Click here to download all references as Bib-File.

Enter keywords to filter the library entries below or Propose new Entry
2023-09-28ConfiantBOZOSLIVEHERE
@online{bozoslivehere:20230928:exploring:3cc7b21, author = {BOZOSLIVEHERE}, title = {{Exploring ScamClub Payloads via Deobfuscation Using Abstract Syntax Trees}}, date = {2023-09-28}, organization = {Confiant}, url = {https://blog.confiant.com/exploring-scamclub-payloads-via-deobfuscation-using-abstract-syntax-trees-65ef7f412537}, language = {English}, urldate = {2023-09-29} } Exploring ScamClub Payloads via Deobfuscation Using Abstract Syntax Trees
2023-09-27Cyber GeeksVlad Pasca
@online{pasca:20230927:deep:2958d5b, author = {Vlad Pasca}, title = {{A Deep Dive into Brute Ratel C4 payloads – Part 2}}, date = {2023-09-27}, organization = {Cyber Geeks}, url = {https://cybergeeks.tech/a-deep-dive-into-brute-ratel-c4-payloads-part-2/}, language = {English}, urldate = {2023-09-29} } A Deep Dive into Brute Ratel C4 payloads – Part 2
Brute Ratel C4
2023-09-25cocomelonccocomelonc
@online{cocomelonc:20230925:malware:536902a, author = {cocomelonc}, title = {{Malware development trick - part 36: Enumerate process modules. Simple C++ example.}}, date = {2023-09-25}, organization = {cocomelonc}, url = {https://cocomelonc.github.io/malware/2023/09/25/malware-trick-36.html}, language = {English}, urldate = {2023-09-29} } Malware development trick - part 36: Enumerate process modules. Simple C++ example.
4h_rat Aria-body
2023-09-22PRODAFTPRODAFT
@online{prodaft:20230922:darkgate:23e4b9e, author = {PRODAFT}, title = {{DarkGate IOCs}}, date = {2023-09-22}, organization = {PRODAFT}, url = {https://github.com/prodaft/malware-ioc/blob/master/PTI-66/DarkGate.md}, language = {English}, urldate = {2023-09-25} } DarkGate IOCs
DarkGate QakBot
2023-09-20ProofpointProofpoint Threat Research Team
@online{team:20230920:chinese:25abe7e, author = {Proofpoint Threat Research Team}, title = {{Chinese Malware Appears in Earnest Across Cybercrime Threat Landscape}}, date = {2023-09-20}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape}, language = {English}, urldate = {2023-09-22} } Chinese Malware Appears in Earnest Across Cybercrime Threat Landscape
FatalRat PurpleFox ValleyRAT
2023-09-20Cado SecurityMatt Muir
@online{muir:20230920:cado:0769cd6, author = {Matt Muir}, title = {{Cado Security Labs Researchers Witness a 600X Increase in P2Pinfect Traffic}}, date = {2023-09-20}, organization = {Cado Security}, url = {https://www.cadosecurity.com/cado-security-labs-researchers-witness-a-600x-increase-in-p2pinfect-traffic/}, language = {English}, urldate = {2023-09-25} } Cado Security Labs Researchers Witness a 600X Increase in P2Pinfect Traffic
2023-09-19Cisco TalosAsheer Malhotra, Caitlin Huey, Sean Taylor, Vitor Ventura, Arnaud Zobec
@online{malhotra:20230919:new:a39af36, author = {Asheer Malhotra and Caitlin Huey and Sean Taylor and Vitor Ventura and Arnaud Zobec}, title = {{New ShroudedSnooper actor targets telecommunications firms in the Middle East with novel Implants}}, date = {2023-09-19}, organization = {Cisco Talos}, url = {https://blog.talosintelligence.com/introducing-shrouded-snooper/}, language = {English}, urldate = {2023-09-20} } New ShroudedSnooper actor targets telecommunications firms in the Middle East with novel Implants
HTTPSnoop PipeSnoop
2023-09-19Medium (@DCSO_CyTec)Johann Aydinbas
@online{aydinbas:20230919:shortandmalicious:a0cff0b, author = {Johann Aydinbas}, title = {{#ShortAndMalicious — DarkGate}}, date = {2023-09-19}, organization = {Medium (@DCSO_CyTec)}, url = {https://medium.com/@DCSO_CyTec/shortandmalicious-darkgate-d9102a457232}, language = {English}, urldate = {2023-09-20} } #ShortAndMalicious — DarkGate
DarkGate
2023-09-18Trend MicroJoseph Chen, Jaromír Hořejší
@online{chen:20230918:earth:e01f24c, author = {Joseph Chen and Jaromír Hořejší}, title = {{Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement}}, date = {2023-09-18}, organization = {Trend Micro}, url = {https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html}, language = {English}, urldate = {2023-09-18} } Earth Lusca Employs New Linux Backdoor, Uses Cobalt Strike for Lateral Movement
SprySOCKS
2023-09-18SentinelOneAlex Delamotte
@online{delamotte:20230918:capratube:77604c8, author = {Alex Delamotte}, title = {{CapraTube | Transparent Tribe’s CapraRAT Mimics YouTube to Hijack Android Phones}}, date = {2023-09-18}, organization = {SentinelOne}, url = {https://www.sentinelone.com/labs/capratube-transparent-tribes-caprarat-mimics-youtube-to-hijack-android-phones/}, language = {English}, urldate = {2023-09-20} } CapraTube | Transparent Tribe’s CapraRAT Mimics YouTube to Hijack Android Phones
CapraRAT
2023-09-15Migeel.skMichal Strehovský
@online{strehovsk:20230915:reverse:c34ac82, author = {Michal Strehovský}, title = {{Reverse engineering natively-compiled .NET apps}}, date = {2023-09-15}, organization = {Migeel.sk}, url = {https://migeel.sk/blog/2023/09/15/reverse-engineering-natively-compiled-dotnet-apps/}, language = {English}, urldate = {2023-09-20} } Reverse engineering natively-compiled .NET apps
2023-09-15CyberCXPhill Moore, Zach Stanford, Suyash Tripathi, Yogesh Khatri
@online{moore:20230915:weaponising:debcaf2, author = {Phill Moore and Zach Stanford and Suyash Tripathi and Yogesh Khatri}, title = {{Weaponising VMs to bypass EDR – Akira ransomware}}, date = {2023-09-15}, organization = {CyberCX}, url = {https://cybercx.com.au/blog/akira-ransomware/}, language = {English}, urldate = {2023-09-15} } Weaponising VMs to bypass EDR – Akira ransomware
Akira
2023-09-14Deep instinctMark Vaitzman, Ron Ben Yizhak, Simon Kenin
@online{vaitzman:20230914:operation:0b13a33, author = {Mark Vaitzman and Ron Ben Yizhak and Simon Kenin}, title = {{Operation Rusty Flag – A Malicious Campaign Against Azerbaijanian Targets}}, date = {2023-09-14}, organization = {Deep instinct}, url = {https://www.deepinstinct.com/blog/operation-rusty-flag-a-malicious-campaign-against-azerbaijanian-targets}, language = {English}, urldate = {2023-09-19} } Operation Rusty Flag – A Malicious Campaign Against Azerbaijanian Targets
Unidentified 110 (RustyFlag)
2023-09-12MicrosoftMicrosoft Threat Intelligence
@online{intelligence:20230912:malware:3a31afc, author = {Microsoft Threat Intelligence}, title = {{Malware distributor Storm-0324 facilitates ransomware access}}, date = {2023-09-12}, organization = {Microsoft}, url = {https://www.microsoft.com/en-us/security/blog/2023/09/12/malware-distributor-storm-0324-facilitates-ransomware-access/}, language = {English}, urldate = {2023-09-13} } Malware distributor Storm-0324 facilitates ransomware access
JSSLoader
2023-09-12Security IntelligenceOle Villadsen, Golo Mühr, Kat Metrick
@online{villadsen:20230912:email:21d359c, author = {Ole Villadsen and Golo Mühr and Kat Metrick}, title = {{Email campaigns leverage updated DBatLoader to deliver RATs, stealers}}, date = {2023-09-12}, organization = {Security Intelligence}, url = {https://securityintelligence.com/posts/email-campaigns-leverage-updated-dbatloader-deliver-rats-stealers/}, language = {English}, urldate = {2023-09-25} } Email campaigns leverage updated DBatLoader to deliver RATs, stealers
DBatLoader
2023-09-12ZscalerSudeep Singh
@online{singh:20230912:peek:6769a87, author = {Sudeep Singh}, title = {{A peek into APT36’s updated arsenal}}, date = {2023-09-12}, organization = {Zscaler}, url = {https://www.zscaler.com/blogs/security-research/peek-apt36-s-updated-arsenal}, language = {English}, urldate = {2023-09-18} } A peek into APT36’s updated arsenal
ElizaRAT
2023-09-11SymantecSymantec Threat Intelligence
@online{intelligence:20230911:about:e53f947, author = {Symantec Threat Intelligence}, title = {{Tweet about Symantec discovering a new variant of SiestaGraph}}, date = {2023-09-11}, organization = {Symantec}, url = {https://x.com/threatintel/status/1701259256199090217}, language = {English}, urldate = {2023-09-18} } Tweet about Symantec discovering a new variant of SiestaGraph
SiestaGraph
2023-09-08Gi7w0rm
@online{gi7w0rm:20230908:uncovering:e0089d9, author = {Gi7w0rm}, title = {{Uncovering DDGroup — A long-time threat actor}}, date = {2023-09-08}, url = {https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4}, language = {English}, urldate = {2023-09-08} } Uncovering DDGroup — A long-time threat actor
AsyncRAT Ave Maria BitRAT DBatLoader NetWire RC Quasar RAT XWorm
2023-09-08K7 SecuritySudeep Waingankar
@online{waingankar:20230908:romcom:2c93c76, author = {Sudeep Waingankar}, title = {{RomCom RAT: Not Your Typical Love Story}}, date = {2023-09-08}, organization = {K7 Security}, url = {https://labs.k7computing.com/index.php/romcom-rat-not-your-typical-love-story/}, language = {English}, urldate = {2023-09-13} } RomCom RAT: Not Your Typical Love Story
ROMCOM RAT
2023-09-07CISACISA
@techreport{cisa:20230907:multiple:e867413, author = {CISA}, title = {{Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475}}, date = {2023-09-07}, institution = {CISA}, url = {https://www.cisa.gov/sites/default/files/2023-09/aa23-250a-apt-actors-exploit-cve-2022-47966-and-cve-2022-42475.pdf}, language = {English}, urldate = {2023-09-11} } Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475
Meterpreter MimiKatz