/vx/Malware Analysis/2023/

1450 directories 0 files
Name Size Modified
Go up — —
2023-01-01 - The Mac Malware of 2022/ —
2023-01-03 - BitRAT Now Sharing Sensitive Bank Data as a Lure/ —
2023-01-03 - Poland warns of attacks by Russia-linked Ghostwriter hacking group/ —
2023-01-03 - Raspberry Robin Detected ITW Targeting Insurance & Financial Institutes In Europe/ —
2023-01-04 - An In-Depth Look at PLAY Ransomware/ —
2023-01-04 - Cyberattacks against governments jumped 95% in last half of 2022, CloudSek says/ —
2023-01-04 - Pupy RAT hiding under WerFault’s cover/ —
2023-01-04 - Rackspace confirms Play ransomware was behind recent cyberattack/ —
2023-01-04 - UNC1151 Group Indicators of Compromise (IOC)/ —
2023-01-04 - Unpacking RedLine Stealer/ —
2023-01-05 - A crowning achievement- Exploring the exploit of Royal ransomware/ —
2023-01-05 - A Deep Dive Into poweRAT- a Newly Discovered Stealer-RAT Combo Polluting PyPI/ —
2023-01-05 - Blindeagle Targeting Ecuador with Sharpened Tools/ —
2023-01-05 - Bluebottle Campaign Hits Banks in French-speaking Countries in Africa/ —
2023-01-05 - Bluebottle- Campaign Hits Banks in French-speaking Countries in Africa/ —
2023-01-05 - Emulating the Highly Sophisticated North Korean Adversary Lazarus Group/ —
2023-01-05 - Gootloader Command & Control/ —
2023-01-05 - SpyNote- Spyware with RAT capabilities targeting Financial Institutions/ —
2023-01-05 - The Cyber Threat from Pyongyang/ —
2023-01-05 - Turla A Galaxy of Opportunity/ —
2023-01-05 - Turla- A Galaxy of Opportunity/ —
2023-01-05 - What is Gootloader-/ —
2023-01-06 - Coldriver Group Research Report/ —
2023-01-06 - Distribution of NetSupport RAT Malware Disguised as a Pokemon Game/ —
2023-01-06 - Exclusive Russian hackers targeted US nuclear scientists/ —
2023-01-06 - LummaC2 Stealer- A Potent Threat To Crypto Users/ —
2023-01-06 - Nisos Research Coldriver/ —
2023-01-07 - STISC - BEWARE - the wave of scam and phishing cyberattacks continues/ —
2023-01-09 - [QuickNote] Another nice PlugX sample/ —
2023-01-09 - Dark Web Profile- Royal Ransomware/ —
2023-01-09 - Emotet returns and deploys loaders/ —
2023-01-09 - Gootkit Loader Actively Targets Australian Healthcare Industry/ —
2023-01-09 - Unwrapping Ursnifs Gifts/ —
2023-01-10 - Be vigilant The modified CIA attack kit Hive enters the field of black and gray production/ —
2023-01-10 - Heads up! Xdr33, A Variant Of CIA’s HIVE Attack Kit Emerges/ —
2023-01-10 - Pro-Ukraine hackers leak Russian data in hopes someone will make sense of it/ —
2023-01-10 - StrongPity espionage campaign targeting Android users/ —
2023-01-10 - The Rebranded Crypter- ScrubCrypt/ —
2023-01-11 - Calling from the Underground- An alternative way to penetrate corporate networks/ —
2023-01-11 - Dark Pink - New APT hitting Asia-Pacific, Europe that goes deeper and darker/ —
2023-01-11 - Dark Pink/ —
2023-01-11 - Increasing The Sting of HIVE Ransomware/ —
2023-01-11 - T95-H616-Malware/ —
2023-01-12 - Android TV box on Amazon came pre-installed with malware/ —
2023-01-12 - CyOps Lighthouse- Vidar Stealer/ —
2023-01-12 - Gootloader Malware Leads to Cobalt Strike and Hand-on-Keyboard Activity/ —
2023-01-12 - NoName057(16) – The Pro-Russian Hacktivist Group Targeting NATO/ —
2023-01-12 - QakBot Malware Used Unpatched Vulnerability to Bypass Windows OS Security Feature/ —
2023-01-12 - Rhadamanthys- New Stealer Spreading Through Google Ads/ —
2023-01-13 - Getting Rusty and Stringy with Luna Ransomware/ —
2023-01-13 - Grandoreiro banking malware- deciphering the DGA/ —
2023-01-13 - Orcus RAT Being Distributed Disguised as a Hangul Word Processor Crack/ —
2023-01-13 - The cyber police exposed a hacker group that attacked foreign companies with an encryption virus/ —
2023-01-16 - Cybercrime, RFQ from Turkey carries AgentTesla and zgRAT/ —
2023-01-16 - Dancing With Shellcodes- Analyzing Rhadamanthys Stealer/ —
2023-01-16 - ProxyNotShell – OWASSRF – Merry Xchange/ —
2023-01-17 - Batloader Malware Abuses Legitimate Tools, Uses Obfuscated JavaScript Files in Q4 2022 Attacks/ —
2023-01-17 - Earth Bogle - Campaigns Target the Middle East with Geopolitical Lures/ —
2023-01-17 - Kasablanka Group Probably Conducted Compaigns Targeting Russia/ —
2023-01-18 - A long way to SectopRat/ —
2023-01-18 - Chinese Playful Taurus Activity in Iran/ —
2023-01-18 - Qihoo 360 - APT Annual Research Report/ —
2023-01-19 - Analysis of FG-IR-22-398 – FortiOS - heap-based buffer overflow in SSLVPNd/ —
2023-01-19 - Following the LNK metadata trail/ —
2023-01-19 - Gamaredon (Ab)uses Telegram to Target Ukrainian Organizations/ —
2023-01-19 - Gamaredon Abuses Telegram to Target Ukrainian Organizations/ —
2023-01-19 - Gigabud RAT- New Android RAT Masquerading as Government Agencies/ —
2023-01-19 - Suspected Chinese Threat Actors Exploiting FortiOS Vulnerability (CVE-2022-42475)/ —
2023-01-20 - Chinese Hackers Exploited Recent Fortinet Flaw as 0-Day to Drop Malware/ —
2023-01-20 - Emotet Returns With New Methods of Evasion/ —
2023-01-20 - Samsung investigating claims of hack on South Korea systems, internal employee platform/ —
2023-01-22 - BadBazaar- iOS and Android Surveillanceware by China’s APT15 Used to Target Tibetans and Uyghurs/ —
2023-01-23 - A -strange font- Smishing Campaign that changes behaviour based on User-Agent, and abuses Duck DNS/ —
2023-01-23 - Activation Context Cache Poisoning- Exploiting CSRSS for Privilege Escalation/ —
2023-01-23 - Black Basta – Technical Analysis/ —
2023-01-23 - FBI Confirms Lazarus Group Cyber Actors Responsible for Harmony's Horizon Bridge Currency Theft/ —
2023-01-23 - The Titan Stealer- Notorious Telegram Malware Campaign - Uptycs/ —
2023-01-24 - [Urgent] A Chinese hacker organization that declared hacking war on Korea...-KISA will hack- notice/ —
2023-01-24 - Cyberattacks Targeting Ukraine Increase 20-fold at End of 2022 Fueled by Russia-linked Gamaredon Activity/ —
2023-01-24 - DragonSpark - Attacks Evade Detection with SparkRAT and Golang Source Code Interpretation/ —
2023-01-24 - DragonSpark Attacks Evade Detection with SparkRAT and Golang Source Code Interpretation/ —
2023-01-24 - The Year of the Wiper/ —
2023-01-24 - Unmasking Venom Spider/ —
2023-01-25 - Python-Based PY-RATION Attack Campaign Leverages Fernet Encryption and Websockets to Avoid Detection/ —
2023-01-25 - Securonix Security Advisory- Python-Based PY#RATION Attack Campaign Leverages Fernet Encryption and Websockets to Avoid Detection/ —
2023-01-25 - TA444- The APT Startup Aimed at Acquisition (of Your Funds)/ —
2023-01-25 - The Rise of Amadey Bot- A Growing Concern for Internet Security/ —
2023-01-26 - Abraham's Ax Likely Linked to Moses Staff/ —
2023-01-26 - Alleged French cybercriminal to appear in Seattle on indictment for conspiracy, computer intrusion, wire fraud and aggravated identity theft/ —
2023-01-26 - Chinese PlugX Malware Hidden in Your USB Devices-/ —
2023-01-26 - CryptBot Infostealer- Malware Analysis/ —
2023-01-26 - Hiding In PlainSight - Proxying DLL Loads To Hide From ETWTI Stack Tracing/ —
2023-01-26 - New Mimic Ransomware Abuses Everything APIs for its Encryption Process/ —
2023-01-26 - Over 50,000 instances of DRAGONBRIDGE activity disrupted in 2022/ —
2023-01-26 - SEABORGIUM and TA453 continue their respective spear-phishing campaigns against targets of interest/ —
2023-01-26 - Unpacking Emotet Malware/ —
2023-01-26 - Welcome to Goot Camp- Tracking the Evolution of GOOTLOADER Operations/ —
2023-01-27 - CERT GOV UA - Cyber attack on the Ukrinform information and communication system/ —
2023-01-27 - ESET - SwiftSlicer/ —
2023-01-27 - Old Bot in New Bottle- Amadey Botnet Back in Action Via Phishing Sites/ —
2023-01-27 - SwiftSlicer- New destructive wiper malware strikes Ukraine/ —
2023-01-29 - Hiding In PlainSight - Indirect Syscall is Dead! Long Live Custom Call Stacks/ —
2023-01-29 - Petya-Not Petya Ransomware Analysis/ —
2023-01-30 - Following the Scent of TrickGate- 6-Year-Old Packer Used to Deploy the Most Wanted Malware/ —
2023-01-31 - Dalbit m00nlight Chinese hacker groups APT attack campaign/ —
2023-01-31 - Vidar Info-Stealer Malware Distributed via Malvertising on Google/ —
2023-02-01 - HeadCrab- A Novel State-of-the-Art Redis Malware in a Global Campaign/ —
2023-02-01 - New LockBit Green ransomware variant borrows code from Conti ransomware/ —
2023-02-01 - Operation Ice Breaker Targets The Gambling Industry Right Before Its Biggest Gathering/ —
2023-02-01 - UAC-0114 aka Winter Vivern to target Ukrainian and Polish GOV/ —
2023-02-01 - Uncovering LockBit Black’s Attack Chain and Anti-forensic activity/ —
2023-02-02 - [Zero2Automated] Complete Custom Sample Challenge Analysis/ —
2023-02-02 - DoNot Team (APT-C-35) Analysis of Latest Campaign- Sophisticated Excel Macro Attack Targeting Pakistan/ —
2023-02-02 - Hive Ransomware Technical Analysis and Initial Access Discovery/ —
2023-02-02 - Iran responsible for Charlie Hebdo attacks/ —
2023-02-02 - Malware analysis- part 7. Yara rule example for CRC32. CRC32 in REvil ransomware/ —
2023-02-02 - Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware/ —
2023-02-02 - New APT34 Malware Targets The Middle East/ —
2023-02-02 - No Pineapple! - DPRK Targeting of Medical Research and Technology Sector/ —
2023-02-02 - North Korea hacking organization, Fair Trade Commission impersonation phishing attack in progress/ —
2023-02-02 - Update to the REF2924 intrusion set and related campaigns/ —
2023-02-03 - AgentVX And Taurus/ —
2023-02-03 - Ave Maria and the Chambers of Warzone RAT/ —
2023-02-03 - HookBot – A New Mobile Malware/ —
2023-02-03 - Massive ESXiArgs ransomware attack targets VMware ESXi servers worldwide/ —
2023-02-03 - TgToxic Malware’s Automated Framework Targets Southeast Asia Android Users/ —
2023-02-03 - Threat Actors Abuse AI-Generated Youtube Videos to Spread Stealer Malware/ —
2023-02-03 - UAC-0114 Group aka Winter Vivern Attack Detection- Hackers Launch Phishing Campaigns Targeting Government Entities of Ukraine and Poland/ —
2023-02-05 - Analysing A Sample Of Arechclient2/ —
2023-02-06 - Behind the Attack- Paradies Clipper Malware/ —
2023-02-06 - CERT GOV UA-5926/ —
2023-02-06 - Qakbot mechanizes distribution of malicious OneNote notebooks/ —
2023-02-06 - Sliver Malware With BYOVD Distributed Through Sunlogin Vulnerability Exploitations/ —
2023-02-07 - Cl0p Ransomware Targets Linux Systems with Flawed Encryption - Decryptor Available/ —
2023-02-07 - Hide your Hypervisor- Analysis of ESXiArgs Ransomware/ —
2023-02-07 - Released- Decryptor for Cl0p ransomware’s Linux variant/ —
2023-02-07 - The Approach of TA413 for Tibetan Targets/ —
2023-02-08 - AsyncRAT- Analysing the Three Stages of Execution/ —
2023-02-08 - Dota 2 Under Attack- How a V8 Bug Was Exploited in the Game/ —
2023-02-08 - Earth Zhulong- Familiar Patterns Target Southeast Asian Firms/ —
2023-02-08 - Graphiron New Russian Information Stealing Malware Deployed Against Ukraine/ —
2023-02-08 - Graphiron- New Russian Information Stealing Malware Deployed Against Ukraine/ —
2023-02-08 - Investigating Intrusions From Intriguing Exploits/ —
2023-02-08 - Play Store App Serves Coper Via GitHub/ —
2023-02-08 - Screentime- Sometimes It Feels Like Somebody's Watching Me/ —
2023-02-08 - SteelClover Attacks Distributing Malware Via Google Ads Increased/ —
2023-02-09 - #StopRansomware- Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities/ —
2023-02-09 - Defeating VMProtect’s Latest Tricks/ —
2023-02-09 - Enigma Stealer Targets Cryptocurrency Industry with Fake Jobs/ —
2023-02-09 - NewsPenguin a Previously Unknown Threat Actor Targets Pakistan with Advanced Espionage Tool/ —
2023-02-09 - Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities/ —
2023-02-09 - Technical analysis of Godfather android malware/ —
2023-02-10 - #ShortAndMalicious — PikaBot and the Matanbuchus connection/ —
2023-02-10 - Bypassing MFA- A Forensic Look At Evilginx2 Phishing Kit/ —
2023-02-10 - Malware analysis- part 8. Yara rule example for MurmurHash2. MurmurHash2 in Conti ransomware/ —
2023-02-10 - Uncle Sow - Dark Caracal in Latin America/ —
2023-02-10 - Uncle Sow- Dark Caracal in Latin America/ —
2023-02-11 - AsyncRAT OneNote Dropper/ —
2023-02-12 - TrueBot Analysis Part I - A short glimpse into packed TrueBot samples/ —
2023-02-13 - Beepin’ Out of the Sandbox- Analyzing a New, Extremely Evasive Malware/ —
2023-02-13 - Dalbit (m00nlight)- Chinese Hacker Group’s APT Attack Campaign/ —
2023-02-13 - Mylobot- Investigating a proxy botnet/ —
2023-02-13 - Nice Try Tonto Team/ —
2023-02-13 - Royal Ransomware Deep Dive/ —
2023-02-14 - Hangeul (HWP) malware using steganography- RedEyes (ScarCruft)/ —
2023-02-14 - Hangeul HWP malware using steganography RedEyes ScarCruft/ —
2023-02-14 - Havoc Across the Cyberspace/ —
2023-02-14 - New MortalKombat ransomware and Laplas Clipper malware threats deployed in financially motivated/ —
2023-02-14 - Vice-Society spreads its own ransomware/ —
2023-02-14 - Worm malware Win32.Parite Deep Analysis & Scanner/ —
2023-02-14 - Writing a decryptor for Jaff ransomware/ —
2023-02-15 - DarkBit Ransomware Targets Israel with Command-Line Options and Optimized Encryption Routines/ —
2023-02-15 - Distributed Malware Exploiting Vulnerable Innorix Andariel/ —
2023-02-15 - How to Identify IcedID Network Traffic/ —
2023-02-15 - Paradise Ransomware Distributed Through AweSun Vulnerability Exploitation/ —
2023-02-15 - Recent TZW Campaigns Revealed As Part of GlobeImposter Malware Family/ —
2023-02-15 - Scandinavian Airlines hit by cyberattack, ‘Anonymous Sudan’ claims responsibility/ —
2023-02-15 - Sustained activity by specific threat actors/ —
2023-02-16 - ALTOUFAN TEAM Targets the Middle East/ —
2023-02-16 - APT SideCopy Targeting Indian Government Entities - Analysis of the new version of ReverseRAT/ —
2023-02-16 - Fog of war- how the Ukraine conflict transformed the cyber threat landscape/ —
2023-02-16 - Frebniis New Malware Abuses Microsoft IIS Feature to Establish Backdoor/ —
2023-02-16 - Invitation to a Secret Event Uncovering Earth Yakos Campaigns/ —
2023-02-16 - Invitation to a Secret Event- Uncovering Earth Yako’s Campaigns/ —
2023-02-16 - Mass Attack buhtiRansom - CVE-2022–47986/ —
2023-02-16 - Operation Silent Watch- Desktop Surveillance in Azerbaijan and Armenia/ —
2023-02-16 - Three Cases of Cyber Attacks on the Security Service of Ukraine and NATO Allies, Likely by Russian State-Sponsored Gamaredon/ —
2023-02-16 - WIP26 Espionage - Threat Actors Abuse Cloud Infrastructure in Targeted Telco Attacks/ —
2023-02-17 - Earth Kitsune Delivers New WhiskerSpy Backdoor via Watering Hole Attack/ —
2023-02-18 - TrueBot Analysis Part II - Static unpacker/ —
2023-02-19 - Investigating a Fake KDDI Smishing Campaign that abuses Duck DNS/ —
2023-02-20 - Royal Ransomware Expands Attacks by Targeting Linux ESXi Servers/ —
2023-02-20 - Stealc- a copycat of Vidar and Raccoon infostealers gaining in popularity – Part 1/ —
2023-02-20 - Vidar Stealer H&M Campaign/ —
2023-02-21 - Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers/ —
2023-02-21 - One Year After- The Cyber Implications of the Russo-Ukrainian War/ —
2023-02-21 - Technical Analysis of Rhadamanthys Obfuscation Techniques/ —
2023-02-22 - Hydrochasma Previously Unknown Group Targets Medical and Shipping Organizations in Asia/ —
2023-02-22 - Hydrochasma- Previously Unknown Group Targets Medical and Shipping Organizations in Asia/ —
2023-02-22 - New Phishing Attack Detection Attributed to the UAC-0050 and UAC-0096 Groups Spreading Remcos Spyware/ —
2023-02-23 - A tale of Phobos - how we almost cracked a ransomware using CUDA/ —
2023-02-23 - Anti-Forensic Techniques Used By Lazarus Group/ —
2023-02-23 - Berbew Backdoor Spotted In The Wild/ —
2023-02-23 - Clasiopa- New Group Targets Materials Research/ —
2023-02-23 - Evasive cryptojacking malware targeting macOS found lurking in pirated applications/ —
2023-02-23 - Getting Dumped- A Trust Relationship Destroyed by Lorenz/ —
2023-02-23 - How to detect Brute Ratel activities/ —
2023-02-23 - Technical Advisory- Various Threat Actors Targeting ManageEngine Exploit CVE-2022-47966/ —
2023-02-23 - The DoNot APT/ —
2023-02-23 - WinorDLL64 A backdoor from the vast Lazarus arsenal/ —
2023-02-23 - WinorDLL64- A backdoor from the vast Lazarus arsenal-/ —
2023-02-24 - A year of wiper attacks in Ukraine/ —
2023-02-24 - Desde Chile con Malware (From Chile with Malware)/ —
2023-02-24 - Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool/ —
2023-02-24 - Qbot testing malvertising campaigns-/ —
2023-02-24 - Snip3 Crypter Reveals New TTPs Over Time/ —
2023-02-26 - Emotet Campaign/ —
2023-02-26 - PikaBot Tiny loader that seems very familiar/ —
2023-02-27 - Blind Eagle Deploys Fake UUE Files and Fsociety to Target Colombia's Judiciary, Financial, Public, and Law Enforcement Entities/ —
2023-02-27 - Blind Eagle Deploys Fake UUE Files and Fsociety to Target Colombias Judiciary Financial Public and Law Enforcement Entities/ —
2023-02-27 - Hunting PrivateLoader- The malware behind InstallsKey PPI service/ —
2023-02-27 - Lumma Stealer targets YouTubers via Spear-phishing Email/ —
2023-02-27 - Stealc- a copycat of Vidar and Raccoon infostealers gaining in popularity – Part 2/ —
2023-02-27 - The increasing presence of pro-Russia hacktivists/ —
2023-02-28 - Blackfly Espionage Group Targets Materials Technology/ —
2023-02-28 - Can You See It Now- An Emerging LockBit Campaign/ —
2023-02-28 - Cryptocurrency Entities at Risk- Threat Actor Uses Parallax RAT for Infiltration/ —
2023-02-28 - Malvertising Surges to Distribute Malware/ —
2023-02-28 - SCARLETEEL- Operation leveraging Terraform, Kubernetes, and AWS for data theft/ —
2023-02-28 - XLoader-FormBook- Encryption Analysis and Malware Decryption/ —
2023-03-01 - BlackLotus UEFI bootkit Myth confirmed/ —
2023-03-01 - BlackLotus UEFI bootkit- Myth confirmed/ —
2023-03-01 - Iron Tigers SysUpdate Reappears Adds Linux Targeting/ —
2023-03-01 - Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting/ —
2023-03-01 - OneNote- A Growing Threat for Malware Distribution/ —
2023-03-01 - SecTopRAT- A Dangerous Remote Access Trojan Spreading Through Google Fake Ads/ —
2023-03-01 - Slippy Spider/ —
2023-03-02 - Behind the Breaches- Mapping Threat Actors and Their CVE Exploits/ —
2023-03-02 - MQsTTang Mustang Pandas latest backdoor treads new ground with Qt and MQTT/ —
2023-03-02 - MQsTTang- Mustang Panda’s latest backdoor treads new ground with Qt and MQTT/ —
2023-03-02 - QakBot C2 Traffic/ —
2023-03-02 - Redirection Roulette- Thousands of hijacked websites in East Asia redirecting visitors to other sites/ —
2023-03-02 - StopRansomware- Royal Ransomware/ —
2023-03-04 - Bumblebee DocuSign Campaign/ —
2023-03-04 - KL Remota - Brazilian Malware Bank/ —
2023-03-06 - Brute Ratel - Scandinavian Defence/ —
2023-03-06 - Core DoppelPaymer ransomware gang members targeted in Europol operation/ —
2023-03-06 - Nevada Ransomware- Yet Another Nokayawa Variant Nevada ransomware/ —
2023-03-06 - Nevada Ransomware- Yet Another Nokoyawa Variant/ —
2023-03-06 - New HiatusRAT Router Malware Covertly Spies On Victims/ —
2023-03-06 - Private Malware for Sale- A Closer Look at AresLoader/ —
2023-03-06 - Schlag gegen international agierendes Netzwerk von Cyber-Kriminellen/ —
2023-03-07 - Don’t Answer That! Russia-Aligned TA499 Beleaguers Targets with Video Call Requests/ —
2023-03-07 - Emotet malware attacks return after three-month break/ —
2023-03-07 - Emotet Sending Malicious Emails After Three-Month Hiatus/ —
2023-03-07 - Internal documents show Mexican army used spyware against civilians, set up secret military intelligence unit/ —
2023-03-07 - Love scam or espionage- Transparent Tribe lures Indian and Pakistani officials/ —
2023-03-07 - Pandas with a Soul Chinese Espionage Attacks Against Southeast Asian Government Entities/ —
2023-03-07 - Pandas with a Soul- Chinese Espionage Attacks Against Southeast Asian Government Entities/ —
2023-03-07 - Qakbot Evolves to OneNote Malware Distribution/ —
2023-03-07 - SYS01 Stealer/ —
2023-03-07 - Using Memory Analysis to Detect EDR-Nullifying Malware/ —
2023-03-08 - CHM malware (Kimsuky) disguised questionnaires related to North Korea/ —
2023-03-08 - GlobeImposter Ransomware Being Distributed with MedusaLocker via RDP/ —
2023-03-08 - Ransomware review- March 2023/ —
2023-03-08 - Suspected Chinese Campaign to Persist on SonicWall Devices, Highlights Importance of Monitoring Edge Devices/ —
2023-03-09 - A border-hopping PlugX USB worm takes its act on the road/ —
2023-03-09 - BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif/ —
2023-03-09 - BlackSnake Ransomware Emerges from Chaos Ransomware’s Shadow/ —
2023-03-09 - COBALT ILLUSION Masquerades as Atlantic Council Employee/ —
2023-03-09 - DUCKTAIL- Threat Operation Re-emerges with New LNK, PowerShell, and Other Custom Tactics to Avoid Detection/ —
2023-03-09 - IceFire Ransomware Returns - Now Targeting Linux Enterprise Networks/ —
2023-03-09 - Malvertising through search engines/ —
2023-03-09 - Nexus- The Latest Android Banking Trojan with SOVA Connections/ —
2023-03-09 - PlugX Malware Being Distributed via Vulnerability Exploitation/ —
2023-03-09 - Prometei botnet improves modules and exhibits new capabilities in recent updates/ —
2023-03-09 - Stealing the LIGHTSHOW (Part One) — North Korea's UNC2970/ —
2023-03-09 - Stealing the LIGHTSHOW (Part Two) — LIGHTSHIFT and LIGHTSHOW/ —
2023-03-09 - Stealing the LIGHTSHOW Part One North Koreas UNC2970/ —
2023-03-09 - The Untold Story of the BlackLotus UEFI Bootkit/ —
2023-03-09 - The VulnCheck 2022 Exploited Vulnerability Report - Missing CISA KEV Catalog Entries/ —
2023-03-10 - [Press Release] Beware of malicious code infection impersonating a national advisory organization/ —
2023-03-10 - Dark Pink APT Group Strikes Government Entities in South Asian Countries/ —
2023-03-10 - FBI and international cops catch a NetWire RAT/ —
2023-03-10 - From Royal With Love/ —
2023-03-10 - How Do You Like Dem Eggs- I like Mine Scrambled, Really Scrambled - A Look at Recent more_eggs Samples/ —
2023-03-10 - Sophisticated APT29 Campaign Abuses Notion API to Target the European Commission/ —
2023-03-10 - Xenomorph v3- a new variant with ATS targeting more than 400 institutions/ —
2023-03-11 - Analyzing GuLoader/ —
2023-03-12 - Makop- The Toolkit of a Criminal Gang/ —
2023-03-13 - Beyond Bullets and Bombs- An Examination of Armageddon Group’s Cyber Warfare Against Ukraine/ —
2023-03-13 - CatB Ransomware - File Locker Sharpens Its Claws to Steal Data with MSDTC Service DLL Hijacking/ —
2023-03-13 - CHM Malware Disguised as North Korea-related Questionnaire Kimsuky/ —
2023-03-13 - DEV-1101 enables high-volume AiTM campaigns with open-source phishing kit/ —
2023-03-13 - Emotet Returns, Now Adopts Binary Padding for Evasion/ —
2023-03-14 - Magniber ransomware actors used a variant of Microsoft SmartScreen bypass/ —
2023-03-14 - NOBELIUM Uses Poland's Ambassador’s Visit to the U.S. to Target EU Governments Assisting Ukraine/ —
2023-03-14 - NOBELIUM Uses Polands Ambassadors Visit to the US to Target EU Governments Assisting Ukraine/ —
2023-03-14 - South Korean Android Banking Menace - Fakecalls/ —
2023-03-14 - Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency/ —
2023-03-14 - The slow Tick‑ing time bomb- Tick APT group compromise of a DLP software developer in East Asia/ —
2023-03-14 - The Zeus Trojan Malware - Definition and Prevention/ —
2023-03-15 - (Ab)using Adobe Acrobat Sign to distribute malware/ —
2023-03-15 - DotRunPEX - Demystifying New Virtualized .NET Injector used in the Wild/ —
2023-03-15 - QBot- Laying the Foundations for Black Basta Ransomware Activity/ —
2023-03-15 - SideCopy Continues to Target Indian Defense Organization/ —
2023-03-15 - Unmasking MedusaLocker Ransomware/ —
2023-03-16 - Bee-Ware of Trigona, An Emerging Ransomware Strain/ —
2023-03-16 - CryptBot/ —
2023-03-16 - FBI shuts down 11-year-old NetWire RAT malware/ —
2023-03-16 - Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation/ —
2023-03-16 - IPFS- A New Data Frontier or a New Cybercriminal Hideout-/ —
2023-03-16 - MoqHao Part 3- Recent Global Targeting Trends/ —
2023-03-16 - Peeking at Reaper's surveillance operations/ —
2023-03-16 - Peeking at Reaper’s surveillance operations/ —
2023-03-16 - Winter Vivern - Uncovering a Wave of Global Espionage/ —
2023-03-17 - CVE-2023-23397- Exploitations in the Wild – What You Need to Know/ —
2023-03-17 - KillNet and affiliate hacktivist groups targeting healthcare with DDoS attacks/ —
2023-03-17 - Kimsuky group appears to be exploiting OneNote like the cybercrime group/ —
2023-03-17 - ShellBot Malware Being Distributed to Linux SSH Servers/ —
2023-03-17 - Thawing the permafrost of ICEDID Summary/ —
2023-03-19 - Gozi - Italian ShellCode Dance/ —
2023-03-19 - ScrubCrypt - The Rebirth of Jlaive/ —
2023-03-19 - Vawtrak Analysis/ —
2023-03-20 - Cybergun- Technical Analysis of the Armageddon's Infostealer/ —
2023-03-20 - Detailed Analysis of Cryptocurrency Phishing Through Famous YouTube Channel Hacking/ —
2023-03-20 - IcedID’s VNC Backdoors- Dark Cat, Anubis & Keyhole/ —
2023-03-20 - Korean Security Advisory/ —
2023-03-20 - Move, Patch, Get Out the Way- 2022 Zero-Day Exploitation Continues at an Elevated Pace/ —
2023-03-20 - NAPLISTENER- more bad dreams from developers of SIESTAGRAPH/ —
2023-03-20 - When the Absence of Noise Becomes Signal- Defensive Considerations for Lazarus FudModule/ —
2023-03-21 - Bad magic new APT found in the area of Russo-Ukrainian conflict/ —
2023-03-21 - Bad magic- new APT found in the area of Russo-Ukrainian conflict/ —
2023-03-21 - BlackCat v3 Decryptor Scripts/ —
2023-03-21 - Nexus- a new Android botnet-/ —
2023-03-21 - Notorious SideCopy APT group sets sights on Indias DRDO/ —
2023-03-21 - The Unintentional Leak - A glimpse into the attack vectors of APT37/ —
2023-03-21 - The Unintentional Leak- A glimpse into the attack vectors of APT37/ —
2023-03-22 - Emotet Resumes Spam Operations, Switches to OneNote/ —
2023-03-22 - New loader on the bloc - AresLoader/ —
2023-03-22 - The 5x5—Conflict in Ukraine’s information environment/ —
2023-03-22 - We (Did!) Start the Fire- Hacktivists Increasingly Claim Targeting of OT Systems/ —
2023-03-23 - Emerging Threats- AgentTesla – A Review and Detection Strategies/ —
2023-03-23 - Kimsuky group distributes malware disguised as a profile file (GitHub)/ —
2023-03-23 - Operation Tainted Love - Chinese APTs Target Telcos in New Attacks/ —
2023-03-23 - Operation Tainted Love Chinese APTs Target Telcos in New Attacks/ —
2023-03-23 - Pack it Secretly - Earth Preta’s Updated Stealthy Strategies/ —
2023-03-23 - Scarcruft Bolsters Arsenal for targeting individual Android devices/ —
2023-03-23 - UNC961 in the Multiverse of Mandiant Three Encounters with a Financially Motivated Threat Actor/ —
2023-03-23 - UNC961 in the Multiverse of Mandiant- Three Encounters with a Financially Motivated Threat Actor/ —
2023-03-24 - APT attacks on industrial organizations in H2 2022/ —
2023-03-24 - Aurora- The Dark Dawn and its Menacing Effects/ —
2023-03-24 - Bypassing Qakbot Anti-Analysis/ —
2023-03-24 - Guidance for investigating attacks using CVE-2023-23397/ —
2023-03-24 - Phishing Campaign Targets Chinese Nuclear Energy Industry/ —
2023-03-25 - [QuickNote] Decrypting the C2 configuration of Warzone RAT/ —
2023-03-26 - Updates from the MaaS- new threats delivered through NullMixer/ —
2023-03-27 - AsyncRAT Crusade- Detections and Defense/ —
2023-03-27 - DBatLoader- Actively Distributing Malwares Targeting European Businesses/ —
2023-03-27 - Fork in the Ice- The New Era of IcedID/ —
2023-03-27 - REF2924- how to maintain persistence as an (advanced-) threat/ —
2023-03-27 - Rhadamanthys- The “Everything Bagel” Infostealer/ —
2023-03-28 - APT43 - North Korean Group Uses Cybercrime to Fund Espionage Operations/ —
2023-03-28 - APT43- North Korean Group Uses Cybercrime to Fund Espionage Operations/ —
2023-03-28 - Chinotto Backdoor Technical Analysis of the APT Reaper’s Powerful Weapon/ —
2023-03-28 - LimeRAT Malware Analysis- Extracting the Config/ —
2023-03-28 - Mélofée a new alien malware in the Pandas toolset targeting Linux hosts/ —
2023-03-28 - Mélofée- a new alien malware in the Panda's toolset targeting Linux hosts/ —
2023-03-28 - Reversing Complex PowerShell Malware/ —
2023-03-28 - Tofsee Botnet- Proxying and Mining/ —
2023-03-29 - BumbleBee notes/ —
2023-03-29 - CrowdStrike Falcon Platform Detects and Prevents Active Intrusion Campaign Targeting 3CXDesktopApp Customers/ —
2023-03-29 - DuckTail- Dissecting a complex infection chain started from social engineering/ —
2023-03-29 - Ironing out (the macOS details) of a Smooth Operator/ —
2023-03-29 - New OpcJacker Malware Distributed via Fake VPN Malvertising/ —
2023-03-29 - SmoothOperator - Ongoing Campaign Trojanizes 3CXDesktopApp in Supply Chain Attack/ —
2023-03-29 - SmoothOperator Ongoing Campaign Trojanizes 3CXDesktopApp in Supply Chain Attack/ —
2023-03-29 - Spyware vendors use 0-days and n-days against popular platforms/ —
2023-03-29 -- SITUATIONAL AWARENESS -- CrowdStrike Tracking Active Intrusion Campaign Targeting 3CX Customers/ —
2023-03-30 - 3CX Desktop App Compromised (CVE-2023-29059)/ —
2023-03-30 - 3CX Supply Chain Attack/ —
2023-03-30 - 3CX Supply Chain Compromise Leads to ICONIC Incident/ —
2023-03-30 - 3CX VoIP Software Compromise & Supply Chain Threats/ —
2023-03-30 - 3CX- Supply Chain Attack Affects Thousands of Users Worldwide/ —
2023-03-30 - Backdoored 3CXDesktopApp Installer Used in Active Threat Campaign/ —
2023-03-30 - Contracts Identify Cyber Operations Projects from Russian Company NTC Vulkan/ —
2023-03-30 - Developing Story- Information on Attacks Involving 3CX Desktop App/ —
2023-03-30 - Elastic users protected from SUDDENICON’s supply chain attack/ —
2023-03-30 - eSentire Threat Intelligence Malware Analysis- BatLoader/ —
2023-03-30 - Exploitation is a Dish Best Served Cold Winter Vivern Uses Known Zimbra Vulnerability to Target Webmail Portals of NATO-Aligned Governments in Europe/ —
2023-03-30 - Exploitation is a Dish Best Served Cold- Winter Vivern Uses Known Zimbra Vulnerability to Target Webmail Portals of NATO-Aligned Governments in Europe/ —
2023-03-30 - Forensic Triage of a Windows System running the Backdoored 3CX Desktop App/ —
2023-03-30 - From Innocence to Malice- The OneNote Malware Campaign Uncovered/ —
2023-03-30 - GoatRAT Attacks Automated Payment Systems/ —
2023-03-30 - Magniber ransomware analysis- Tiny Tracer in action/ —
2023-03-30 - SEKOIAIO analysis of the VulkanFiles leak/ —
2023-03-30 - TAG Bulletin- Q1 2023/ —
2023-03-30 - Technical Analysis of Xloader’s Code Obfuscation in Version 4.3/ —
2023-03-30 - The Vulkan Files A Look Inside Putins Secret Plans for Cyber-Warfare/ —
2023-03-30 - With KEYPLUG, China’s RedGolf Spies On, Steals From Wide Field of Targets/ —
2023-03-30 - X-Force Prevents Zero Day from Going Anywhere/ —
2023-03-30 -New TACTICALOCTOPUS Attack Campaign Targets US Entities with Malware Bundled in Tax-Themed Documents/ —
2023-03-30- 3CX Supply Chain Compromise Leads to ICONIC Incident/ —
2023-03-31 - 3CX Supply Chain Attack Campaign Campaign Analysis/ —
2023-03-31 - A Comprehensive Analysis of the 3CX Attack/ —
2023-03-31 - Initial Implants and Network Analysis Suggest the 3CX Supply Chain Operation Goes Back to Fall 2022/ —
2023-03-31 - Moqhao masters new tricks/ —
2023-03-31 - Red flags flew over software supply chain-compromised 3CX update/ —
2023-03-31 - Splunk Insights- Investigating the 3CXDesktopApp Supply Chain Compromise/ —
2023-03-31 - TrueBot Analysis Part III - Capabilities/ —
2023-04-01 - Ironing out (the macOS) details of a Smooth Operator (Part II)/ —
2023-04-01 - SmoothOperator/ —
2023-04-02 - AresLoader Taking a closer look at this new loader/ —
2023-04-03 - A Royal Analysis of Royal Ransom/ —
2023-04-03 - ALPHV Ransomware Affiliate Targets Vulnerable Backup Installations to Gain Initial Access/ —
2023-04-03 - Not just an infostealer- Gopuram backdoor deployed through 3CX supply chain attack/ —
2023-04-04 - A Blog with NoName/ —
2023-04-04 - Mantis- New Tooling Used in Attacks Against Palestinian Targets/ —
2023-04-04 - Not just an infostealer Gopuram backdoor deployed through 3CX supply chain attack/ —
2023-04-04 - Rorschach – A New Sophisticated and Fast Ransomware/ —
2023-04-04 - Typhon Reborn V2- Updated stealer features enhanced anti-analysis and evasion capabilities/ —
2023-04-05 - Automating Qakbot Decode At Scale/ —
2023-04-05 - Everything you need to know about the LummaC2 Stealer- Leveraging IDA Python and Unicorn to deobfuscate Windows API Hashing/ —
2023-04-05 - How were protecting users from government-backed attacks from North Korea/ —
2023-04-05 - How we’re protecting users from government-backed attacks from North Korea/ —
2023-04-06 - Neutralizing Tofsee Spambot – Part 1 - Binary file vaccine/ —
2023-04-06 - Neutralizing Tofsee Spambot – Part 2 - InMemoryConfig store vaccine/ —
2023-04-06 - Neutralizing Tofsee Spambot – Part 3 - Network-based kill switch/ —
2023-04-06 - PhotoLoader ICEDID/ —
2023-04-07 - Attack chain leads to XWORM and AGENTTESLA/ —
2023-04-07 - MERCURY and DEV-1084 Destructive attack on hybrid environment/ —
2023-04-07 - MERCURY and DEV-1084- Destructive attack on hybrid environment/ —
2023-04-08 - [QuickNote] Uncovering Suspected Malware Distributed By Individuals from Vietnam/ —
2023-04-08 - Dcrat - Manual De-obfuscation of .NET Malware/ —
2023-04-09 - LummaC2 BreakDown/ —
2023-04-10 - March 2023’s Most Wanted Malware- New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files/ —
2023-04-10 - Redline Stealer - Static Analysis and C2 Extraction/ —
2023-04-11 - APT-C-28 (Scarcruft)/ —
2023-04-11 - BumbleBee hunting with a Velociraptor/ —
2023-04-11 - DEV-0196- QuaDream’s “KingsPawn” malware used to target civil society in Europe, North America, the Middle East, and Southeast Asia/ —
2023-04-11 - Guidance for investigating attacks using CVE-2022-21894- The BlackLotus campaign/ —
2023-04-11 - Sweet QuaDreams- A First Look at Spyware Vendor QuaDream’s Exploits, Victims, and Customers/ —
2023-04-12 - Following the Lazarus group by tracking DeathNote campaign/ —
2023-04-12 - Lazarus DeathNote campaign/ —
2023-04-12 - Maximizing Threat Detections of Qakbot with Osquery/ —
2023-04-12 - Probing Lorec53 Phishing through the DNS Microscope/ —
2023-04-12 - Recent IcedID (Bokbot) activity/ —
2023-04-12 - XMRig is one of the most widespread malicious miners, that exploits hardware to mine Monero/ —
2023-04-13 - Aurora Stealer deep dive Analysis/ —
2023-04-13 - CERT Polska and SKW warn against the activities of Russian spies/ —
2023-04-13 - Chameleon- A New Android Malware Spotted In The Wild/ —
2023-04-13 - Continuing our work to hold cybercriminal ecosystems accountable/ —
2023-04-13 - Detecting QakBot- WSF attachments, OneNote files, and generic attack surface reduction/ —
2023-04-13 - Espionage campaign linked to Russian intelligence services/ —
2023-04-13 - Money Ransomware- The Latest Double Extortion Group/ —
2023-04-13 - Quasar Chaos- Open Source Ransomware Meets Open Source RAT/ —
2023-04-13 - Read The Manual Locker- A Private RaaS Provider/ —
2023-04-13 - The (Not so) Secret War on Discord/ —
2023-04-13 - Threat actors strive to cause Tax Day headaches/ —
2023-04-13 - Transparent Tribe APT36 Pakistan-Aligned Threat Actor Expands Interest in Indian Education Sector/ —
2023-04-14 - 2022 ICS-OT Threat Landscape Recap & What to Watch for This Year/ —
2023-04-14 - Ex-Conti and FIN7 Actors Collaborate with New Domino Backdoor/ —
2023-04-14 - Lockbit changes color/ —
2023-04-14 - PlutoCrypt - A CryptoJoker Ransomware Variant/ —
2023-04-14 - SHATTEREDGLASS Server Emulator/ —
2023-04-15 - Dissecting Npm Malware- Five Packages And Their Evil Install Scripts/ —
2023-04-16 - XORStringsNet/ —
2023-04-17 - 8220 Gang Uses Log4Shell Vulnerability to Install CoinMiner/ —
2023-04-17 - Additional Activities of the Tick Group That Attacks with a Modified Q-Dir and Their Ties with Operation Triple Tiang/ —
2023-04-17 - An in-depth look at the Golang Windows calls/ —
2023-04-17 - April 2023 Threat Horizons Report/ —
2023-04-17 - Butting Heads with a Threat Actor on an Engagement/ —
2023-04-17 - Cyber Espionage in India Decoding APT-36s New Linux Malware Campaign/ —
2023-04-17 - Data Insights from Russian Cyber Militants- NoName05716/ —
2023-04-17 - Exposed Web Panel Reveals Gamaredon Groups Automated Spear Phishing Campaigns/ —
2023-04-17 - Noname057(16) Attack Tracker/ —
2023-04-17 - The Bitter Group Targets Chinese Agencies with CHM Malware via Email Attachments/ —
2023-04-17 - Trigona Ransomware Attacking MS-SQL Servers/ —
2023-04-18 - An Analysis of the BabLock (aka Rorschach) Ransomware (IoCs)/ —
2023-04-18 - An Analysis of the BabLock (aka Rorschach) Ransomware/ —
2023-04-18 - APT28 Advisory/ —
2023-04-18 - Automating Qakbot Detection at Scale With Velociraptor/ —
2023-04-18 - DDosia Project- How NoName057(16) is trying to improve the efficiency of DDoS attacks/ —
2023-04-18 - Giving a Face to the Malware Proxy Service ‘Faceless’/ —
2023-04-18 - How Microsoft names threat actors/ —
2023-04-18 - Introducing DevOpt- A Multifunctional Backdoor Arsenal/ —
2023-04-18 - M-Trends 2023/ —
2023-04-18 - Nation-state threat actor Mint Sandstorm refines tradecraft to attack high-value targets/ —
2023-04-18 - Nation-state threat actor PHOSPHORUS refines tradecraft to attack high-value targets/ —
2023-04-18 - PrivateLoader- Analyzing the Encryption and Decryption of a Modern Loader/ —
2023-04-18 - Raspberry Robin- Anti-Evasion How-To & Exploit Analysis/ —
2023-04-18 - SimpleHarm Tracking MuddyWaters infrastructure/ —
2023-04-18 - State-sponsored campaigns target global network infrastructure/ —
2023-04-18 - Triple Threat- NSO Group’s Pegasus Spyware Returns in 2022 with a Trio of iOS 15 and iOS 16 Zero-Click Exploit Chains/ —
2023-04-18 - U.S. Citizens and Russian Intelligence Officers Charged with Conspiring to Use U.S. Citizens as Illegal Agents of the Russian Government/ —
2023-04-18 - What Makes Invalid Printer Loader So Stealthy-/ —
2023-04-19 - A new group of Shadow ransomware attacks large industrial enterprises in Russia/ —
2023-04-19 - AllaKore(d) the SideCopy Train/ —
2023-04-19 - AllaKored the SideCopy Train/ —
2023-04-19 - March 2023 broke ransomware attack records with 459 incidents/ —
2023-04-19 - Play Ransomware Group Using New Custom Data-Gathering Tools/ —
2023-04-19 - Rorschach Ransomware Analysis with Attack Flow/ —
2023-04-19 - Ukraine remains Russia’s biggest cyber focus in 2023/ —
2023-04-19 - ‘AuKill’ EDR killer malware abuses Process Explorer driver/ —
2023-04-20 - 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible/ —
2023-04-20 - Advanced Threat Tracking APT Patchwork organization update technology makes a comeback launching anot/ —
2023-04-20 - An analysis of syscall usage in Cobalt Strike Beacons/ —
2023-04-20 - APT43 - An investigation into the North Korean group’s cybercrime operations/ —
2023-04-20 - Bumblebee Malware Distributed Via Trojanized Installer Downloads/ —
2023-04-20 - CryptNET Ransomware/ —
2023-04-20 - DAAM Android Botnet being distributed through Trojanized Applications/ —
2023-04-20 - Daggerfly APT Actor Targets Telecoms Company in Africa/ —
2023-04-20 - Daggerfly- APT Actor Targets Telecoms Company in Africa/ —
2023-04-20 - EvilExtractor – All-in-One Stealer/ —
2023-04-20 - Linux malware strengthens links between Lazarus and the 3CX supplychain attack/ —
2023-04-20 - Linux malware strengthens links between Lazarus and the 3CX supply‑chain attack/ —
2023-04-20 - New OCX#HARVESTER Attack Campaign Leverages a Modernized More_eggs Suite to Target Victims/ —
2023-04-20 - PichichiH0ll0wer - New Process hollowing loader/ —
2023-04-20 - Security Update Thursday 20 April 2023 – Initial Intrusion Vector Found/ —
2023-04-20 - UCID902 - Uncovering nation state watering hole credential harvesting campaigns/ —
2023-04-20 - Uncovering nation state watering hole credential harvesting campaigns targeting human rights activists by APT threat group UCID902/ —
2023-04-20 - Xiaoqiying Genesis Day Threat Actor Group Targets South Korea, Taiwan/ —
2023-04-20 - Xiaoqiying-Genesis Day Threat Actor Group Targets South Korea, Taiwan/ —
2023-04-21 - BlueNoroff APT group targets macOS with RustBucket Malware/ —
2023-04-21 - BlueNoroff APT group targets macOS with ‘RustBucket’ Malware/ —
2023-04-21 - MuddyWaters back with DarkBit/ —
2023-04-21 - X_Trader Supply Chain Attack Affects Critical Infrastructure Organizations in U.S. and Europe/ —
2023-04-21 - X_Trader Supply Chain Attack Affects Critical Infrastructure Organizations in US and Europe/ —
2023-04-23 - exposing the internals of Aurora Stealer Builder/ —
2023-04-23 - in2al5dp3in4er Loader/ —
2023-04-24 - Detecting and decrypting Sliver C2 – a threat hunter’s guide/ —
2023-04-24 - Open-Source Gh0st RAT Still Haunting Inboxes 15 Years After Release/ —
2023-04-24 - Tomiris called they want their Turla malware back/ —
2023-04-24 - Tomiris called, they want their Turla malware back/ —
2023-04-24 - U.S. Sanctions 3 North Koreans for Supporting Hacking Group Known for Crypto Thefts/ —
2023-04-24 - ViperSoftX Updates Encryption, Steals Data/ —
2023-04-25 - Educated Manticore Iran Aligned Threat Actor Targeting Israel via Improved Arsenal of Tools/ —
2023-04-25 - Elastic Security Labs discovers the LOBSHOT malware/ —
2023-04-26 - Chinese Alloy Taurus Updates PingPull Malware/ —
2023-04-26 - Chinese hackers use new Linux malware variants for espionage/ —
2023-04-26 - Evasive Panda APT group delivers malware via updates for popular Chinese software/ —
2023-04-26 - EvilExtractor Network Forensics/ —
2023-04-26 - Gootloader Unloaded- Researchers Launch Multi-Pronged Offensive Against Gootloader, Cutting Off Traffic to Thousands of Gootloader Web Pages and Using the Operator’s Very Own Tactics to Protect End-Users/ —
2023-04-26 - RokRAT Malware Distributed Through LNK Files (.lnk)- RedEyes (ScarCruft)/ —
2023-04-26 - RokRAT Malware Distributed Through LNK Files lnk RedEyes ScarCruft/ —
2023-04-26 - RTM Locker Ransomware as a Service (RaaS) Now Suits Up for Linux Architecture/ —
2023-04-26 - Threat Actor Selling New Atomic macOS (AMOS) Stealer on Telegram/ —
2023-04-26 - Tonto Team Using Anti-Malware Related Files for DLL Side-Loading/ —
2023-04-26 - Unpacking BellaCiao A Closer Look at Irans Latest Malware/ —
2023-04-26 - Unpacking BellaCiao- A Closer Look at Iran’s Latest Malware/ —
2023-04-27 - CatB Ransomware- A New Threat Exploiting DLL Side-Loading/ —
2023-04-27 - Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities - BouldSpy/ —
2023-04-27 - Lookout Discovers Android Spyware Tied to Iranian Police Targeting Minorities- BouldSpy/ —
2023-04-27 - Nomadic Octopus Paperbug Campaign/ —
2023-04-27 - The Week in Security- A possible Colonial Pipeline 2.0, ransomware takes bite out of American eateries/ —
2023-04-28 - Beyond Banking- IcedID Gets Forked/ —
2023-04-28 - Rapture, a Ransomware Family With Similarities to Paradise/ —
2023-04-28 - Unleashing the Power of Shimcache with Chainsaw/ —
2023-05-01 - Attack trends related to the attack campaign DangerousPassword/ —
2023-05-01 - Chain Reaction ROKRATs Missing Link/ —
2023-05-01 - Chain Reaction- RokRAT's Missing Link/ —
2023-05-01 - RTM Locker ransomware targets VMware ESXi servers/ —
2023-05-02 - Attack on Security Titans Earth Longzhi Returns With New Tricks/ —
2023-05-02 - Attack on Security Titans- Earth Longzhi Returns With New Tricks/ —
2023-05-02 - IcedID Malware- Traversing Through its Various Incarnations/ —
2023-05-02 - Transparent Tribe APT actively lures Indian Army amidst increased targeting of Educational Institutions/ —
2023-05-03 - A doubled Dragon Breath adds new air to DLL sideloading attacks/ —
2023-05-03 - Meta’s Adversarial Threat Report, First Quarter 2023/ —
2023-05-03 - New Mustang Panda’s campaing against Australia/ —
2023-05-03 - RecordBreaker Stealer Distributed via Hacked YouTube Accounts/ —
2023-05-03 - Teasing the Secrets From Threat Actors- Malware Configuration Parsing at Scale/ —
2023-05-03 - UnpacMe Weekly- New Version of IcedId Loader/ —
2023-05-04 - Clean Rooms Nuclear Missiles and SideCopy Oh My/ —
2023-05-04 - Eastern Asian Android Assault - FluHorse/ —
2023-05-04 - Kimsuky Evolves Reconnaissance Capabilities in New Global Campaign/ —
2023-05-04 - Not quite an Easter egg- a new family of Trojan subscribers on Google Play/ —
2023-05-04 - Sandworm Attackers Use WinRAR to Wipe Data from Government Devices/ —
2023-05-04 - Unpacking ICEDID/ —
2023-05-05 - Deep Dive Into PIPEDREAM’s OPC UA Module, MOUSEHOLE/ —
2023-05-05 - Sophisticated DarkWatchMan RAT Spreads Through Phishing Sites/ —
2023-05-05 - Stealc- A new stealer emerges in 2023/ —
2023-05-07 - StrelaStealer Under the radar email credential stealer in development/ —
2023-05-08 - Extracting DDosia targets from process memory/ —
2023-05-08 - Malware analysis report- WinDealer (LuoYu Threat Group)/ —
2023-05-08 - SideWinder Uses Server-side Polymorphism to Attack Pakistan Government Officials and Is Now Targeting Turkey/ —
2023-05-08 - SideWinder Uses Server-side Polymorphism to Attack Pakistan Government Officials — and Is Now Targeting Turkey/ —
2023-05-09 - Advanced Cyberchef Tips - AsyncRAT Loader/ —
2023-05-09 - Akira Ransomware is “bringin’ 1988 back”/ —
2023-05-09 - eSentire Threat Intelligence Malware Analysis- Vidar Stealer/ —
2023-05-09 - Hunting Russian Intelligence “Snake” Malware/ —
2023-05-09 - Managed XDR Investigation of Ducktail in Trend Micro Vision One/ —
2023-05-09 - MetaStealer string decryption and DGA overview/ —
2023-05-09 - Threat Assessment- Royal Ransomware/ —
2023-05-10 - BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game/ —
2023-05-10 - Deconstructing a Cybersecurity Event/ —
2023-05-10 - Deep Dive Into DownEx Espionage Operation in Central Asia/ —
2023-05-10 - Hunting for Ursnif/ —
2023-05-10 - spynote/ —
2023-05-10 - Uncovering RedStinger - Undetected APT cyber operations in Eastern Europe since 2020/ —
2023-05-11 - Malware development trick - part 28- Dump lsass.exe. Simple C++ example/ —
2023-05-11 - Stealthier version of Linux BPFDoor malware spotted in the wild/ —
2023-05-12 - Attack Trends Related to DangerousPassword/ —
2023-05-12 - BlackSuit Ransomware Strikes Windows and Linux Users/ —
2023-05-12 - Evolution of KILLNET from Hacktivism to Private Hackers Company and the Role of Sub-groups/ —
2023-05-12 - Ongoing MEME4CHAN Attack-Phishing Campaign uses Meme-Filled Code to Drop XWorm Payloads/ —
2023-05-12 - The Five Bears Russias Offensive Cyber Capabilities/ —
2023-05-12 - The Illustrious Graduates of Wuhan Kerui/ —
2023-05-13 - All roads lead back to Wuhan Xiaoruizhi Science and Technology Company/ —
2023-05-13 - Mallox affiliate leverages PureCrypter in MS-SQL exploitation campaigns/ —
2023-05-14 - Fun with the new bpfdoor (2023)/ —
2023-05-14 - Silent Echoes- The Hidden Dialogue among Malware Entities — Spotlight on AMOS InfoStealer/ —
2023-05-15 - Botnet Fenix - New botnet going after tax payers in Mexico and Chile/ —
2023-05-15 - Hypervisor Jackpotting, Part 3- Lack of Antivirus Support Opens the Door to Adversary Attacks/ —
2023-05-15 - Lancefly Group Uses Custom Backdoor to Target Orgs in Government Aviation Other Sectors/ —
2023-05-15 - Lancefly- Group Uses Custom Backdoor to Target Orgs in Government, Aviation, Other Sectors/ —
2023-05-15 - LokiLocker, a Ransomware Similar to BlackBit Being Distributed in Korea/ —
2023-05-15 - Quasar Rat Analysis - Identification of 64 Quasar Servers Using Shodan and Censys/ —
2023-05-15 - Water Orthrus's New Campaigns Deliver Rootkit and Phishing Modules/ —
2023-05-16 - 8220 Gang Evolves With New Strategies/ —
2023-05-16 - Introducing Cheng Feng/ —
2023-05-16 - OilAlpha- A Likely Pro-Houthi Group Targeting Entities Across the Arabian Peninsula/ —
2023-05-16 - Russian Hacker “Wazawaka” Indicted for Ransomware/ —
2023-05-16 - The Dragon Who Sold his Camaro- Analyzing a Custom Router Implant/ —
2023-05-16 - The Growing Threat from Infostealers/ —
2023-05-17 - Andariel’s “Jupiter” malware and the case of the curious C2/ —
2023-05-17 - APT28 leverages multiple phishing techniques to target Ukrainian civil society/ —
2023-05-17 - Deobfuscating the Latest GuLoader- Automating Analysis with Ghidra Scripting/ —
2023-05-17 - Detailed Analysis of AlphaSeed, a new version of Kimsuky’s AppleSeed written in Golang/ —
2023-05-17 - Identifying the Nexus of Scaled Ad Fraud/ —
2023-05-17 - MiSSing links/ —
2023-05-17 - The distinctive rattle of APT SideWinder/ —
2023-05-17 - Visualizing QakBot Infrastructure/ —
2023-05-18 - How Hackers Use Binary Padding to Outsmart Sandboxes and Infiltrate Your Systems/ —
2023-05-18 - Identifying Laplas Infrastructure Using Shodan and Censys/ —
2023-05-18 - Looking Closer at BPF Bytecode in BPFDoor/ —
2023-05-18 - SparkRAT Being Distributed Within a Korean VPN Installer/ —
2023-05-18 - Zimperium’s MTD Against OilAlpha- A Comprehensive Defense Strategy/ —
2023-05-19 - Analysis of Amadey Bot Infrastructure Using Shodan/ —
2023-05-19 - CloudWizard APT the bad magic story goes on/ —
2023-05-19 - CloudWizard APT- the bad magic story goes on/ —
2023-05-19 - Malware source code investigation- AsyncRAT/ —
2023-05-19 - Rust-Based Info Stealers Abuse GitHub Codespaces/ —
2023-05-20 - Kraken - The Deep Sea Lurker Part 1/ —
2023-05-20 - Peachtree Orthopedics alerts patients to cyberattack; third patient data breach in seven years/ —
2023-05-21 - PCAPeek/ —
2023-05-22 - [Case study] Decrypt strings using Dumpulator/ —
2023-05-22 - Back in Black- BlackByte Ransomware returns with its New Technology (NT) version/ —
2023-05-22 - BlackCat Ransomware Deploys New Signed Kernel Driver/ —
2023-05-22 - Bluenoroffs RustBucket campaign/ —
2023-05-22 - Bluenoroff’s RustBucket campaign/ —
2023-05-22 - Cloud-based Malware Delivery- The Evolution of GuLoader/ —
2023-05-22 - IcedID Macro Ends in Nokoyawa Ransomware/ —
2023-05-22 - Kimsuky Group Using Meterpreter to Attack Web Servers/ —
2023-05-22 - The Hunt for VENOM SPIDER PART 2/ —
2023-05-22 - WINTAPIX A New Kernel Driver Targeting Countries in The Middle East/ —
2023-05-23 - Android app breaking bad- From legitimate screen recording to file exfiltration within a year/ —
2023-05-23 - DarkCloud Infostealer Being Distributed via Spam Emails/ —
2023-05-23 - Kimsuky - Ongoing Campaign Using Tailored Reconnaissance Toolkit/ —
2023-05-23 - Kimsuky Ongoing Campaign Using Tailored Reconnaissance Toolkit/ —
2023-05-23 - Meet the GoldenJackal APT group Dont expect any howls/ —
2023-05-23 - Meet the GoldenJackal APT group. Don’t expect any howls/ —
2023-05-23 - Scratching the Surface of Rhysida Ransomware/ —
2023-05-23 - Taming the Storm- Understanding and Mitigating the Consequences of CVE-2023-27350/ —
2023-05-23 - Technical analysis and considerations on Strela malware/ —
2023-05-24 - AA23-144a- People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection/ —
2023-05-24 - Agrius Deploys MoneyBird in Targeted Attacks against Israeli Organizations/ —
2023-05-24 - Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations/ —
2023-05-24 - CryptoClippy is Evolving to Pilfer Even More Financial Data/ —
2023-05-24 - Notable DDoS Attack Tools and Services Supporting Hacktivist Operations in 2023/ —
2023-05-24 - Technical Analysis of Pikabot/ —
2023-05-24 - Unmasking Ransomware Using Stylometric Analysis- Shadow, 8BASE, Rancoz/ —
2023-05-24 - Volt Typhoon targets US critical infrastructure with living-off-the-land techniques/ —
2023-05-25 - COSMICENERGY New OT Malware Possibly Related To Russian Emergency Response Exercises/ —
2023-05-25 - COSMICENERGY- New OT Malware Possibly Related To Russian Emergency Response Exercises/ —
2023-05-25 - Invicta Stealer Spreading Through Phony GoDaddy Refund Invoices/ —
2023-05-25 - New tricks of APT29 – update on the CERT.PL report/ —
2023-05-26 - Kraken - The Deep Sea Lurker Part 2/ —
2023-05-26 - Malware development trick - part 30- Find PID via NtGetNextProcess. Simple CPlusPlus example/ —
2023-05-26 - Moneybird Ransomware/ —
2023-05-26 - New Info Stealer Bandit Stealer Targets Browsers, Wallets/ —
2023-05-26 - Threat Brief- Attacks on Critical Infrastructure Attributed to Insidious Taurus (aka Volt Typhoon)/ —
2023-05-29 - GobRAT malware written in Go language targeting Linux routers/ —
2023-05-30 - BlackCat (ALPHV) ransomware levels up for stealth, speed and exfiltration/ —
2023-05-30 - Cold as Ice- Answers to Unit 42 Wireshark Quiz for IcedID/ —
2023-05-30 - Void Rabisu’s Use of RomCom Backdoor Shows a Growing Shift in Threat Actors’ Goals/ —
2023-05-31 - Dark Pink Episode 2/ —
2023-05-31 - Investigating BlackSuit Ransomware’s Similarities to Royal/ —
2023-06-01 - Encrypted Chaos- Analysis of Crytox Ransomware/ —
2023-06-01 - Malware Spotlight Camaro Dragons TinyNote Backdoor/ —
2023-06-01 - Operation Triangulation iOS devices targeted with previously unknown malware/ —
2023-06-01 - Operation Triangulation- iOS devices targeted with previously unknown malware/ —
2023-06-01 - Qakbot- Retool, Reinfect, Recycle/ —
2023-06-01 - SharpPanda APT Campaign Expands its Arsenal Targeting G20 Nations/ —
2023-06-02 - Chinese Threat Actor Used Modified Cobalt Strike Variant to Attack Taiwanese Critical Infrastructure/ —
2023-06-02 - Malware analysis report- SNOWYAMBER (+APT29 related malwares)/ —
2023-06-02 - Zero-Day Vulnerability in MOVEit Transfer Exploited for Data Theft/ —
2023-06-03 - Technical Analysis of Bandit Stealer/ —
2023-06-04 - Malware development trick - part 31- Run shellcode via SetTimer. Simple C++ example/ —
2023-06-05 - 30 DAYS OF FORMBOOK- DAY 1, MONDAY 2023-06-05/ —
2023-06-05 - Iran Cyber Threat Overview/ —
2023-06-05 - Operation Clairvoyance - How APT Groups Spy on the Media Industry/ —
2023-06-05 - Satacom delivers browser extension that steals cryptocurrency/ —
2023-06-06 - ITG10 Likely Targeting South Korean Entities of Interest to the Democratic People’s Republic of Korea (DPRK)/ —
2023-06-06 - Kimsuky Strikes Again New Social Engineering Campaign Aims to Steal Credentials and Gather Strategic/ —
2023-06-06 - Kimsuky Strikes Again- New Social Engineering Campaign Aims to Steal Credentials and Gather Strategic Intelligence/ —
2023-06-06 - RedLine Technical Analysis Report/ —
2023-06-06 - Xollam, the Latest Face of TargetCompany/ —
2023-06-07 - Analysis and Reversing of srvnet2.sys/ —
2023-06-07 - Malware development trick - part 32. Syscalls - part 1. Simple C++ example/ —
2023-06-07 - RomCom Resurfaces Targeting Politicians in Ukraine and US-Based Healthcare Providing Aid to Refugees/ —
2023-06-08 - Asylum Ambuscade crimeware or cyberespionage/ —
2023-06-08 - Detecting and mitigating a multi-stage AiTM phishing and BEC campaign/ —
2023-06-08 - DynamicRAT — A full-fledged Java Rat/ —
2023-06-08 - Lazarus Group exploiting vulnerabilities in domestic financial security solutions/ —
2023-06-08 - Practical Queries for Identifying Malware Infrastructure- An informal page for storing Censys-Shodan queries/ —
2023-06-08 - Stealth Soldier Backdoor Used in Targeted Espionage Attacks in North Africa/ —
2023-06-08 - Stealth Soldier used in Targeted Espionage Attacks in North Africa/ —
2023-06-09 - Elastic charms SPECTRALVIPER/ —
2023-06-09 - Malware development trick - part 33. Syscalls - part 2. Simple C++ example/ —
2023-06-09 - SmashJacker (ChromeLoader variant)/ —
2023-06-10 - IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment/ —
2023-06-12 - A Truly Graceful Wipe Out/ —
2023-06-12 - About PowerHarbor, a new malware used by SteelClover/ —
2023-06-12 - Deep dive into the Pikabot cyber threat/ —
2023-06-12 - Sneaky DoubleFinger loads GreetingGhoul targeting your cryptocurrency/ —
2023-06-13 - Core Werewolf targets the defense industry and critical infrastructure/ —
2023-06-13 - ICS attack classifications- differentiating between cyberwarfare, cyberterrorism, and hacktivism/ —
2023-06-13 - Skuld- The Infostealer that Speaks Golang/ —
2023-06-13 - VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compro/ —
2023-06-13 - VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors (UNC3886)/ —
2023-06-13 - VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors/ —
2023-06-14 - Cadet Blizzard emerges as a novel and distinct Russian threat actor/ —
2023-06-14 - Fake Security Researcher GitHub Repositories Deliver Malicious Implant/ —
2023-06-14 - Picus Cyber Threat Intelligence Report May 2023- Top 10 MITRE ATT&CK Techniques/ —
2023-06-15 - Android GravityRAT goes after WhatsApp backups/ —
2023-06-15 - Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Actor, Suspected Links to China/ —
2023-06-15 - Barracuda ESG Zero-Day Vulnerability CVE-2023-2868 Exploited Globally/ —
2023-06-15 - Darth Vidar- The Aesir Strike Back/ —
2023-06-15 - Double Action, Triple Infection, and a New RAT- SideCopy’s Persistent Targeting of Indian Defence/ —
2023-06-15 - eSentire Threat Intelligence Malware Analysis- Resident Campaign/ —
2023-06-15 - Lazarus Threat Group Exploiting Vulnerability of Korean Finance Security Solution/ —
2023-06-15 - Malware analysis report- Babuk ransomware/ —
2023-06-15 - Mystic Stealer- The New Kid on the Block/ —
2023-06-15 - Resident Campaign/ —
2023-06-15 - Shuckworm Inside Russias Relentless Cyber Campaign Against Ukraine/ —
2023-06-15 - Shuckworm- Inside Russia’s Relentless Cyber Campaign Against Ukraine/ —
2023-06-15 - Tracking Diicot- an emerging Romanian threat actor/ —
2023-06-16 - PicassoLoader and Cobalt Strike Beacon Detection- UAC-0057 aka GhostWriter Hacking Group Attacks the Ukrainian Leading Military Educational Institution/ —
2023-06-16 - Through the Cortex XDR Lens- Uncovering a New Activity Group Targeting Governments in the Middle East and Africa/ —
2023-06-19 - Malware AV-VM evasion - part 17- bypass UAC via fodhelper.exe. Simple C++ example/ —
2023-06-20 - BlueDelta Exploits Ukrainian Government Roundcube Mail Servers to Support Espionage Activities/ —
2023-06-20 - Cyber Shadows Pact- Darknet Parliament (KillNet, Anonymous Sudan, REvil)/ —
2023-06-20 - Tsunami DDoS Malware Distributed to Linux SSH Servers/ —
2023-06-21 - Dissecting TriangleDB a Triangulation spyware implant/ —
2023-06-21 - Dissecting TriangleDB, a Triangulation spyware implant/ —
2023-06-21 - Fortinet Reverses Flutter-based Android Malware “Fluhorse”/ —
2023-06-21 - Graphican Flea Uses New Backdoor in Attacks Targeting Foreign Ministries/ —
2023-06-21 - Graphican- Flea Uses New Backdoor in Attacks Targeting Foreign Ministries/ —
2023-06-21 - Initial research exposing JOKERSPY/ —
2023-06-21 - Persistent Connection Established- Nitrogen Campaign Leverages DLL Side-Loading Technique for C2 Communication/ —
2023-06-21 - Ransomware Redefined- RedEnergy Stealer-as-a-Ransomware attacks/ —
2023-06-22 - Business as Usual- Falcon Complete MDR Thwarts Novel VANGUARD PANDA (Volt Typhoon) Tradecraft/ —
2023-06-22 - Goot to Loot - How a Gootloader Infection Led to Credential Access/ —
2023-06-22 - LockBit Green and phishing that targets organizations/ —
2023-06-22 - Malware Analysis Gh0stBins, Chinese RAT- Malware Analysis, Protocol Description, RDP Stream Recovery/ —
2023-06-22 - PindOS- New JavaScript Dropper Delivering Bumblebee and IcedID/ —
2023-06-23 - An Overview of the Different Versions of the Trigona Ransomware/ —
2023-06-23 - Bluepurple Pulse- week ending June 25th/ —
2023-06-23 - Clop Ransomware- History, Timeline, And Adversary Simulation/ —
2023-06-23 - Deep Dive into GOOTLOADER Malware and Its Infection Chain/ —
2023-06-23 - Detecting New MULTI#STORM Attack Campaign Involving Python-based Loader Masquerading as OneDrive Utilities to Drop Multiple RAT Payloads With Security Analytics/ —
2023-06-23 - Detecting New MULTI-STORM Attack Campaign Involving Python-based Loader Masquerading as OneDrive Utilities to Drop Multiple RAT Payloads With Security Analytics/ —
2023-06-23 - Inside KangaPack- the Kangaroo packer with native decryption/ —
2023-06-23 - Malware source code investigation- Paradise Ransomware/ —
2023-06-23 - ObserverStealer- Unmasking the New Contender in Cyber Crime/ —
2023-06-23 - Phylum Discovers Sophisticated Ongoing Attack on NPM/ —
2023-06-23 - Why is it so rare to hear about Western cyber-attacks/ —
2023-06-24 - SmokeLoader - Malware Analysis and Decoding With Procmon/ —
2023-06-26 - Anatsa banking Trojan hits UK, US and DACH with new campaign/ —
2023-06-27 - The Trickbot-Conti Crypters- Where Are They Now-/ —
2023-06-27 - The Underground Economist- Volume 3, Issue 12/ —
2023-06-28 - Andariels silly mistakes and a new malware family/ —
2023-06-28 - Andariel’s silly mistakes and a new malware family/ —
2023-06-28 - Charming Kitten Updates POWERSTAR with an InterPlanetary Twist/ —
2023-06-28 - Detection, Containment, and Hardening Opportunities for Privileged Guest Operations, Anomalous Behavior, and VMCI Backdoors on Compromised VMware Hosts/ —
2023-06-28 - Kimsuky Attack Group Abusing Chrome Remote Desktop/ —
2023-06-28 - Meduza Stealer or The Return of The Infamous Aurora Stealer/ —
2023-06-28 - Red Wolf is back to spy on commercial firms Red Wolf is back to spy on commercial firms/ —
2023-06-28 - Sowing Chaos and Reaping Rewards in Confluence and Jira/ —
2023-06-29 - Decrypted- Akira Ransomware/ —
2023-06-29 - Following NoName057(16) DDoSia Project’s Targets/ —
2023-06-29 - GuLoader- Navigating a Maze of Intricacy/ —
2023-06-29 - PhonyC2 Revealing a New Malicious Command Control Framework by MuddyWater/ —
2023-06-29 - PhonyC2- Revealing a New Malicious Command & Control Framework by MuddyWater/ —
2023-06-29 - Rhysida Ransomware - RaaS Crawls Out of Crimeware Undergrowth to Attack Chilean Army/ —
2023-06-29 - The DPRK strikes using a new variant of RUSTBUCKET/ —
2023-06-30 - Barracuda ESG- CVE-2023-2868 Hardening Recommendations/ —
2023-06-30 - Cobalt Strike’s Deployment with Hardware Breakpoint for AMSI Bypass/ —
2023-06-30 - Formbook unpacking/ —
2023-06-30 - Monthly news - July 2023/ —
2023-07-03 - Chinese Threat Actors Targeting Europe in SmugX Campaign/ —
2023-07-03 - Crysis Threat Actor Installing Venus Ransomware Through RDP/ —
2023-07-04 - Fort Worth officials say leaked data came from Public Information Act request/ —
2023-07-04 - Reversing a recent IcedID Crypter/ —
2023-07-04 - Suspected Maha Grass Organization Uses WarHawk Backdoor Variant Spyder to Spy on Multiple Countries/ —
2023-07-04 - Unleashing the Viper - A Technical Analysis of WhiteSnake Stealer/ —
2023-07-04 - Vulkan - Unveiled Tools of The Trade/ —
2023-07-04 - Wuhan Xiaoruizhi Class of 19 - APT31/ —
2023-07-05 - Anatomy of Silentbob’s Cloud Attack/ —
2023-07-05 - Belarusian hacktivists сlaim to breach country’s leading state university/ —
2023-07-05 - BlueNoroff - How DPRK’s macOS RustBucket Seeks to Evade Analysis and Detection/ —
2023-07-05 - Patchwork Group Utilizing WarHawk Backdoor Variant -Spyder- for Espionage against Multiple Countries/ —
2023-07-06 - [QuickNote] Examining Formbook Campaign via Phishing Emails/ —
2023-07-06 - Increased Truebot Activity Infects U.S. and Canada Based Networks/ —
2023-07-06 - The five-day job- A BlackByte ransomware intrusion case study/ —
2023-07-06 - What’s up with Emotet-/ —
2023-07-07 - Beyond appearances- unknown actor using APT29’s TTP against Chinese users/ —
2023-07-07 - Exploitation of Mitel MiVoice Connect SA CVE-2022-29499/ —
2023-07-07 - Eyes on Android-S.O.V.A botnet sample/ —
2023-07-07 - Malware development trick - part 34- Find PID via WTSEnumerateProcesses. Simple C++ example/ —
2023-07-07 - The TOITOIN Trojan- Analyzing a New Multi-Stage Attack Targeting LATAM Region/ —
2023-07-08 - CloudEyE — From .lnk to Shellcode/ —
2023-07-08 - RomCom Threat Actor Suspected of Targeting Ukraine's NATO Membership Talks at the NATO Summit/ —
2023-07-08 - RomCom Threat Actor Suspected of Targeting Ukraines NATO Membership Talks at the NATO Summit/ —
2023-07-10 - Defend Against the Latest Active Directory Certificate Services Threats/ —
2023-07-11 - Analysis of the Rekoobe Backdoor Being Used In Attacks Against Linux Systems in Korea/ —
2023-07-11 - Breaking into the Bandit Stealer Malware Infrastructure/ —
2023-07-11 - SCARLETEEL 2.0- Fargate, Kubernetes, and Crypto/ —
2023-07-11 - Storm-0978 attacks reveal financial and espionage motives/ —
2023-07-11 - The Spies Who Loved You - Infected USB Drives to Steal Secrets/ —
2023-07-11 - The Spies Who Loved You- Infected USB Drives to Steal Secrets/ —
2023-07-12 - CustomerLoader- a new malware distributing a wide variety of payloads/ —
2023-07-12 - DangerousPassword attacks targeting developers' Windows, macOS, and Linux environments/ —
2023-07-12 - Diplomats Beware - Cloaked Ursa Phishing With a Twist/ —
2023-07-12 - Diplomats Beware- Cloaked Ursa Phishing With a Twist/ —
2023-07-12 - LokiBot Campaign Targets Microsoft Office Document Using Vulnerabilities and Macros/ —
2023-07-12 - Mitigating CVE-2023-3595 and CVE-2023-3596 Impacting Rockwell Automation ControlLogix Firmware/ —
2023-07-12 - New invitation from APT29 to use CCleaner/ —
2023-07-12 - Routers From The Underground- Exposing AVrecon/ —
2023-07-12 - The GRU's Disruptive Playbook/ —
2023-07-12 - The GRUs Disruptive Playbook/ —
2023-07-13 - APT Exploit Targeting Rockwell Automation Flaws Threatens Critical Infrastructure/ —
2023-07-13 - Detecting BPFDoor Backdoor Variants Abusing BPF Filters/ —
2023-07-13 - Malicious campaigns target government, military and civilian entities in Ukraine, Poland/ —
2023-07-13 - Malware analysis report- BlackCat ransomware/ —
2023-07-13 - Possible Supply-Chain Attack Targeting Pakistani Government Delivers Shadowpad/ —
2023-07-13 - TeamTNT Reemerged with New Aggressive Cloud Campaign/ —
2023-07-13 - TrueBot Analysis Part IV - Config Extraction/ —
2023-07-14 - Analysis of Storm-0558 techniques for unauthorized email access/ —
2023-07-14 - Possible Supply-Chain Attack Targeting Pakistani Government Delivers Shadowpad/ —
2023-07-15 - Deep Analysis of GCleaner/ —
2023-07-15 - Malware source code investigation- BlackLotus - part 1/ —
2023-07-16 - Lobshot- Lobshot a basic hVNC bot/ —
2023-07-16 - Malware development- persistence - part 22. Windows Setup. Simple C++ example/ —
2023-07-17 - 8Base ransomware stays unseen for a year/ —
2023-07-17 - The New Release of Danabot Version 3- What You Need to Know/ —
2023-07-18 - FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware/ —
2023-07-18 - NemesisProject/ —
2023-07-18 - Security alert- social engineering campaign targets technology industry employees (Jade Sleet-Storm-0954)/ —
2023-07-18 - Space Pirates- a look into the group's unconventional techniques, new attack vectors, and tools/ —
2023-07-18 - Stealth Mode- Chinese Cyber Espionage Actors Continue to Evolve Tactics to Avoid Detection/ —
2023-07-18 - Targeted Turla attacks (UAC-0024, UAC-0003) using CAPIBAR and KAZUAR malware/ —
2023-07-18 - Ursnif VS Italy- Il PDF del Destino/ —
2023-07-19 - BYOS – Bundle Your Own Stealer/ —
2023-07-19 - Escalating Privileges via Third-Party Windows Installers/ —
2023-07-19 - Lookout Attributes Advanced Android Surveillanceware to Chinese Espionage Group APT41/ —
2023-07-19 - Military topics become the focus- The threat of fake hunter APT organizations continues to be exposed/ —
2023-07-19 - P2PInfect- The Rusty Peer-to-Peer Self-Replicating Worm/ —
2023-07-20 - Analyzing a New .NET variant of LaplasClipper- retrieving the config/ —
2023-07-20 - JumpCloud Intrusion - Attacker Infrastructure Links Compromise to North Korean APT Activity/ —
2023-07-20 - JumpCloud Intrusion Attacker Infrastructure Links Compromise to North Korean APT Activity/ —
2023-07-20 - KillNet Showcases New Capabilities While Repeating Older Tactics/ —
2023-07-20 - Threat Group Assessment- Mallox Ransomware/ —
2023-07-21 - Exploitation of Citrix Zero-Day by Possible Espionage Actors (CVE-2023-3519)/ —
2023-07-21 - First Known Targeted OSS Supply Chain Attacks Against the Banking Sector/ —
2023-07-21 - Ransomware Spotlight- Play/ —
2023-07-22 - HookBot Android Malware Builder Panel and APK Source/ —
2023-07-23 - Guloader Deobfuscation using Ghidra/ —
2023-07-23 - Malware via VHD Files, an Excellent Choice/ —
2023-07-24 - Deep Analysis of Vidar Stealer/ —
2023-07-24 - Lazarus Threat Group Attacking Windows Servers to Use as Malware Distribution Points/ —
2023-07-24 - North Korea Leverages SaaS Provider in a Targeted Supply Chain Attack/ —
2023-07-24 - Norway government ministries hit by cyber attack/ —
2023-07-24 - Pro-PRC HaiEnergy Campaign Exploits U.S. News Outlets via Newswire Services to Target U.S. Audiences; Evidence of Commissioned Protests in Washington, D.C/ —
2023-07-25 - Akira’s Play with Linux/ —
2023-07-25 - Amadey Threat Analysis and Detections/ —
2023-07-25 - EVOLUTION OF RUSSIAN APT29 – NEW ATTACKS AND TECHNIQUES UNCOVERED/ —
2023-07-25 - Hibernating Qakbot- A Comprehensive Study and In-depth Campaign Analysis/ —
2023-07-25 - Who and What is Behind the Malware Proxy Service SocksEscort-/ —
2023-07-26 - Christmas in July- A finely wrapped Malware Proxy Service/ —
2023-07-26 - Conti and Akira- Chained Together/ —
2023-07-26 - Incident Response trends Q2 2023- Data theft extortion rises, while healthcare is still most-targeted vertical/ —
2023-07-26 - Into the tank with Nitrogen/ —
2023-07-26 - Major Malaysian water utilities company hit by hackers; Ranhill offline; hackers claim databases and backups deleted/ —
2023-07-26 - PatchWork’s new assault Weapons report — EyeShell Weapons Disclosure/ —
2023-07-27 - Are Akira Ransomware's Crypto-Locking Malware Days Numbered-/ —
2023-07-27 - Bitter’s new assault weapon analysis - ORPCBackdoor weapon/ —
2023-07-27 - Dark Web Profile- 8Base Ransomware/ —
2023-07-28 - APT Bahamut Targets Individuals with Android Malware Using Spear Messaging/ —
2023-07-28 - CISA Releases Malware Analysis Reports on Barracuda Backdoors/ —
2023-07-28 - Detecting Ongoing STARK#MULE Attack Campaign Targeting Victims Using US Military Document Lures/ —
2023-07-28 - Detecting Ongoing STARKMULE Attack Campaign Targeting Victims Using US Military Document Lures/ —
2023-07-28 - Inside the IcedID BackConnect Protocol (Part 2)/ —
2023-07-28 - MAR-10454006-r1.v2 SUBMARINE Backdoor/ —
2023-07-28 - MAR-10454006-r2.v1 SEASPY Backdoor/ —
2023-07-28 - Scattered Spider Threat Actor Profile/ —
2023-07-29 - Linux version of Abyss Locker ransomware targets VMware ESXi servers/ —
2023-07-29 - Unknown powershell backdoor with ties to new Zloader/ —
2023-07-31 - Bandit Stealer Garbled/ —
2023-07-31 - Cado Security Labs Encounter Novel Malware, Redis P2Pinfect/ —
2023-07-31 - China-Backed Hackers Threaten Texas Military Sites, Utilities/ —
2023-07-31 - Out of the Sandbox- WikiLoader Digs Sophisticated Evasion/ —
2023-07-31 - Pikabot deep analysis/ —
2023-07-31 - SpyNote continues to attack financial institutions/ —
2023-08-01 - Analysis of Recent Activities of the Mylobot Botnet/ —
2023-08-01 - BatLoader Continues Signed MSIX App Package Abuse/ —
2023-08-01 - Illicit Brand Impersonation - A Threat Hunting Approach/ —
2023-08-01 - NodeStealer 2.0 – The Python Version- Stealing Facebook Business Accounts/ —
2023-08-01 - Sliver C2 Being Distributed Through Korean Program Development Company/ —
2023-08-02 - BlueCharlie, Previously Tracked as TAG-53, Continues to Deploy New Infrastructure in 2023/ —
2023-08-02 - HUI Loader — Malware Analysis Note/ —
2023-08-02 - Lazarus Group Launches First Open Source Supply Chain Attacks Targeting Crypto Sector/ —
2023-08-02 - Midnight Blizzard conducts targeted social engineering over Microsoft Teams/ —
2023-08-03 - DarkGate Keylogger Analysis- Masterofnone/ —
2023-08-03 - Reptile Malware Targeting Linux Systems/ —
2023-08-03 - Russian APT 'BlueCharlie' Swaps Infrastructure to Evade Detection/ —
2023-08-03 - What’s happening in the world of crimeware- Emotet, DarkGate and LokiBot/ —
2023-08-06 - DarkGate - Threat Breakdown Journey/ —
2023-08-07 - Comrades in Arms - North Korea Compromises Sanctioned Russian Missile Engineering Company/ —
2023-08-07 - Comrades in Arms- - North Korea Compromises Sanctioned Russian Missile Engineering Company/ —
2023-08-07 - Latest Batloader Campaigns Use Pyarmor Pro for Evasion/ —
2023-08-07 - New threat actor targets Bulgaria, China, Vietnam and other countries with customized Yashma ransomware/ —
2023-08-08 - CISA Malware Analysis Report - Barracuda ESG Seaspy and Whirlpool/ —
2023-08-08 - CrowdStrike observes massive spike in identity-based attacks/ —
2023-08-08 - RedHotel - A Prolific, Chinese State-Sponsored Group Operating at a Global Scale/ —
2023-08-08 - Statc Stealer- Decoding the Elusive Malware Threat/ —
2023-08-08 - The Rhysida Ransomware- Activity Analysis And Ties To Vice Society/ —
2023-08-08 - What Cisco Talos knows about the Rhysida ransomware/ —
2023-08-09 - An Overview of the New Rhysida Ransomware Targeting the Healthcare Sector/ —
2023-08-09 - Rhysida ransomware behind recent attacks on healthcare/ —
2023-08-09 - Understanding BumbleBee- The delivery of Bumblee/ —
2023-08-10 - Discovering and Blocking a Zero-Day Exploit with CrowdStrike Falcon Complete- The Case of CVE-2023-36874/ —
2023-08-10 - Exploring New Techniques of Fake Browser Updates Leading to NetSupport RAT/ —
2023-08-10 - Focus on DroxiDat-SystemBC/ —
2023-08-10 - German Embassy Lure - Likely Part of Campaign Against NATO Aligned Ministries of Foreign Affairs/ —
2023-08-10 - German Embassy Lure- Likely Part of Campaign Against NATO Aligned Ministries of Foreign Affairs/ —
2023-08-10 - Gootloader- Why your Legal Document Search May End in Misery/ —
2023-08-10 - GuLoader Malware Disguised as Tax Invoices and Shipping Statements (Detected by MDS Products)/ —
2023-08-10 - Iranian cyber spies are targeting dissidents in Germany, warns intelligence service/ —
2023-08-10 - JanelaRAT - Repurposed BX RAT variant targeting FinTech users in the LATAM region/ —
2023-08-10 - MoustachedBouncer - Espionage against foreign diplomats in Belarus/ —
2023-08-10 - MoustachedBouncer- Espionage against foreign diplomats in Belarus/ —
2023-08-10 - Unveiling the Dominance of Scams Amidst a 24% Surge in Blocked Attacks/ —
2023-08-12 - Sophisticated, Highly-Targeted Attacks Continue to Plague npm/ —
2023-08-14 - Monti Ransomware Unleashes a New Encryptor for Linux/ —
2023-08-15 - Raccoon Stealer Announce Return After Hiatus/ —
2023-08-15 - StealC Delivered via Deceptive Google Sheets/ —
2023-08-16 - APT-K-47 “Mysterious Elephant”, a new APT organization in South Asia/ —
2023-08-17 - Chinese Entanglement - DLL Hijacking in the Asian Gambling Sector/ —
2023-08-17 - Cuba Ransomware Deploys New Tools - Targets Critical Infrastructure Sector in the U.S. and IT Integrator in Latin America/ —
2023-08-17 - Godfather Android Banking Trojan Technical Analysis/ —
2023-08-17 - No Rest For The Wicked- HiatusRAT Takes Little Time Off In A Return To Action/ —
2023-08-17 - Scattered Spider- The Modus Operandi/ —
2023-08-18 - Understanding BumbleBee- The malicious behavior of BumbleBee/ —
2023-08-18 - Understanding Syscalls- Direct, Indirect, and Cobalt Strike Implementation/ —
2023-08-21 - On the Horizon- Ransomed.vc Ransomware Group Spotted in the Wild/ —
2023-08-21 - XLoader's Latest Trick - New macOS Variant Disguised as Signed OfficeNote App/ —
2023-08-22 - Agniane Stealer- Dark Web’s Crypto Threat/ —
2023-08-22 - Analysis of APT Attack Cases Targeting Web Services of Korean Corporations/ —
2023-08-22 - Analyzing the new attack activity of the Andariel group/ —
2023-08-22 - Carderbee APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong/ —
2023-08-22 - Carderbee- APT Group use Legit Software in Supply Chain Attack Targeting Orgs in Hong Kong/ —
2023-08-22 - FBI Identifies Cryptocurrency Funds Stolen by DPRK/ —
2023-08-22 - GroundPeony Crawling with Malice/ —
2023-08-23 - Akira- Pulling on the chains of ransomware/ —
2023-08-23 - Defending Against 8base- Uncovering Their Arsenal and Crafting Responses/ —
2023-08-23 - Malware-as-a-Service- Redline Stealer Variants Demonstrate a Low-Barrier-to-Entry Threat/ —
2023-08-24 - Flax Typhoon using legitimate software to quietly access Taiwanese organizations/ —
2023-08-24 - Lazarus Group exploits ManageEngine vulnerability to deploy QuiteRAT/ —
2023-08-24 - Lazarus Group's infrastructure reuse leads to discovery of new malware/ —
2023-08-24 - Revisting BLISTER- New development of the BLISTER loader/ —
2023-08-24 - Signs of MuddyWater Developments Found in the DNS/ —
2023-08-24 - XWorm- Technical Analysis of a New Malware Version/ —
2023-08-24 - “Proxy” Based Phishing Attacks Are on the Rise Again/ —
2023-08-25 - Shining some light on the DarkGate loader/ —
2023-08-25 - Suspected APT37 New Attack Weapon Fakecheck Analysis Report/ —
2023-08-25 - Technical analysis of WarZoneRAT malware/ —
2023-08-25 - Warzone RAT configuration extractor/ —
2023-08-26 - ClearFake Malware Analysis/ —
2023-08-26 - Tracking Adversaries- Scattered Spider, the BlackCat affiliate/ —
2023-08-28 - APT-C-55 (Kimsuky) organization uses Korean domain names for malicious activities/ —
2023-08-28 - Defender Experts Chronicles- A Deep Dive into Storm-0867/ —
2023-08-28 - DreamBus Botnet Resurfaces, Targets RocketMQ vulnerability/ —
2023-08-28 - HTML Smuggling Leads to Domain Wide Ransomware/ —
2023-08-28 - MalDoc in PDF - Detection bypass by embedding a malicious Word file into a PDF file –/ —
2023-08-29 - Diving Deep into UNC4841 Operations Following Barracuda ESG Zero-Day Remediation (CVE-2023-2868)/ —
2023-08-29 - Documents and Resources related to the Disruption of the QakBot Malware and Botnet/ —
2023-08-29 - FBI, Partners Dismantle Qakbot Infrastructure in Multinational Cyber Takedown/ —
2023-08-29 - Kinsing Malware Exploits Novel Openfire Vulnerability/ —
2023-08-29 - Law Enforcement Takes Down QakBot/ —
2023-08-29 - New Remo Android Banking Trojan Targets Over 50 Banking Applications And Crypto Wallets/ —
2023-08-29 - Qakbot - the takedown and the remediation/ —
2023-08-29 - Qakbot Botnet Disruption/ —
2023-08-29 - Qakbot Malware Disrupted in International Cyber Takedown/ —
2023-08-29 - U.S. Hacks QakBot, Quietly Removes Botnet Infections/ —
2023-08-30 - A Fake Signal App Was Planted On Google Play By China-Linked Hackers/ —
2023-08-30 - A Look Into DuckTail/ —
2023-08-30 - APT34 Unleashes New Wave of Phishing Attack with Variant of SideTwist Trojan/ —
2023-08-30 - Battling the Death Trap of Malicious Loan Apps/ —
2023-08-30 - Earth Estries Targets Government, Tech for Cyberespionage/ —
2023-08-30 - Empire Dragon Accelerates Covert Information Operations, Converges with Russian Narratives/ —
2023-08-30 - Gazavat - Expiro DMSniff connection and DGA analysis/ —
2023-08-30 - IT threat evolution in Q2 2023/ —
2023-08-30 - Trickbot in Light of Trickleaks Data/ —
2023-08-31 - A Deep Dive into Brute Ratel C4 Payloads/ —
2023-08-31 - Analysis of Andariels New Attack Activities/ —
2023-08-31 - Analysis of Andariel’s New Attack Activities/ —
2023-08-31 - Fake Update Utilizes New IDAT Loader To Execute StealC and Lumma Infostealers/ —
2023-08-31 - From Hidden Bee to Rhadamanthys - The Evolution of Custom Executable Formats/ —
2023-08-31 - One month later, Ranhill still hasn’t fully recovered from cyberattack/ —
2023-08-31 - Reverse engineering SuperBear RAT/ —
2023-08-31 - SapphireStealer- Open-source information stealer enables credential and data theft/ —
2023-09-01 - Malicious LNK that distributes backdoors- RedEyes (ScarCruft)/ —
2023-09-01 - Understanding BumbleBee- BumbleBee’s malware configuration and clusters/ —
2023-09-04 - A deep dive into DCRAT-DarkCrystalRAT malware/ —
2023-09-04 - Amadey- New encoding with old tricks/ —
2023-09-04 - APT28 uses msedge as a bootloader, TOR and mockbin websitehook services as a control center (CERT-UA#7469)/ —
2023-09-04 - APT28 uses msedge as a bootloader, TOR and mockbin websitehook services as a control center (CERT-UA7469)/ —
2023-09-04 - Cert.lv- activist groups supported by Russia perform cyber attacks on Latvian state institutions/ —
2023-09-04 - CHM Malware Using Fukushima Contaminated Water Discharge- RedEyes (ScarCruft)/ —
2023-09-05 - BlueShell malware used in APT attacks targeting Korea and Thailand/ —
2023-09-05 - Chae$ 4- New Chaes Malware Variant Targeting Financial and Logistics Customers/ —
2023-09-05 - MultiPlatform HTTP Reverse Shell/ —
2023-09-06 - DarkGate Loader Malware Delivered via Microsoft Teams/ —
2023-09-06 - Mac users targeted in new malvertising campaign delivering Atomic Stealer/ —
2023-09-06 - Pizza Hut Australia leaks one million customers' details, claims ShinyHunters hacking group/ —
2023-09-06 - Steal-It Campaign/ —
2023-09-06 - The Rise of the Lumma Info-Stealer/ —
2023-09-07 - 'From Russia with a 71'- Uncovering Gamaredon's fast flux infrastructure. New apex domains and ASN-IP diversity patterns discovered/ —
2023-09-07 - Active North Korean campaign targeting security researchers/ —
2023-09-07 - China, North Korea pursue new targets while honing cyber capabilities/ —
2023-09-07 - Critical Energy Infrastructure Facility Attack In Ukraine/ —
2023-09-07 - Evolution of USB-Borne Malware, Raspberry Robin/ —
2023-09-07 - From Russia with a 71 - Uncovering Gamaredons fast flux infrastructure/ —
2023-09-07 - MAR-10454006.r5.v1 SUBMARINE, SKIPJACK, SEASPRAY, WHIRLPOOL, and SALTWATER Backdoors/ —
2023-09-07 - Multiple Foreign Nationals Charged in Connection with Trickbot Malware and Conti Ransomware Conspiracies/ —
2023-09-07 - My Tea’s not cold. An overview of China’s cyber threat/ —
2023-09-07 - New Hive0117 phishing campaign imitates conscription summons to deliver DarkWatchman malware/ —
2023-09-07 - PTI-257 (ex-Wizard Spider) - IOCs/ —
2023-09-07 - The Case of LummaC2 v4.0/ —
2023-09-07 - The Infamous Mirai Trojan Evolves- New “Pandora” Variant Targets Android TVs/ —
2023-09-08 - Carderbee Targets Hong Kong in Supply Chain Attack/ —
2023-09-08 - RedEyes (ScarCruft) CHM Malware Using the Topic of Fukushima Wastewater Release/ —
2023-09-08 - RomCom RAT- Not Your Typical Love Story/ —
2023-09-08 - Uncovering DDGroup — A long-time threat actor/ —
2023-09-11 - BlueShell Used in APT Attacks Against Korean and Thai Targets/ —
2023-09-11 - From Caribbean shores to your devices- analyzing Cuba ransomware/ —
2023-09-11 - From ERMAC to Hook- Investigating the technical differences between two Android malware variants/ —
2023-09-11 - OriginBotnet Spreads via Malicious Word Document/ —
2023-09-12 - A peek into APT36’s updated arsenal/ —
2023-09-12 - Email campaigns leverage updated DBatLoader to deliver RATs, stealers/ —
2023-09-12 - Malware distributor Storm-0324 facilitates ransomware access/ —
2023-09-12 - Redfly Espionage Actors Continue to Target Critical Infrastructure/ —
2023-09-12 - Redfly- Espionage Actors Continue to Target Critical Infrastructure/ —
2023-09-12 - The Transportation sector cyber threat overview/ —
2023-09-13 - FBI Hacker Dropped Stolen Airbus Data on 9-11/ —
2023-09-13 - New Ransomware Threats and the Rising Menace of Telegram/ —
2023-09-14 - Operation Rusty Flag – A Malicious Campaign Against Azerbaijanian Targets/ —
2023-09-14 - Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets/ —
2023-09-14 - Sekoia.io mid-2023 Ransomware Threat Landscape/ —
2023-09-15 - Reverse engineering natively-compiled .NET apps/ —
2023-09-15 - The DGA of BumbleBee/ —
2023-09-15 - Threat Group Assessment - Turla/ —
2023-09-15 - Threat Group Assessment- Muddled Libra/ —
2023-09-18 - -Scattered Spider- group launches ransomware attacks while expanding targets in hospitality, retail/ —
2023-09-18 - CapraTube - Transparent Tribe’s CapraRAT Mimics YouTube to Hijack Android Phones/ —
2023-09-18 - Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement/ —
2023-09-18 - HijackLoader Targets Hotels- A Technical Analysis/ —
2023-09-18 - Who's Behind the 8Base Ransomware Website-/ —
2023-09-19 - #ShortAndMalicious — DarkGate/ —
2023-09-19 - Multi-year Chinese APT Campaign Targets South Korean Academic, Government, and Political Entities/ —
2023-09-19 - New ShroudedSnooper actor targets telecommunications firms in the Middle East with novel Implants/ —
2023-09-19 - Unveiling the Shadows- The Dark Alliance between GuLoader and Remcos/ —
2023-09-20 - Behind the Scenes of BBTok- Analyzing a Banker’s Server Side Components/ —
2023-09-20 - Cado Security Labs Researchers Witness a 600X Increase in P2Pinfect Traffic/ —
2023-09-20 - Chinese Malware Appears in Earnest Across Cybercrime Threat Landscape/ —
2023-09-20 - Unmasking USDoD- The Enigma of the Cyber Realm/ —
2023-09-21 - Backchannel Diplomacy - APT29s Rapidly Evolving Diplomatic Phishing Operations/ —
2023-09-21 - Cyber Soft Power - China’s Continental Takeover/ —
2023-09-21 - OilRig’s Outer Space and Juicy Mix- Same ol’ rig, new drill pipes/ —
2023-09-21 - Quick Malware Analysis- PIKABOT INFECTION WITH COBALT STRIKE pcap from 2023-05-23/ —
2023-09-21 - Sandman APT - A Mystery Group Targeting Telcos with a LuaJIT Toolkit/ —
2023-09-21 - Secrets of commercial RATs! NanoCore dissected/ —
2023-09-22 - Ahmed Eltantawy Targeted with Predator Spyware After Announcing Presidential Ambitions/ —
2023-09-22 - Backchannel Diplomacy- APT29’s Rapidly Evolving Diplomatic Phishing Operations/ —
2023-09-22 - Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda/ —
2023-09-22 - DarkGate IOCs/ —
2023-09-22 - EvilBamboo Targets Mobile Devices in Multi-year Campaign/ —
2023-09-22 - More on DreamLand/ —
2023-09-22 - Persistent Attempts at Cyberespionage Against Southeast Asian Government Target Have Links to Alloy Taurus/ —
2023-09-22 - Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government/ —
2023-09-22 - Stealth Falcon preying over Middle Eastern skies with Deadglyph/ —
2023-09-22 - Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government/ —
2023-09-22 - Unmasking the Godfather/ —
2023-09-23 - BunnyLoader, the newest Malware-as-a-Service/ —
2023-09-25 - A ransomware group claims to have breached ‘all Sony systems’/ —
2023-09-25 - APT and financial attacks on industrial organizations in H1 2023/ —
2023-09-25 - Malware development trick - part 36- Enumerate process modules. Simple C++ example/ —
2023-09-25 - New STARK#VORTEX Attack Campaign - Threat Actors Use Drone Manual Lures to Deliver MerlinAgent Payloads/ —
2023-09-25 - New STARKVORTEX Attack Campaign - Threat Actors Use Drone Manual Lures to Deliver MerlinAgent Payloads/ —
2023-09-25 - Newly Discovered APT Attacker AtlasCross Exploits Red Cross Blood Drive Phishing for Cyberattack/ —
2023-09-25 - REArchive- Reverse engineering APT37’s GOLDBACKDOOR dropper/ —
2023-09-25 - Securonix Threat Labs Security Advisory- New STARK#VORTEX Attack Campaign- Threat Actors Use Drone Manual Lures to Deliver MerlinAgent Payloads/ —
2023-09-25 - Smishing Triad Impersonates Emirates Post to Target UAE Citizens/ —
2023-09-25 - SSSCIP RUSSIA'S CYBER TACTICS H1'2023/ —
2023-09-25 - Warning- Newly Discovered APT Attacker AtlasCross Exploits Red Cross Blood Drive Phishing for Cyberattack/ —
2023-09-26 - Analyzing Lu0Bot- A Node.js Malware with Near-Unlimited Capabilities/ —
2023-09-27 - A Deep Dive into Brute Ratel C4 payloads – Part 2/ —
2023-09-27 - Dark River. You can't see them, but they're there/ —
2023-09-27 - Uncovering the “Easy Stealer” Infostealer/ —
2023-09-27 - ‘Ransomed.VC’ in the Spotlight – What is Known About the Ransomware Group Targeting Sony and NTT Docomo/ —
2023-09-28 - Budworm - APT Group Uses Updated Custom Tool in Attacks on Government and Telecoms Org/ —
2023-09-28 - Exploring ScamClub Payloads via Deobfuscation Using Abstract Syntax Trees/ —
2023-09-28 - Loader Galore - TaskLoader at the start of a Pay-per-Install Infection Chain/ —
2023-09-28 - The Scattered Spider Ransomware Group’s Secret Weapons- Social Engineering and Fluent English/ —
2023-09-28 - The security pitfalls of social media sites offering ID-based authentication/ —
2023-09-29 - APT34 Deploys Phishing Attack With New Malware/ —
2023-09-29 - Lazarus luring employees with trojanized coding challenges - The case of a Spanish aerospace company/ —
2023-09-29 - Lazarus luring employees with trojanized coding challenges- The case of a Spanish aerospace company/ —
2023-10-01 - .NET Assembly Obfuscation for Memory Scanner Evasion/ —
2023-10-01 - ShinyHunters’ 22-Year-Old Member Pleads Guilty to Cyber Extortion, Causing $6 Million in Damage/ —
2023-10-02 - LightSpy mAPT Mobile Payment System Attack/ —
2023-10-03 - 2023-10-03 (Tuesday) - PikaBot infection with Cobalt Strike/ —
2023-10-03 - Introducing the REF5961 intrusion set (RUDEBIRD, DOWNTOWN, and EAGERBEE)/ —
2023-10-03 - Lighting the Exfiltration Infrastructure of a LockBit Affiliate (and more)/ —
2023-10-03 - NATO 'actively addressing' alleged cyberattack affecting some websites/ —
2023-10-03 - Rhadamanthys malware analysis- How infostealers use VMs to avoid analysis/ —
2023-10-03 - Stealc Malware Analysis/ —
2023-10-04 - Developing Yara Signatures for Malware - Practical Examples/ —
2023-10-04 - Introducing the REF5961 intrusion set/ —
2023-10-04 - Operation King Tut – The universe of threats in LATAM/ —
2023-10-05 - Chinese State-Sponsored Cyber Espionage Activity Targeting Semiconductor Industry in East Asia/ —
2023-10-05 - Introduction to DotNet Configuration Extraction - RevengeRAT/ —
2023-10-05 - Operation Jacana- Foundling hobbits in Guyana/ —
2023-10-05 - Qakbot-affiliated actors distribute Ransom Knight malware despite infrastructure takedown/ —
2023-10-05 - Securonix Threat Labs Monthly Intelligence Insights – September 2023/ —
2023-10-05 - Unveiling activities of Tropic Trooper 2023- deep analysis of Xiangoop Loader and EntryShell payload/ —
2023-10-05 - Unveiling activities of Tropic Trooper 2023/ —
2023-10-06 - Hacking Group ‘Cyber Av3ngers’ Claims Responsibility for Yavne Power Outages- What You Need to Know/ —
2023-10-09 - Cyber Criminals Using EvilProxy Phishing Kit To Target Senior Executives in U.S. Firms/ —
2023-10-09 - IZ1H9 Campaign Enhances Its Arsenal with Scores of Exploits/ —
2023-10-09 - Reflections of the Israel-Palestine Conflict on the Cyber World/ —
2023-10-10 - Assessed Cyber Structure and Alignments of North Korea in 2023/ —
2023-10-10 - Grayling - Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan/ —
2023-10-10 - Grayling- Previously Unseen Threat Actor Targets Multiple Organizations in Taiwan/ —
2023-10-10 - Hacktivists take sides in Israel-Palestinian war/ —
2023-10-10 - How To Develop Yara Rules for .NET Malware Using IL ByteCodes/ —
2023-10-10 - Threat Actor deploys Mythic’s Athena Agent to target Russian Semiconductor Suppliers/ —
2023-10-11 - Automatic disruption of human-operated attacks through containment of compromised user accounts/ —
2023-10-11 - Hacker Group “Caracal Kitten” Targets KDP Activists With Malware/ —
2023-10-11 - Stayin Alive – Targeted Attacks Against Telecoms and Government Ministries in Asia/ —
2023-10-12 - CVE-2023-38831 Exploited by Pro-Russia Hacking Groups in RU-UA Conflict Zone for Credential Harvesting Operations/ —
2023-10-12 - DarkGate Opens Organizations for Attack via Skype, Teams/ —
2023-10-12 - Forensic Timeline of an IcedID Infection/ —
2023-10-12 - ToddyCat - Keep calm and check logs/ —
2023-10-13 - Analysis Report on Lazarus Threat Groups Volgmer and Scout Malware/ —
2023-10-13 - Analysis Report on Lazarus Threat Group’s Volgmer and Scout Malware/ —
2023-10-13 - Analysis Report on Lazarus Threat Group’s Volgmer and Scout Malwares/ —
2023-10-13 - APT Group DarkPink Exploits WinRAR 0-Day to Target Multiple Entities in Vietnam and Malaysia/ —
2023-10-13 - Disclosing the BLOODALCHEMY backdoor/ —
2023-10-13 - Rewterz Threat Alert – Power Supplier’s Network Infiltrated for 6 Months by “Redfly” Hackers – Active IOCs/ —
2023-10-13 - Sticky Werewolf spies attack state organizations of Russia and Belarus/ —
2023-10-13 - The Good, the Bad and the Ugly in Cybersecurity – Week 41/ —
2023-10-13 - Void Rabisu Targets Female Political Leaders with New Slimmed-Down ROMCOM Variant/ —
2023-10-14 - Disclosing the BLOODALCHEMY backdoor/ —
2023-10-15 - Chinese Cyber- Resources for Western Researchers/ —
2023-10-15 - Colonial Pipeline attributes ransomware claims to ‘unrelated’ third-party data breach/ —
2023-10-15 - Features of destructive Sandworm cyber attacks in relation to Ukrainian providers (CERT-UA-7627)/ —
2023-10-16 - A hack in hand is worth two in the bush/ —
2023-10-16 - ClearFake- a newcomer to the “fake updates” threats landscape/ —
2023-10-16 - Decoding a Simple Visual Basic (.vbs) Script - DarkGate Loader/ —
2023-10-17 - APT trends report Q3 2023/ —
2023-10-17 - Dark Peep #2- War and a Piece of Hilarity/ —
2023-10-17 - Lumma Stealer actively deployed in multiple campaigns/ —
2023-10-17 - PROSPERNOT (PROSPERO-AS) The Little AS That Could. Part 1/ —
2023-10-18 - Ghidra Tutorial - Using Entropy To Locate a Cobalt Strike Decryption Function/ —
2023-10-18 - Government-backed actors exploiting WinRAR vulnerability/ —
2023-10-18 - Qubitstrike - An Emerging Malware Campaign Targeting Jupyter Notebooks/ —
2023-10-18 - Threat Actor Profile- SiegedSec/ —
2023-10-18 - Updated MATA attacks industrial companies in Eastern Europe/ —
2023-10-19 - Crambus- New Campaign Targets Middle Eastern Government/ —
2023-10-20 - Authorities confirm RagnarLocker ransomware taken down during international sting/ —
2023-10-20 - Decoding a Cobalt Strike .hta Loader Using CyberChef and Emulation/ —
2023-10-20 - IcedID gets Loaded/ —
2023-10-20 - Malware and cryptography 21- encrypt-decrypt payload via WAKE. Simple C++ example/ —
2023-10-21 - Malware analysis NJ RAT 0.7NC & 0.6.4/ —
2023-10-23 - Advice For Catching a RedLine Stealer/ —
2023-10-23 - Cobalt Strike .VBS Loader - Decoding with Advanced CyberChef and Emulation/ —
2023-10-23 - From Copacabana to Barcelona- The Cross-Continental Threat of Brazilian Banking Malware/ —
2023-10-23 - The outstanding stealth of Operation Triangulation/ —
2023-10-24 - Malware stories- Deworming the XWorm/ —
2023-10-24 - The Israel-Hamas War - Cyber Domain State-Sponsored Activity of Interest/ —
2023-10-25 - Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan/ —
2023-10-25 - Skuld Stealer/ —
2023-10-25 - Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers/ —
2023-10-26 - AridViper, an intrusion set allegedly associated with Hamas/ —
2023-10-26 - How to catch a wild triangle/ —
2023-10-26 - Rhysida Ransomware Technical Analysis/ —
2023-10-26 - SmartApeSG/ —
2023-10-27 - A cascade of compromise - unveiling Lazarus new campaign/ —
2023-10-27 - A cascade of compromise- unveiling Lazarus’ new campaign/ —
2023-10-27 - A Guide to Scattered Spider Data Breaches/ —
2023-10-27 - GHOSTPULSE haunts victims using defense evasion bag o' tricks/ —
2023-10-27 - Hackers escalate- leak 200k CCSD students’ data; claim to still have access to CCSD email system/ —
2023-10-27 - Remcos Downloader Analysis - Manual Deobfuscation of Visual Basic and Powershell/ —
2023-10-27 - Security Analyst Summit 2023- key research/ —
2023-10-30 - 30TH OCTOBER – THREAT INTELLIGENCE REPORT/ —
2023-10-30 - BiBi Wiper/ —
2023-10-30 - Evolving Cyber Dynamics Amidst the Israel-Hamas Conflict/ —
2023-10-30 - FastViewer Variant Merged with FastSpy and disguised as a Legitimate Mobile Application/ —
2023-10-30 - Managed Security Services Provider (MSSP) Market News- 30 October 2023/ —
2023-10-30 - Nitrogen Campaign 2.0 - Reloads with Enhanced Capabilities Leading to ALPHV-BlackCat Ransomware/ —
2023-10-30 - Security Brief- TA571 Delivers IcedID Forked Loader/ —
2023-10-30 - Unpacking .NET Malware With Process Hacker and Dnspy/ —
2023-10-31 - Analysis of activities of suspected APT-C-36 (Blind Eagle) organization launching Amadey botnet Trojan (CN)/ —
2023-10-31 - Arid Viper disguising mobile spyware as updates for non-malicious Android applications/ —
2023-10-31 - Elastic catches DPRK passing out KANDYKORN/ —
2023-10-31 - From Albania to the Middle East - The Scarred Manticore is Listening/ —
2023-10-31 - From Albania to the Middle East- The Scarred Manticore is Listening/ —
2023-10-31 - Over the Kazuars Nest - Cracking Down on a Freshly Hatched Backdoor Used by Pensive Ursa (Aka Turla)/ —
2023-10-31 - Over the Kazuar’s Nest- Cracking Down on a Freshly Hatched Backdoor Used by Pensive Ursa (Aka Turla)/ —
2023-10-31 - Prolific Puma- Shadowy Link Shortening Service Enables Cybercrime/ —
2023-11-01 - Malware Dropped Through a ZPAQ Archive/ —
2023-11-01 - Malware Unpacking With Memory Dumps - Intermediate Methods (Pe-Sieve, Process Hacker, Hxd and Pe-bear)/ —
2023-11-01 - MuddyWater eN-Able spear-phishing with new TTPs/ —
2023-11-01 - New DarkGate Variant Uses a New Loading Approach/ —
2023-11-01 - Popping Blisters for research- An overview of past payloads and exploring recent developments/ —
2023-11-01 - RedLine Stealer Malware Analysis/ —
2023-11-01 - Vietnamese Information Stealer Campaigns Target Professionals on LinkedIn/ —
2023-11-02 - From DarkGate to DanaBot/ —
2023-11-02 - Jeffco Public Schools hit by the same threat actors that hit Clark County School District — and via the same way/ —
2023-11-02 - Monthly news - November 2023/ —
2023-11-02 - Unveiling Socks5Systemz- The Rise of a New Proxy Service via PrivateLoader and Amadey/ —
2023-11-03 - GhostSec- From Fighting ISIS to Possibly Targeting Israel with RaaS/ —
2023-11-03 - Looney Tunables Vulnerability Exploited by Kinsing/ —
2023-11-03 - The Five Families- Hacker Collaboration Redefining the Game/ —
2023-11-06 - Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors/ —
2023-11-06 - Arid Viper - APTs Nest of SpyC23 Malware Continues to Target Android Devices/ —
2023-11-06 - BlueNoroff strikes again with new macOS malware/ —
2023-11-06 - GootBot – Gootloader’s new approach to post-exploitation/ —
2023-11-06 - Iran-linked hackers attack Israeli education and tech organizations/ —
2023-11-06 - SideCopys Multi-platform Onslaught - Leveraging WinRAR Zero-Day and Linux Variant of Ares RAT/ —
2023-11-06 - SideCopy’s Multi-platform Onslaught- Leveraging WinRAR Zero-Day and Linux Variant of Ares RAT/ —
2023-11-06 - Unpacking Malware With Hardware Breakpoints - Cobalt Strike/ —
2023-11-07 - Chinese APT Targeting Cambodian Government/ —
2023-11-07 - Malware development trick - part 37- Enumerate process modules via VirtualQueryEx. Simple C++ example/ —
2023-11-07 - New Gootloader Variant “GootBot” Changes the Game in Malware Tactics/ —
2023-11-08 - MuddyC2Go - Latest C2 Framework Used by Iranian APT MuddyWater Spotted in Israel/ —
2023-11-08 - MuddyC2Go – Latest C2 Framework Used by Iranian APT MuddyWater Spotted in Israel/ —
2023-11-09 - Agonizing Serpens Attack Detection- Iran-Backed Hackers Target Israeli Tech Firms and Educational Institutions/ —
2023-11-09 - IMPERIAL KITTEN Deploys Novel Malware Families in Middle East-Focused Operations/ —
2023-11-09 - Microsoft shares threat intelligence at CYBERWARCON 2023/ —
2023-11-09 - Modern Asian APT groups tactics, techniques and procedures/ —
2023-11-09 - Modern Asian APT Groups TTPs/ —
2023-11-09 - Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology/ —
2023-11-09 - Tasnim News Hacked By WeRedEvils/ —
2023-11-10 - BiBi Wiper Used in the Israel-Hamas War Now Runs on Windows/ —
2023-11-10 - Detection of attacks exploiting asset management software (Andariel Group)/ —
2023-11-10 - Ducktail fashion week/ —
2023-11-10 - The New APT Group DarkCasino and the Global Surge in WinRAR 0-Day Exploits/ —
2023-11-11 - A Unified Front Against Cyber Mercenaries/ —
2023-11-11 - Mission -Data Destruction-- A Large-scale Data-Wiping Campaign Targeting Israel/ —
2023-11-12 - ELECTRUM Targeted Ukrainian Electric Entity Using Custom Tools and CaddyWiper Malware (Oct 22)/ —
2023-11-13 - Decrypting the Mystery of MedusaLocker/ —
2023-11-13 - The attack against Danish critical infrastructure/ —
2023-11-14 - APT29 attacks Embassies using CVE-2023-38831/ —
2023-11-14 - HostingHunter Series- CHANG WAY TECHNOLOGIES CO. LIMITED/ —
2023-11-14 - Remcos RAT Detection- UAC-0050 Hackers Launch Phishing Attacks Impersonating the Security Service of Ukraine/ —
2023-11-14 - Russian and Moldovan National Pleads Guilty to Operating Illegal Botnet Proxy Service that Infected Tens of Thousands of Internet-Connected Devices Around the World/ —
2023-11-14 - TA402 Uses Complex IronWind Infection Chains to Target Middle East-Based Government Entities/ —
2023-11-14 - Taking The Elevator Down To Ring 0/ —
2023-11-15 - Identifying Simple Pivot Points in Malware Infrastructure - RisePro Stealer/ —
2023-11-15 - Investigating the New Rhysida Ransomware/ —
2023-11-16 - Approaching stealers devs - a brief interview with LummaC2/ —
2023-11-16 - BlackCat plays with malvertising traps to lure corporate victims/ —
2023-11-16 - Elephant Hunting - Inside an Indian Hack-For-Hire Group/ —
2023-11-16 - Scattered Spider/ —
2023-11-16 - Zimbra 0-day used to target international government organizations/ —
2023-11-17 - A deep dive into Phobos ransomware, recently deployed by 8Base group/ —
2023-11-17 - Into the Trash - Analyzing LitterDrifter/ —
2023-11-17 - Malware Spotlight – Into the Trash- Analyzing LitterDrifter/ —
2023-11-17 - Stately Taurus Targets the Philippines As Tensions Flare in the South Pacific/ —
2023-11-17 - Understanding the Phobos affiliate structure and activity/ —
2023-11-19 - A Look at IPStorm - Cross-Platform Malware Written in Go/ —
2023-11-19 - Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike/ —
2023-11-19 - PikaBot Is Back With a Vengeance - Part 2/ —
2023-11-20 - Are DarkGate and PikaBot the new QakBot-/ —
2023-11-20 - CVE-2023-46604 (Apache ActiveMQ) Exploited to Infect Systems With Cryptominers and Rootkits/ —
2023-11-20 - DarkGate Internals/ —
2023-11-20 - Unveiling LummaC2 stealer’s novel Anti-Sandbox technique- Leveraging trigonometry for human behavior detection/ —
2023-11-21 - Hacking Employers and Seeking Employment- Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors/ —
2023-11-21 - PlayCrypt Ransomware-as-a-Service Expands Threat from Script Kiddies and Sophisticated Attackers/ —
2023-11-21 - Scattered Spider Attack Analysis/ —
2023-11-21 - Stealthy WailingCrab Malware misuses MQTT Messaging Protocol/ —
2023-11-21 - The Continued Evolution of the DarkGate Malware-as-a-Service/ —
2023-11-21 - The Platform Matters- A Comparative Study on Linux and Windows Ransomware Attacks/ —
2023-11-21 - Tracking Vidar Infrastructure with Censys/ —
2023-11-21 - Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors/ —
2023-11-21 - Unmasking NJRat- A Deep Dive into a Notorious Remote Access Trojan Part1/ —
2023-11-22 - Diamond Sleet supply chain compromise distributes a modified CyberLink installer/ —
2023-11-22 - HrServ - Previously unknown web shell used in APT attack/ —
2023-11-22 - Practical Queries for Malware Infrastructure - Part 3 (Advanced Examples)/ —
2023-11-23 - Cyber spies from XDSpy attack Russian metallurgists and military-industrial complex enterprises/ —
2023-11-23 - Defence Intelligence of Ukraine conducted a cyber operation against Rosaviatsia/ —
2023-11-23 - Israel-Hamas War Spotlight - Shaking the Rust Off SysJoker/ —
2023-11-23 - Israel-Hamas War Spotlight- Shaking the Rust Off SysJoker/ —
2023-11-23 - Malware analysis Remcos RAT- 4.9.2 Pro/ —
2023-11-23 - Malware and cryptography 22- encrypt-decrypt payload via XTEA. Simple C++ example/ —
2023-11-23 - ParaSiteSnatcher- How Malicious Chrome Extensions Target Brazil/ —
2023-11-23 - Unveiling the Deceptive Dance- Phobos Ransomware Masquerading As VX-Underground/ —
2023-11-24 - Approaching stealers devs - a brief interview with Recordbreaker/ —
2023-11-26 - From Infection to Encryption- Tracing the Impact of RYUK Ransomware/ —
2023-11-26 - Identifying Suspected PrivateLoader Servers with Censys/ —
2023-11-27 - Building Threat Intel Queries Utilising Regex and TLS Certificates - (BianLian)/ —
2023-11-27 - DPRK Crypto Theft - macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads/ —
2023-11-27 - DPRK state-linked cyber actors conduct software supply chain attacks/ —
2023-11-27 - WildCard - The APT Behind SysJoker Targets Critical Sectors in Israel/ —
2023-11-28 - Aki-RATs – Command and Control Party/ —
2023-11-28 - Approaching stealers devs - a brief interview with Meduza/ —
2023-11-28 - GoTitan Botnet - Ongoing Exploitation on Apache ActiveMQ/ —
2023-11-28 - RisePro Malware Analysis- Exploring C2 Communication of a New Version/ —
2023-11-29 - Akira Ransomware/ —
2023-11-29 - Emerging MaaS Operator Sordeal Releases Nova Infostealer/ —
2023-11-30 - Advanced Threat Intel Queries - Catching 83 Qakbot Servers with Regex, Censys and TLS Certificates/ —
2023-11-30 - AeroBlade on the Hunt Targeting the U.S. Aerospace Industry/ —
2023-11-30 - Analysis of OceanLotus APT organization's imitating APT29 attack activities/ —
2023-11-30 - Approaching stealers devs - a brief interview with Vidar/ —
2023-11-30 - Hellhounds - Operation Lahat/ —
2023-11-30 - Kimsuky Targets South Korean Research Institutes with Fake Import Declaration/ —
2023-11-30 - New SugarGh0st RAT targets Uzbekistan government and South Korea/ —
2023-11-30 - Promon discovers new Android banking malware, “FjordPhantom”/ —
2023-11-30 - Uncovering the Serpent/ —
2023-12-01 - Cases of attacks disguised as North Korean market price analysis documents, etc. CVE-2022-41128 vulnerability called with HWP, HWPX, DOCX, XLSX files/ —
2023-12-01 - CL-STA-0002 - New Tool Set Found Used Against Organizations in the Middle East, Africa and the US/ —
2023-12-01 - Kimsuky Group Uses AutoIt to Create Malware (RftRAT, Amadey)/ —
2023-12-01 - Monthly news - December 2023/ —
2023-12-01 - New Tool Set Found Used Against Organizations in the Middle East, Africa and the US/ —
2023-12-01 - Russian developer of Trickbot malware pleads guilty, faces 35-year sentence/ —
2023-12-02 - Approaching stealers devs - a brief interview with Amadey/ —
2023-12-02 - Threat Hunting Malware Infrastructure/ —
2023-12-03 - Linux version of Qilin ransomware focuses on VMware ESXi/ —
2023-12-03 - SkidSec Hacker Group Announces Plans to Spread North Korean Propaganda Through Hacked Printers in South Korea/ —
2023-12-04 - Detecting malicious activity against Microsoft Exchange servers (APT28)/ —
2023-12-04 - Florida water agency latest to confirm cyber incident as feds warn of nation-state attacks/ —
2023-12-04 - P2Pinfect - New Variant Targets MIPS Devices/ —
2023-12-04 - SQL Brute Force leads to Bluesky Ransomware/ —
2023-12-05 - Approaching stealers devs - a brief interview with StealC/ —
2023-12-05 - BlueNoroff- new Trojan attacking macOS users/ —
2023-12-05 - TA422’s Dedicated Exploitation Loop—the Same Week After Week/ —
2023-12-05 - The Tortoise and The Malwahare/ —
2023-12-06 - Cinnamon Tempest/ —
2023-12-06 - Getting gooey with GULOADER- deobfuscating the downloader/ —
2023-12-06 - Ghidra Basics - Identifying, Decoding and Fixing Encrypted Strings/ —
2023-12-06 - Nebula Broker- offensive operations made in Italy/ —
2023-12-06 - The csharp-streamer RAT/ —
2023-12-06 - Unmasking the Enigma- A Historical Dive into the World of PlugX Malware/ —
2023-12-06 - Unveiling “Vetta Loader”- A custom loader hitting Italy and spread through infected USB Drives/ —
2023-12-07 - DanaBot's Latest Move- Deploying Latrodectus/ —
2023-12-07 - Fighting Ursa Aka APT28 - Illuminating a Covert Campaign/ —
2023-12-07 - Fighting Ursa Aka APT28- Illuminating a Covert Campaign/ —
2023-12-07 - Russian influence and cyber operations adapt for long haul and exploit war fatigue/ —
2023-12-07 - Star Blizzard increases sophistication and evasion in ongoing attacks/ —
2023-12-07 - Two Russian Nationals Working with Russia’s Federal Security Service Charged with Global Computer Intrusion Campaign/ —
2023-12-07 - UK exposes attempted Russian cyber interference in politics and democratic processes/ —
2023-12-07 - UK names FSB unit behind hack-and-leak campaigns, summons Russian ambassador/ —
2023-12-08 - Analysis of attack samples suspected of Lazarus (APT-Q-1) involving npm package supply chain/ —
2023-12-08 - Approaching stealers devs - a brief interview with Meta/ —
2023-12-08 - Ghidra Basics - Manual Shellcode Analysis and C2 Extraction/ —
2023-12-08 - ITG05 operations leverage Israel-Hamas conflict lures to deliver Headlace malware/ —
2023-12-08 - Kimsuky Group Uses AutoIt to Create Malware (RftRAT, Amadey)/ —
2023-12-09 - AST based GootLoader unpacker, C2 extractor and deobfuscator/ —
2023-12-10 - Malware development- persistence - part 23. LNK files. Simple Powershell example/ —
2023-12-10 - Rhysida Ransomware and the Detection Opportunities/ —
2023-12-11 - Mustang Panda’s PlugX new variant targetting Taiwanese government and diplomats/ —
2023-12-11 - Operation Blacksmith - Lazarus using novel Telegram-based malware written in DLang/ —
2023-12-11 - Operation Blacksmith- Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang/ —
2023-12-11 - Sandman APT - China-Based Adversaries Embrace Lua/ —
2023-12-12 - November 2023’s Most Wanted Malware- New AsyncRAT Campaign Discovered while FakeUpdates Re-Entered the Top Ten after Brief Hiatus/ —
2023-12-12 - Rhysida Ransomware- History, TTPs And Adversary Emulation Plans/ —
2023-12-12 - Security Brief- TA4557 Targets Recruiters Directly via Email/ —
2023-12-12 - Threat actors misuse OAuth applications to automate financially driven attacks/ —
2023-12-12 - Ukrainian intelligence attacks and paralyses Russia's tax system/ —
2023-12-12 - UTG-Q-003 - Supply Chain Poisoning of 7ZIP on the Microsoft App Store/ —
2023-12-13 - CALISTO doxxing- Sekoia.io findings concurs to Reuters’ investigation on FSB-related Andrey Korinets/ —
2023-12-13 - Disrupting the gateway services to cybercrime/ —
2023-12-13 - FakeSG campaign, Akira ransomware and AMOS macOS stealer/ —
2023-12-13 - Kuiper ransomware analysis- Stairwell’s technical report/ —
2023-12-13 - Malware in the wild book/ —
2023-12-13 - Rhysida Ransomware/ —
2023-12-13 - Routers Roasting on an Open Firewall- the KV-botnet Investigation/ —
2023-12-13 - Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally/ —
2023-12-13 - Scammers Weaponize Google Forms in New BazarCall Attack/ —
2023-12-13 - TeamCity Intrusion Saga - APT29 Suspected Among the Attackers Exploiting CVE-2023-42793/ —
2023-12-13 - TeamCity Intrusion Saga- APT29 Suspected Among the Attackers Exploiting CVE-2023-42793/ —
2023-12-13 - Vishing via Microsoft Teams Facilitates DarkGate Malware Intrusion/ —
2023-12-14 - 2 Month Review of Cyber Activities in the Israel Hamas Conflict/ —
2023-12-14 - Bad Zip and new Packer for Android-BianLian/ —
2023-12-14 - Gaza Cybergang - Unified Front Targeting Hamas Opposition/ —
2023-12-14 - Imperva Detects Undocumented 8220 Gang Activities/ —
2023-12-14 - OilRigs persistent attacks using cloud service-powered downloaders/ —
2023-12-14 - Opening a Can of Whoop Ads- Detecting and Disrupting a Malvertising Campaign Distributing Backdoors/ —
2023-12-14 - Rhadamanthys v0.5.0 – A Deep Dive into the Stealer’s Components/ —
2023-12-15 - Github Repo for Malicord/ —
2023-12-15 - PikaBot distributed via malicious search ads/ —
2023-12-18 - Analysing a Widespread Microsoft 365 Credential Harvesting Campaign/ —
2023-12-18 - Innovation in Cyber Intrusions- The Evolution of TA544/ —
2023-12-18 - Organizing malware analysis with Colander- example on Android-WyrmSpy/ —
2023-12-18 - Rewterz Threat Update – Microsoft Warns of Emerging Threat by Storm-0539 Behind Gift Card Frauds/ —
2023-12-19 - Seedworm - Iranian Hackers Target Telecoms Orgs in North and East Africa/ —
2023-12-19 - Seedworm- Iranian Hackers Target Telecoms Orgs in North and East Africa/ —
2023-12-20 - CryptoGuard- An asymmetric approach to the ransomware battle/ —
2023-12-20 - GhostLocker Ransomware Analysis Report (Paywall)/ —
2023-12-20 - Nim-based Campaign Using Microsoft Word Docs to Impersonate the Nepali Government/ —
2023-12-20 - Operation HamsaUpdate - A Sophisticated Campaign Delivering Wipers Puts Israeli Infrastructure at Risk/ —
2023-12-20 - The Origin of OriginLogger & Agent Tesla/ —
2023-12-21 - Android Banking Trojan Chameleon can now bypass any Biometric Authentication/ —
2023-12-21 - Bandook - A Persistent Threat That Keeps Evolving/ —
2023-12-21 - BattleRoyal, DarkGate Cluster Spreads via Email and Fake Browser Updates/ —
2023-12-21 - BPF Memory Forensics with Volatility 3/ —
2023-12-21 - Iranian nation-state actor Peach Sandstorm delivering FalseFont backdoor/ —
2023-12-21 - Threat Actor UAC-0099 Continues to Target Ukraine/ —
2023-12-22 - Smoke and Mirrors- Understanding The Workings of Wazawaka/ —
2023-12-23 - IceNova Malware Profile/ —
2023-12-23 - Scattered Spider spins a troublesome web/ —
2023-12-24 - Barracuda Email Security Gateway Appliance (ESG) Vulnerability CVE-2023-7102/ —
2023-12-24 - Barracuda Email Security Gateway Appliance (ESG) Vulnerability/ —
2023-12-26 - Pikabot Loader analysis, round 2!/ —
2023-12-26 - Pure Logs Stealer Fails to Impress/ —
2023-12-27 - Malicious code impersonating the National Tax Service created by Konni/ —
2023-12-27 - Mallox Evading AMSI/ —
2023-12-27 - Operation Triangulation- The last (hardware) mystery/ —
2023-12-27 - Operation Triangulation- What You Get When Attack iPhones of Researchers/ —
2023-12-27 - Pivoting through a Sea of indicators to spot Turtles/ —
2023-12-28 - APT28 - From initial attack to creating threats to a domain controller in an hour (CERT-UA 8399)/ —
2023-12-28 - MetaStealer Part 2, Google Cookie Refresher Madness and Stealer Drama/ —
2023-12-28 - New Rugmi Malware Loader Surges with Hundreds of Daily Detections/ —
2023-12-28 - Trend Analysis on Kimsuky Group's Attacks Using AppleSeed/ —
2023-12-28 - Trend Analysis on Kimsuky Group’s Attacks Using AppleSeed/ —
2023-12-29 - Microsoft Storm-1152 Crackdown- Stopping Threat Actors/ —
2023-12-30 - Rewterz Threat Alert – Widely Abused MSIX App Installer Disabled by Microsoft – Active IOCs/ —