10-21 - Apache HTTP Server CVE-2021-42013 and CVE-2021-41773 Exploited in the Wild/ —
2021-10-21 - Chrome targeted by Magnitude exploit kit/ —
2021-10-21 - Cobalt Strike- Using Known Private Keys To Decrypt Traffic – Part 1/ —
2021-10-21 - DBatLoader- Abusing Discord to Deliver Warzone RAT/ —
2021-10-21 - Evil Corp demands $40 million in new Macaw ransomware attacks/ —
2021-10-21 - FIN7 Recruits Talent For Push Into Ransomware/ —
2021-10-21 - Franken-phish- TodayZoo built from other phishing kits/ —
2021-10-21 - How to- Threat hunting and threat intelligence/ —
2021-10-21 - Initial Access Broker Landscape/ —
2021-10-21 - Massive campaign uses YouTube to push password-stealing malware/ —
2021-10-21 - Multi-Staged JSOutProx RAT Targets Indian Co-operative Banks and Finance Companies/ —
2021-10-21 - Stopping GRACEFUL SPIDER- Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign/ —
2021-10-21 - ​​Raccoon Stealer Under the Lens- A Deep-dive Analysis/ —
2021-10-21 - “Missed Voice Message,” the Latest Phishing Lure/ —
2021-10-22 - Advanced IP Scanner- the preferred scanner in the A(P)T toolbox/ —
2021-10-22 - Assassinations of -MiniNinja- in Various APAC Countries/ —
2021-10-22 - DarkSide bitcoins on the move following government cyberattack against REvil ransomware group/ —
2021-10-22 - DarkSide ransomware rushes to cash out $7 million in Bitcoin/ —
2021-10-22 - EXCLUSIVE Governments turn tables on ransomware gang REvil by pushing it offline/ —
2021-10-22 - New MultiloginBot Phishing Campaign/ —
2021-10-22 - Recent Attack Uses Vulnerability on Confluence Server/ —
2021-10-22 - Spectre v4.0 - The Speed of Malware Threats After the Pandemics/ —
2021-10-22 - Threat Advisory- Hackers Are Exploiting a Vulnerability in Popular Billing Software to Deploy Ransomware/ —
2021-10-22 - “Page Not Found”- REvil Darknet Services Offline After Attack Last Weekend/ —
2021-10-23 - Links to Previous Attacks in UAParserJS Compromise/ —
2021-10-24 - Breaking the News New York Times Journalist Ben Hubbard Hacked with Pegasus after Reporting on Previous Hacking Attempts/ —
2021-10-24 - New activity from Russian actor Nobelium/ —
2021-10-24 - Node poisoning- hijacked package delivers coin miner and credential-stealing backdoor/ —
2021-10-25 - Bear in the Net- A Network-Focused Perspective on Berserk Bear/ —
2021-10-25 - Conti Ransom Gang Starts Selling Access to Victims/ —
2021-10-25 - Digital banking fraud- how the Gozi malware works/ —
2021-10-25 - NOBELIUM targeting delegated administrative privileges to facilitate broader attacks/ —
2021-10-25 - OverWatch Elite In Action- Prompt Call Escalation Proves Vital to Containing Attack/ —
2021-10-25 - TeamTNT Continues to Target Exposed Docker API/ —
2021-10-25 - UAParser.js npm Package Supply Chain Attack- Impact and Response/ —
2021-10-25 - UltimaSMS- A widespread premium SMS scam on the Google Play Store/ —
2021-10-25 - WebAssembly Is Abused by eCriminals to Hide Malware/ —
2021-10-26 - Almost 100 Organizations in Brazil Targeted with Banking Trojan/ —
2021-10-26 - APT trends report Q3 2021/ —
2021-10-26 - Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 1/ —
2021-10-26 - DRIDEX- Analysing API Obfuscation Through VEH/ —
2021-10-26 - EP 103- Cloud Hopper/ —
2021-10-26 - High(er) Fidelity Software Supply Chain Attack Detection/ —
2021-10-26 - Malware WinDealer used by LuoYu Attack Group/ —
2021-10-26 - Mercenary APTs – An Exploration/ —
2021-10-26 - Protect your business from password sprays with Microsoft DART recommendations/ —
2021-10-26 - SQUIRRELWAFFLE Leverages malspam to deliver Qakbot Cobalt Strike/ —
2021-10-26 - SQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike/ —
2021-10-27 - [RE025] TrickBot ... many tricks/ —
2021-10-27 - Avast releases decryptor for AtomSilo and LockFile ransomware/ —
2021-10-27 - Cobalt Strike- Using Known Private Keys To Decrypt Traffic – Part 2/ —
2021-10-27 - Code similarity analysis with r2diaphora/ —
2021-10-27 - Evading EDR Detection with Reentrancy Abuse/ —
2021-10-27 - Extracting type information from Go binaries/ —
2021-10-27 - Github Repo for TripleCross/ —
2021-10-27 - New Threat Actor Spoofs Philippine Government COVID-19 Health Data in Widespread RAT Campaigns/ —
2021-10-27 - New Threat Actor Spoofs Philippine Government, COVID-19 Health Data in Widespread RAT Campaigns/ —
2021-10-27 - Portable Executable File Infecting Malware Is Increasingly Found in OT Networks/ —
2021-10-27 - Tales From the Cryptojacking Front Lines/ —
2021-10-27 - THREAT ALERT- Malicious Code Implant in the UAParser.js Library/ —
2021-10-27 - Vidar stealer campaign targeting Baltic region and NATO entities/ —
2021-10-27 - Wslink - Unique and undocumented malicious loader that runs as a server/ —
2021-10-27 - Wslink- Unique and undocumented malicious loader that runs as a server/ —
2021-10-28 - A Detailed Walkthrough of Ranzy Locker Ransomware TTPs/ —
2021-10-28 - Chaos Ransomware Variant in Fake Minecraft Alt List Brings Destruction to Japanese Gamers/ —
2021-10-28 - DECAF Ransomware- A New Golang Threat Makes Its Appearance/ —
2021-10-28 - Mutmaßlicher Ransomware-Millionär identifiziert/ —
2021-10-28 - Rooting Malware Makes a Comeback Lookout Discovers Global Campaign/ —
2021-10-28 - Rooting Malware Makes a Comeback- Lookout Discovers Global Campaign/ —
2021-10-28 - Russian National (Vladimir Dunaev) Extradited to United States to Face Charges for Alleged Role in Cybercriminal Organization/ —
2021-10-28 - Spook Ransomware - Prometheus Derivative Names Those That Pay, Shames Those That Don’t/ —
2021-10-28 - TA575 Uses ‘Squid Game’ Lures to Distribute Dridex malware/ —
2021-10-28 - Tactics, Techniques, and Indicators of Compromise Associated with Hello KittyFiveHands Ransomware/ —
2021-10-28 - Termination of Federal Unemployment Programs Represents Turning Point for Fraudsters/ —
2021-10-28 - THREAT ANALYSIS REPORT- Snake Infostealer Malware/ —
2021-10-28 - Urgency, Mail Relay Serve Phishers Well on Craigslist/ —
2021-10-29 - OpenCTI data sharing/ —
2021-10-29 - Pink, a botnet that competed with the vendor to control the massive infected devices/ —
2021-10-29 - TAG Bulletin- Q3 2021/ —
2021-10-30 - Reversing CryptoCrazy Ransomware - PoC Decryptor and some Tricks/ —
2021-10-31 - A detailed analysis of the STOP-Djvu Ransomware/ —
2021-10-31 - Measuring User Behavior/ —
2021-11-01 - BlackMatter- New Data Exfiltration Tool Used in Attacks/ —
2021-11-01 - Cybercrime underground flush with shipping companies credentials/ —
2021-11-01 - Deceive the Heavens to Cross the Sea - Over 300K Infections via Droppers on Google Play Store/ —
2021-11-01 - Diving into double extortion campaigns/ —
2021-11-01 - From Thanos to Prometheus- When Ransomware Encryption Goes Wrong/ —
2021-11-01 - From Zero to Domain Admin/ —
2021-11-01 - The Hack that Changed the World/ —
2021-11-01 - Two Tools for Malware Analysis and Reverse Engineering in Ghidra/ —
2021-11-02 - Adults Only Malware Lures/ —
2021-11-02 - BlackMatter Ransomware- In-Depth Analysis & Recommendations/ —
2021-11-02 - Cobalt Strike Process Injection/ —
2021-11-02 - Detecting CONTI CobaltStrike Lateral Movement Techniques - Part 2/ —
2021-11-02 - FBI Warning- HelloKitty Ransomware Add DDoS to Extortion Arsenal/ —
2021-11-02 - Hunting for potential network beaconing patterns using Apache Spark via Azure Synapse – Part 1/ —
2021-11-02 - Lamwac/ —
2021-11-02 - Malware analysis- Hands-On Shellbot malware/ —
2021-11-02 - New Malware “Gameloader” in Discord Malspam Campaign Identified by GoSecure Titan Labs/ —
2021-11-02 - Underminer Exploit Kit- The More You Check The More Evasive You Become/ —
2021-11-02 - US seeks extradition of alleged Ukrainian scammer arrested at Polish border stop/ —
2021-11-02 - ‘Destructive’ cyberattack hits National Bank of Pakistan/ —
2021-11-03 - BlackMatter ransomware moves victims to LockBit after shutdown/ —
2021-11-03 - BlackMatter ransomware says its shutting down due to pressure from local authorities/ —
2021-11-03 - Cobalt Strike- Using Process Memory To Decrypt Traffic – Part 3/ —
2021-11-03 - Credit card skimmer evades Virtual Machines/ —
2021-11-03 - DirtyMoe- Deployment/ —
2021-11-03 - Dissecting new AppleSeed backdoor of Kimsuky threat actor/ —
2021-11-03 - Identification of a new cybercriminal group- Lockean/ —
2021-11-03 - Mekotio Banker Returns with Improved Stealth and Ancient Encryption/ —
2021-11-03 - Microsoft Exchange vulnerabilities exploited once again for ransomware, this time with Babuk/ —
2021-11-03 - New Tool- cs-extract-key.py/ —
2021-11-03 - TeamTNT Upgrades Arsenal, Refines Focus on Kubernetes and GPU Environments/ —
2021-11-03 - The Darker Things BlackMatter and their victims/ —
2021-11-03 - Use EVTX files on VirusTotal with Timesketch and Sigma (Part1)/ —
2021-11-03 - Webinject Panel Administration- A Vantage Point into Multiple Threat Actor Campaigns - A Case Study on the Value of Threat Reconnaisance/ —
2021-11-04 - Blackboxing Diebold-Nixdorf ATMs/ —
2021-11-04 - CARBON SPIDER Embraces Big Game Hunting, Part 2/ —
2021-11-04 - Caught Beneath the Landline- A 411 on Telephone Oriented Attack Delivery/ —
2021-11-04 - Deep Dive into a Fresh Variant of Snake Keylogger Malware/ —
2021-11-04 - Detecting IcedID... Could It Be A Trickbot Copycat-/ —
2021-11-04 - DoD's 2021 China Military Power Report- How Advances in AI and Emerging Technologies Will Shape China’s Military/ —
2021-11-04 - Google fixes Android zero-day exploited in the wild in targeted attacks (CVE-2021-1048)/ —
2021-11-04 - SSU identified FSB hackers who carried out more than 5,000 cyberattacks on state bodies of Ukraine (video)/ —
2021-11-04 - Technical report Armagedon/ —
2021-11-04 - Threat Thursday- Karma Ransomware/ —
2021-11-04 - Understanding the Windows JavaScript Threat Landscape/ —
2021-11-05 - A Review and Analysis of 2021 Buer Loader Campaigns/ —
2021-11-05 - Hunter Becomes Hunted Zebra2104 Hides a Herd of Malware/ —
2021-11-05 - Hunter Becomes Hunted- Zebra2104 Hides a Herd of Malware/ —
2021-11-05 - Jury Convicts Chinese Intelligence Officer of Espionage Crimes, Attempting to Steal Trade Secrets (Yanjun Xu)/ —
2021-11-05 - Spike in DanaBot Malware Activity/ —
2021-11-05 - The BigBoss Rules- Something about one of the Uroburos’ RPC-based backdoors/ —
2021-11-07 - CONTI Ransomware- Cheat Sheet/ —
2021-11-07 - Godzilla Webshell/ —
2021-11-07 - IronTiger APT campaign New HyperBro and SysUpdate samples/ —
2021-11-07 - Selling China's Story/ —
2021-11-07 - Targeted Attack Campaign Against ManageEngine ADSelfService Plus Delivers Godzilla Webshells, NGLite Trojan and KdcSponge Stealer/ —
2021-11-07 - Who Will Bend the Knee in RaaS Game of Thrones in 2022-/ —
2021-11-08 - Desorden Group Reportedly Hacks Centara Hotels & Resorts Within 10 Minutes After Recovering From the First Data Breach/ —
2021-11-08 - Devices of Palestinian Human Rights Defenders Hacked with NSO Group’s Pegasus Spyware/ —
2021-11-08 - Hacking group says it has found encryption keys needed to unlock the PS5 [Updated]/ —
2021-11-08 - In-Depth Analysis of Ransom Note Files/ —
2021-11-08 - Popular NPM Repositories Compromised in Man-in-the-Middle Attack/ —
2021-11-08 - REvil Ransom Arrest, $6M Seizure, and $10M Reward/ —
2021-11-08 - TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access/ —
2021-11-08 - Threat actor DEV-0322 exploiting ZOHO ManageEngine ADSelfService Plus/ —
2021-11-08 - Treasury Continues to Counter Ransomware as Part of Whole-of-Government Effort; Sanctions Ransomware Operators and Virtual Currency Exchange (Yaroslav Vasinskyi & Yevgeniy Polyanin)/ —
2021-11-08 - Ukrainian Arrested and Charged with Ransomware Attack on Kaseya/ —
2021-11-08 - WANTED poster for Yevhgyeniy Polyanin (REvil affiliate)/ —
2021-11-08 - “A grim outlook”- How cyber surveillance is booming on a global scale/ —
2021-11-09 - [EX008] The exploit chain allows to take control of Zalo user accounts/ —
2021-11-09 - A New DatopLoader Delivers QakBot Trojan/ —
2021-11-09 - Cisco Talos finds 10 vulnerabilities in Azure Sphere’s Linux kernel, Security Monitor and Pluton/ —
2021-11-09 - Compromised Docker Hub Accounts Abused for Cryptomining Linked to TeamTNT/ —
2021-11-09 - Scheming with URLs- One-Click Attack Surface in Linux Desktop Environments/ —
2021-11-09 - The Invisible JavaScript Backdoor/ —
2021-11-09 - THREAT ANALYSIS REPORT- From Shatak Emails to the Conti Ransomware/ —
2021-11-09 - Who are latest targets of cyber group Lyceum-/ —
2021-11-10 - -He does not get in touch-- what is known about Barnaul, wanted by the FBI on charges of cybercrime/ —
2021-11-10 - Lazaus - NukeSped/ —
2021-11-10 - mai1zhi2 - SharpBeacon - CobaltStrike Beacon written in .Net 4/ —
2021-11-10 - North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets/ —
2021-11-10 - PhoneSpy- The App-Based Cyberattack Snooping South Korean Citizens/ —
2021-11-10 - Ploutus ATM Malware Case Study- Automated Deobfuscation of a Strongly Obfuscated .NET Binary/ —
2021-11-10 - REvil Under the Microscope/ —
2021-11-10 - Stories from the SOC - Powershell, Proxyshell, Conti TTPs OH MY!/ —
2021-11-10 - The hunt for NOBELIUM, the most sophisticated nation-state attack in history/ —
2021-11-10 - The Newest Malicious Actor- “Squirrelwaffle” Malicious Doc/ —
2021-11-10 - TR-64 - Exploited Exchange Servers - Mails with links to malware from known-valid senders/ —
2021-11-10 - Use EVTX files on VirusTotal with Timesketch and Sigma (Part 2)/ —
2021-11-10 - Void Balaur and the Rise of the Cybermercenary Industry (IOCs)/ —
2021-11-10 - Void Balaur/ —
2021-11-10 - Walking on APT31 infrastructure footprints/ —
2021-11-10 - Zero-Day Disclosure- Palo Alto Networks GlobalProtect VPN CVE-2021-3064/ —
2021-11-11 - A Duck Nightmare Quakbot Strikes with QuakNightmare Exploitation/ —
2021-11-11 - Analyzing a watering hole campaign using macOS exploits/ —
2021-11-11 - AT&T Alien Labs finds new Golang malware (BotenaGo) targeting millions of routers and IoT devices with more than 30 exploits/ —
2021-11-11 - BazarLoader ‘call me back’ attack abuses Windows 10 Apps mechanism/ —
2021-11-11 - FIN7 Tools Resurface in the Field – Splinter or Copycat-/ —
2021-11-11 - HTML smuggling surges- Highly evasive loader technique increasingly used in banking malware, targeted attacks/ —
2021-11-11 - Is SquirrelWaffle the New Emotet- How to Detect the Latest MalSpam Loader/ —
2021-11-11 - Magniber ransomware gang now exploits Internet Explorer flaws in attacks/ —
2021-11-11 - OSX.CDDS a sophisticated watering hole campaign drops a new macOS implant!/ —
2021-11-11 - SharkBot- a new generation of Android Trojans is targeting banks in Europe/ —
2021-11-11 - SideCopy organization's recent attack incident analysis using China-India current affairs news/ —
2021-11-11 - Stopping Cybersecurity Threats- Why Databases Matter/ —
2021-11-11 - TeamTNT Upgrades Arsenal, Refines Focus on Kubernetes and GPU Environments/ —
2021-11-11 - Threat Thursday- SquirrelWaffle Takes a Bite Out of Victim's Bank Accounts/ —
2021-11-11 - To Joke or Not to Joke- COVID-22 Brings Disaster to MBR/ —
2021-11-12 - A multi-stage PowerShell based attack targets Kazakhstan/ —
2021-11-12 - AgentTesla dropped via NSIS installer/ —
2021-11-12 - Golang Malware Is More than a Fad- Financial Motivation Drives Adoption/ —
2021-11-12 - Malware Analysis- Syscalls- Examining how to analyse malware that uses syscalls as opposed to API calls/ —
2021-11-12 - New Threat Alert- Krane Malware/ —
2021-11-13 - QAKBOT Loader Returns With New Techniques and Tools/ —
2021-11-13 - Threat Spotlight - Domain Fronting/ —
2021-11-15 - Emotet malware is back and rebuilding its botnet via TrickBot/ —
2021-11-15 - Evasive maneuvers- HTML smuggling explained/ —
2021-11-15 - Exchange Exploit Leads to Domain Wide Ransomware/ —
2021-11-15 - Fake Ransomware Infection Spooks Website Owners/ —
2021-11-15 - Finding Beacons in the Dark - A Guide to CTI (X)/ —
2021-11-15 - Groups Target Alibaba ECS Instances for Cryptojacking/ —
2021-11-15 - Guess who’s back/ —
2021-11-15 - How cryptomixers allow cybercriminals to clean their ransoms/ —
2021-11-15 - Infect If Needed - A Deeper Dive Into Targeted Backdoor macOS.Macma/ —
2021-11-15 - KIMSUKY- OP Light-Shell/ —
2021-11-15 - ProxyShell, QBot, and Conti Ransomware Combined in a Series of Cyberattacks/ —
2021-11-15 - Uncovering MosesStaff techniques- Ideology over Money/ —
2021-11-16 - Attackers use domain fronting technique to target Myanmar with Cobalt Strike/ —
2021-11-16 - Comeback of Emotet/ —
2021-11-16 - Emotet Returns/ —
2021-11-16 - Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021/ —
2021-11-16 - Excel 4 macro code obfuscation/ —
2021-11-16 - Global Operations Lead to Arrests of Alleged Members of GandCrab-REvil and Cl0p Cartels/ —
2021-11-16 - Hands-On Muhstik Botnet- crypto-mining attacks targeting Kubernetes/ —
2021-11-16 - How IronNet's Behavioral Analytics Detect REvil and Conti Ransomware/ —
2021-11-16 - New Type of Supply Chain Attack Could Put Popular Admin Tools at Risk/ —
2021-11-16 - Office Documents- May the XLL technique change the threat Landscape in 2022-/ —
2021-11-16 - RAMP Ransomware’s Apparent Overture to Chinese Threat Actors/ —
2021-11-16 - Return of Emotet malware/ —
2021-11-16 - Strategic web compromises in the Middle East with a pinch of Candiru/ —
2021-11-16 - Taking Action Against Hackers in Pakistan and Syria/ —
2021-11-16 - TrickBot helps Emotet come back from the dead/ —
2021-11-16 - UNC1151 Assessed with High Confidence to have Links to Belarus, Ghostwriter Campaign Aligned with Belarusian Government Interests/ —
2021-11-16 - Vulnerability Intelligence- What’s the Word in Dark Web Forums-/ —
2021-11-16 - ‘Ghostwriter’ Looks Like a Purely Russian Op - Except It's Not/ —
2021-11-17 - An in-depth look at hacking back, active defense, and cyber letters of marque/ —
2021-11-17 - Analyzing ProxyShell-related Incidents via Trend Micro Managed XDR/ —
2021-11-17 - Astaroth- Banking Trojan/ —
2021-11-17 - BrazKing Android Malware Upgraded and Targeting Brazilian Banks/ —
2021-11-17 - Cobalt Strike- Decrypting Obfuscated Traffic – Part 4/ —
2021-11-17 - Creating your first Microsoft Sentinel Notebook/ —
2021-11-17 - DNS Over HTTPS for Cobalt Strike/ —
2021-11-17 - Evil Corp- 'My hunt for the world's most wanted hackers'/ —
2021-11-17 - GitHub - cube0x0 - SharpMapExec/ —
2021-11-17 - Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities/ —
2021-11-17 - ProxyNoShell- A Change in Tactics Exploiting ProxyShell Vulnerabilities/ —
2021-11-17 - Ransomware (R)evolution Plagues Organizations, But CrowdStrike Protection Never Wavers/ —
2021-11-17 - Sorveglianza- l’azienda italiana che vuole sfidare i colossi NSO e Palantir/ —
2021-11-18 - APT41 Perfects Code Signing Abuse to Escalate Supply Chain Attacks/ —
2021-11-18 - BlackMatter, LockBit, and THOR/ —
2021-11-18 - Conti Ransomware Group In-Depth Analysis/ —
2021-11-18 - Conti Ransomware Nets at Least $25.5 Million in Four Months/ —
2021-11-18 - Conti Ransomware/ —
2021-11-18 - Emotet Activity Identified/ —
2021-11-18 - Intelligence Insights- November 2021/ —
2021-11-18 - Introducing Mandiant's Digital Forensics and Incident Response Framework for Embedded OT Systems/ —
2021-11-18 - Iranian targeting of IT sector on the rise/ —
2021-11-18 - Linux malware agent hits eCommerce sites/ —
2021-11-18 - Netskope Threat Coverage- The Return of Emotet/ —
2021-11-18 - New ransomware actor uses password protected archives to bypass encryption protection/ —
2021-11-18 - New ransomware actor uses password-protected archives to bypass encryption protection/ —
2021-11-18 - The Art of PerSwaysion Investigation of a Long-Lived Phishing Kit/ —
2021-11-18 - The awakening- Group-IB uncovers new corporate espionage attacks by RedCurl/ —
2021-11-18 - The Pitfall of Threat Intelligence Whitelisting- Specter Botnet is 'taking over' Top Legit DNS Domains By Using ClouDNS Service/ —
2021-11-18 - Threat Thursday- DanaBot’s Evolution from Bank Fraud to DDos Attacks/ —
2021-11-18 - Treasury Sanctions Iran Cyber Actors for Attempting to Influence the 2020 U.S. Presidential Election/ —
2021-11-18 - Triple Threat North Korea-Aligned TA406 Steals, Scams and Spies/ —
2021-11-18 - Triple Threat- North Korea-Aligned TA406 Scams, Spies, and Steals/ —
2021-11-18 - Two Iranian Nationals Charged for Cyber-Enabled Disinformation and Threat Campaign Designed to Influence the 2020 U.S. Presidential Election ( Seyyed Mohammad Hosein Musa Kazemi & Sajjad Kashian )/ —
2021-11-19 - Im Rätsel um gruselige Spionage-Software führt die Spur über Wirecard in den Kreml/ —
2021-11-19 - Is a coordinated cyberattack brewing in the escalating Russian-Ukrainian conflict-/ —
2021-11-19 - It is suspected that the APT-C-55 organization used the commercial software Web Browser Password Viewer to carry out the attack/ —
2021-11-19 - It’s a BEE! It’s a… no, it’s ShadowPad/ —
2021-11-19 - La Botnet de EMOTET reinicia ataques en Chile y LATAM/ —
2021-11-19 - Malware Emotet resumes its activities for the first time in 10 months, and Japan is also the target of the attack/ —
2021-11-19 - Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains/ —
2021-11-19 - The New Threat- Mallox Ransomware/ —
2021-11-20 - Corporate Loader -Emotet-- History of -X- Project Return for Ransomware/ —
2021-11-21 - Dridex Trojan - Defeating Anti-Analysis - Strings Decryption - C&C Extraction/ —
2021-11-22 - Powershell and DnSpy tricks in .NET reversing – AgentTesla [Part1]/ —
2021-11-22 - Powershell and DnSpy tricks in .NET reversing – AgentTesla [Part2]/ —
2021-11-22 - Tardigrade - APT Attack on the Bioeconomy/ —
2021-11-23 - A Long List Of Arkei Stealer's Crypto Browser Wallets/ —
2021-11-23 - Android APT spyware, targeting Middle East victims, enhances evasiveness/ —
2021-11-23 - Babadeda Crypter targeting crypto, NFT, and DeFi communities/ —
2021-11-23 - BazarLoader Adds Compromised Installers, ISO to Arrival and Delivery Vectors/ —
2021-11-23 - HANCITOR- Analysing The Malicious Document/ —
2021-11-23 - Mummy Spider’s Emotet Malware is Back After a Year Hiatus; Wizard Spider’s TrickBot Observed in Its Return/ —
2021-11-23 - RATDispenser- Stealthy JavaScript Loader Dispensing RATs into the Wild/ —
2021-11-24 - Anatomy of COBRA/ —
2021-11-24 - CronRAT malware hides behind February 31st/ —
2021-11-24 - From the archive #1- OSTap downloader deobfuscation and analysis/ —
2021-11-24 - New PowerShortShell Stealer Exploits Recent Microsoft MSHTML Vulnerability to Spy on Farsi Speakers/ —
2021-11-25 - A Deep Dive Into SoWaT - APT31’s Multifunctional Router Implant/ —
2021-11-25 - A Deep Dive Into SoWaT- APT31’s Multifunctional Router Implant/ —
2021-11-25 - Emotet de retour, POC Exchange, 0-day Windows - à quelle sauce les attaquants prévoient de nous manger cette semaine-/ —
2021-11-27 - Halos Gate Evolves - Tartarus Gate/ —
2021-11-29 - Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites/ —
2021-11-29 - CONTInuing the Bazar Ransomware Story/ —
2021-11-29 - Kitten.gif- Meet the Sabbath Ransomware Affiliate Program, Again/ —
2021-11-29 - Nowhere to Hide- Detecting SILENT CHOLLIMA’s Custom Tooling/ —
2021-11-29 - Pysa Ransomware Under the Lens- A Deep-Dive Analysis/ —
2021-11-29 - ScarCruft surveilling North Korean defectors and human rights activists/ —
2021-11-29 - Unpatched Exchange Servers distribute Phishing Links (SquirrelWaffle)/ —
2021-11-29 - WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019/ —
2021-11-30 - Cyberspace's Magic Eye- PROMETHIUM Fakes attack activity analysis of NotePads and installation packages/ —
2021-11-30 - EwDoor Botnet Is Attacking AT&T Customers/ —
2021-11-30 - Is -KAX17- performing de-anonymization Attacks against Tor Users-/ —
2021-11-30 - Just another analysis of the njRAT malware – A step-by-step approach/ —
2021-11-30 - ProxyShell exploitation leads to BlackByte ransomware/ —
2021-11-30 - The Re-Emergence of Emotet/ —
2021-11-30 - Yanluowang ransomware operation matures with experienced affiliates/ —
2021-11-30 - Yanluowang- Further Insights on New Ransomware Threat/ —
2021-12-01 - Analyzing How TeamTNT Used Compromised Docker Hub Accounts/ —
2021-12-01 - BlackCat Ransomware/ —
2021-12-01 - BlackTech, an East Asian hacking group, has launched attacks in sectors such as finance and education/ —
2021-12-01 - Injection is the New Black- Novel RTF Template Inject Technique Poised for Widespread Adoption Beyond APT Actors/ —
2021-12-01 - Injection is the New Black/ —
2021-12-01 - JUMPING THE AIR GAP - 15 years of nation-state effort/ —
2021-12-01 - Ransomware Spotlight- Conti/ —
2021-12-01 - Smishing Botnets Going Viral in Iran/ —
2021-12-01 - Toss a Coin to your Helper (Part 2 of 2)/ —
2021-12-01 - Tracking a P2P network related to TA505/ —
2021-12-02 - ABC Botnet Attacks on the Rise/ —
2021-12-02 - Alert (AA21-336A)- APT Actors Exploiting CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus/ —
2021-12-02 - APT Expands Attack on ManageEngine With Active Campaign Against ServiceDesk Plus/ —
2021-12-02 - Magnat campaigns use malvertising to deliver information stealer, backdoor and malicious Chrome extension/ —
2021-12-02 - Revix Linux Ransomware/ —
2021-12-02 - SideCopy APT Connecting lures to victims, payloads to infrastructure/ —
2021-12-02 - SideCopy APT- Connecting lures to victims, payloads to infrastructure/ —
2021-12-02 - Spreading AgentTesla through more sophisticated malicious PPT/ —
2021-12-02 - Structured threat hunting- One way Microsoft Threat Experts prioritizes customer defense/ —
2021-12-02 - TAG Bulletin- Q4 2021/ —
2021-12-03 - Hive Demo and IoCs/ —
2021-12-03 - Mobile banking fraud- BRATA strikes again/ —
2021-12-03 - TA551 (Shathak) pushes IcedID (Bokbot)/ —
2021-12-03 - TigerRAT Families/ —
2021-12-03 - TrickBot Leverages Zoom Work from Home Interview Malspam, Heaven’s Gate and… Spamhaus-/ —
2021-12-03 - Vulnerabilities Exploited for Monero Mining Malware Delivered via GitHub, Netlify/ —
2021-12-03 - Who Is the Network Access Broker ‘Babam’-/ —
2021-12-04 - APT-C-23 in Palestine/ —
2021-12-04 - Malicious KMSPico installers steal your cryptocurrency wallets/ —
2021-12-04 - Pivoting through malicious infrastructure- from ZoomPortable to Windscribe/ —
2021-12-06 - AGENT TESLAGGAH/ —
2021-12-06 - APT37 Using a New Android Spyware, Chinotto/ —
2021-12-06 - Attack Lifecycle Detection of an Operational Technology Breach/ —
2021-12-06 - Complaint filed by Microsoft against NICKEL-APT15/ —
2021-12-06 - Magecart Groups Abuse Google Tag Manager/ —
2021-12-06 - Mirai-based Botnet - Moobot Targets Hikvision Vulnerability/ —
2021-12-06 - NICKEL targeting government organizations across Latin America and Europe/ —
2021-12-06 - Phishing campaigns by the Nobelium intrusion set/ —
2021-12-06 - Protecting people from recent cyberattacks/ —
2021-12-06 - Suspected Russian Activity Targeting Government and Business Entities Around the Globe (UNC2452)/ —
2021-12-07 - Critical Hit- How DoppelPaymer Hunts and Kills Windows Processes/ —
2021-12-07 - Disrupting the Glupteba operation/ —
2021-12-07 - Emotet now drops Cobalt Strike, fast forwards ransomware attacks/ —
2021-12-07 - Exploit, steganography and Delphi- unpacking DBatLoader/ —
2021-12-07 - FIN13 A Cybercriminal Threat Actor Focused on Mexico/ —
2021-12-07 - FIN13- A Cybercriminal Threat Actor Focused on Mexico/ —
2021-12-07 - New action to combat cyber crime/ —
2021-12-07 - Revix Linux Ransomware/ —
2021-12-07 - Threat news TeamTNT stealing credentials using EC2 Instance Metadata/ —
2021-12-07 - Threat news- TeamTNT stealing credentials using EC2 Instance Metadata/ —
2021-12-07 - University Targeted Credential Phishing Campaigns Use COVID-19, Omicron Themes/ —
2021-12-07 - XE Group – Exposed- 8 Years of Hacking & Card Skimming for Profit/ —
2021-12-08 - Chasing Shadows - A deep dive into the latest obfuscation methods being used by ShadowPad/ —
2021-12-08 - Chasing Shadows- A deep dive into the latest obfuscation methods being used by ShadowPad/ —
2021-12-08 - Collector-stealer- a Russian origin credential and information extractor/ —
2021-12-08 - Full malware analysis Work-Flow of AgentTesla Malware/ —
2021-12-08 - The double extortion business- Conti Ransomware Gang finds new avenues of negotiation/ —
2021-12-08 - When old friends meet again- why Emotet chose Trickbot for rebirth/ —
2021-12-09 - A closer look at Qakbot’s latest building blocks (and how to knock them down)/ —
2021-12-09 - A new StrongPity variant hides behind Notepad++ installation/ —
2021-12-09 - Emotet’s Return- What’s Different-/ —
2021-12-09 - Inside the Hive- Deep dive into Hive RaaS, analysis of latest samples/ —
2021-12-09 - The Evolution of IoT Linux Malware Based on MITRE ATT&CK TTPs/ —
2021-12-10 - BlackCatConf - Static Configuration Extractor for BlackCat Ransomware/ —
2021-12-10 - Karakurt rises from its lair/ —
2021-12-10 - Log4j2 Vulnerability “Log4Shell” (CVE-2021-44228)/ —
2021-12-10 - New Yanluowang Ransomware Found to be Code-Signed, Terminates Database-Related Processes/ —
2021-12-11 - Apache Log4j Zero-Day Being Exploited in the Wild/ —
2021-12-11 - Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability/ —
2021-12-12 - Log4Shell Hell- anatomy of an exploit outbreak/ —
2021-12-12 - Log4Shell- Reconnaissance and post exploitation network detection/ —
2021-12-12 - More Flagpro, More Problems/ —
2021-12-13 - A Look Into Purple Fox’s Server Infrastructure/ —
2021-12-13 - Analysis of Initial In The Wild Attacks Exploiting Log4Shell-Log4J-CVE-2021-44228/ —
2021-12-13 - Diavol Ransomware/ —
2021-12-13 - Now You Serial, Now You Don’t — Systematically Hunting for Deserialization Exploits/ —
2021-12-13 - Return of Emotet- Malware Analysis/ —
2021-12-14 - Analysis of Novel Khonsari Ransomware Deployed by the Log4Shell Vulnerability/ —
2021-12-14 - Azure Run Command for Dummies/ —
2021-12-14 - Collecting In the Dark- Tropic Trooper Targets Transportation and Government/ —
2021-12-14 - Cuba Ransomware Analysis/ —
2021-12-14 - DarkWatchman A new evolution in fileless techniques/ —
2021-12-14 - DarkWatchman- A new evolution in fileless techniques/ —
2021-12-14 - Espionage Campaign Targets Telecoms Organizations across Middle East and Asia/ —
2021-12-14 - Full Spectrum Detections for 5 Popular Web Shells- Alfa, SharPyShell, Krypton, ASPXSpy, and TWOFACE/ —
2021-12-14 - Network Security Monitoring Opportunities and Best Practices for Log4j Defense/ —
2021-12-14 - Neutralizing Apache Log4j Exploits with Identity-Based Segmentation/ —
2021-12-14 - Owowa- the add-on that turns your OWA into a credential stealer and remote access panel/ —
2021-12-14 - Tropic Trooper Targets Transportation and Government Organizations/ —
2021-12-15 - APT31 INTRUSION SET CAMPAIGN/ —
2021-12-15 - Backdoored Client from Mongolian CA MonPass/ —
2021-12-15 - Log4Shell Initial Exploitation and Mitigation Recommendations/ —
2021-12-15 - Nation State Threat Group Targets Airline with Aclip Backdoor/ —
2021-12-15 - No Unaccompanied Miners- Supply Chain Compromises Through Node.js Packages (UNC3379)/ —
2021-12-15 - The dirty dozen of Latin America- From Amavaldo to Zumanek/ —
2021-12-15 - ThreatLabz analysis - Log4Shell CVE-2021-44228 Exploit Attempts/ —
2021-12-15 - Tracking Malicious Glupteba Activity Through the Blockchain/ —
2021-12-16 - Avast Finds Backdoor on US Government Commission Network/ —
2021-12-16 - Global outbreak of Log4Shell/ —
2021-12-16 - How the -Contact Forms- campaign tricks people/ —
2021-12-16 - Inside the LockBit Arsenal - The StealBit Exfiltration Tool/ —
2021-12-16 - Intelligence Insights- December 2021/ —
2021-12-16 - New DarkHotel APT attack chain identified/ —
2021-12-16 - Noberus- Technical Analysis Shows Sophistication of New Rust-based Ransomware/ —
2021-12-16 - Pegasus vs. Predator- Dissident's Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware/ —
2021-12-16 - Phorpiex botnet is back with a new Twizt- Hijacking Hundreds of crypto transactions/ —
2021-12-16 - PseudoManuscrypt - a mass-scale spyware attack campaign/ —
2021-12-16 - PseudoManuscrypt- a mass-scale spyware attack campaign/ —
2021-12-16 - Threat Thursday- Warzone RAT Breeds a Litter of ScriptKiddies/ —
2021-12-16 - Winnti is Coming - Evolution after Prosecution/ —
2021-12-17 - APT Actors Exploiting Newly-Identified Zero Day in ManageEngine Desktop Central/ —
2021-12-17 - Diavol Ransomware/ —
2021-12-17 - DSIRFWe unveil the “Subzero” state trojan from Austria/ —
2021-12-17 - Inside the code- How the Log4Shell exploit works/ —
2021-12-17 - noPac- A Tale of Two Vulnerabilities That Could End in Ransomware/ —
2021-12-17 - Ransomware Advisory- Log4Shell Exploitation for Initial Access & Lateral Movement/ —
2021-12-17 - Serverless InfoStealer delivered in Est European Countries/ —
2021-12-17 - Staging a Quack- Reverse Analyzing a Fileless QAKBOT Stager/ —
2021-12-17 - Wir enthüllen den Staatstrojaner „Subzero“ aus Österreich/ —
2021-12-19 - Exposed Docker APIs Abused by DDoS, Cryptojacking Botnet Malware/ —
2021-12-20 - (Don't) Bring Dridex Home for the Holidays/ —
2021-12-20 - Detecting anomalous network traffic resulting from a successful Log4j attack/ —
2021-12-20 - Log4j vulnerability now used to install Dridex banking malware/ —
2021-12-20 - Logjam- Log4j exploit attempts continue in globally distributed scans, attacks/ —
2021-12-20 - PowerPoint attachments, Agent Tesla and code reuse in malware/ —
2021-12-20 - Ransomware Spotlight- REvil/ —
2021-12-20 - STOP-DJVU Ransomware IOC List/ —
2021-12-21 - Attackers test “CAB-less 40444” exploit in a dry run/ —
2021-12-21 - China’s Narrative War on Democracy/ —
2021-12-21 - Ready-made fraud Behind the scenes of targeted scams/ —
2021-12-21 - The Continued Evolution of Abcbot/ —
2021-12-21 - The Log Keeps Rolling On- Evaluating Log4j Developments and Defensive Requirements/ —
2021-12-22 - Alert (AA21-356A) Mitigating Log4Shell and Other Log4j-Related Vulnerabilities/ —
2021-12-22 - APT Tracking Analytics- Transparent Tribe Attack Activity/ —
2021-12-22 - Avos Locker remotely accesses boxes, even running in Safe Mode/ —
2021-12-22 - CrowdStrike Launches Free Targeted Log4j Search Tool/ —
2021-12-22 - Emotet 2.0- Everything you need to know about the new Variant of the Banking Trojan/ —
2021-12-22 - Establishing the TigerRAT and TigerDownloader Malware Families/ —
2021-12-22 - Stopping a DreamBus Botnet Attack with Aqua’s CNDR/ —
2021-12-22 - The ‘STOP’ Ransomware Variant/ —
2021-12-23 - COVID-19 Phishing Lure to Steal and Mine Cryptocurrency/ —
2021-12-23 - Cyber Threat Profile MALTEIRO/ —
2021-12-23 - Elastic Security uncovers BLISTER malware campaign/ —
2021-12-23 - Hacker gains access to Hewlett-Packard 9000 EPYC server hardware to mine the cryptocurrency Raptoreum using Java exploit/ —
2021-12-23 - Log4j Vulnerabilities- Attack Insights/ —
2021-12-23 - New Rook Ransomware Feeds Off the Code of Babuk/ —
2021-12-23 - Snip3, an investigation into malware/ —
2021-12-23 - Threat Report- Echelon Malware Detected in Mobile Chat Forums/ —
2021-12-27 - A Deep Dive into DoubleFeature, Equation Group’s Post-Exploitation Dashboard/ —
2021-12-27 - A Deep Dive into DoubleFeature/ —
2021-12-28 - APT Attack Cases of Kimsuky Group (PebbleDash)/ —
2021-12-28 - Attackers are abusing MSBuild to evade defenses and implant Cobalt Strike beacons/ —
2021-12-28 - Cases of Lockis ransomware infection/ —
2021-12-28 - CrowdStrike Strengthens Exploit Protection Using Intel CPU Telemetry/ —
2021-12-28 - Extracting Hancitor’s Configuration with Ghidra part 1/ —
2021-12-28 - Flagpro - The new malware used by BlackTech/ —
2021-12-28 - Flagpro- The new malware used by BlackTech/ —
2021-12-28 - Iranian hackers behind Cox Media Group ransomware attack (DEV-0270)/ —
2021-12-28 - The attack on ONUS – A real-life case of the Log4Shell vulnerability/ —
2021-12-28 - The hacker-for-hire industry is now too big to fail/ —
2021-12-29 - AQUATIC PANDA in Possession of Log4Shell Exploit Tools/ —
2021-12-29 - AsyncRAT Configuration Parser/ —
2021-12-29 - Cobalt Strike DFIR- Listening to the Pipes/ —
2021-12-29 - Japan aerospace cyberattacks show link to Chinese military- police (PLA Unit 61419)/ —
2021-12-29 - OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt/ —
2021-12-29 - Strategically Aged Domain Detection- Capture APT Attacks With DNS Traffic Trends/ —
2021-12-29 - Take the lights-out Implant.ARM.iLOBleed.a/ —
2021-12-29 - Threat Alert- Evolving Attack Techniques of Autom Cryptomining Campaign/ —
2021-12-30 - Agent Tesla Updates SMTP Data Exfiltration Technique/ —
2021-12-30 - Ahnlab - Kimsuky/ —
2021-12-30 - Lights Out in Isfahan/ —
2021-12-30 - Technical Analysis of Khonsari Ransomware Campaign Exploiting the Log4Shell Vulnerability/ —
2021-12-30 - Vice Society- Ransomware Gang Disrupted Spar Stores/ —
2021-12-31 - APT28 SKINNYBOY - Cheat Sheet/ —
2021-12-31 - Compromised Godaddy Infrastructure Attacking Numerous U.S. Government Websites to Promote “Canadian Pharmacy” Scam Websites/ —
2021-12-31 - Do you want your Agent Tesla in the 300 MB or 8 kB package-/ —
2021-12-31 - HANCITOR- Analysing The Main Loader/ —
2021-12-31 - IKO activation - Malware campaign/ —