Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2025-01-07 ⋅ SANS ISC ⋅ Yee Ching Tok
PacketCrypt Classic Cryptocurrency Miner on PHP Servers
2025-01-03 ⋅ SANS ISC ⋅ Xavier Mertens
SwaetRAT Delivery Through Python
SwaetRAT
2024-02-29 ⋅ SANS ISC ⋅ John Moutos
Dissecting DarkGate: Modular Malware Delivery and Persistence as a Service
DarkGate
2023-11-01 ⋅ SANS ISC ⋅ Xavier Mertens
Malware Dropped Through a ZPAQ Archive
2023-05-30 ⋅ SANS ISC ⋅ Brad Duncan
Malspam pushes ModiLoader (DBatLoader) infection for Remcos RAT
DBatLoader
2023-04-12 ⋅ SANS ISC ⋅ Brad Duncan
Recent IcedID (Bokbot) activity
IcedID
2023-01-18 ⋅ SANS ISC ⋅ Brad Duncan
Malicious Google Ad --> Fake Notepad++ Page --> Aurora Stealer malware
Aurora Stealer
2022-12-18 ⋅ SANS ISC ⋅ Guy Bruneau
Infostealer Malware with Double Extension
Agent Tesla
2022-08-19 ⋅ SANS ISC ⋅ Brad Duncan
Brazil malspam pushes Astaroth (Guildma) malware
Astaroth
2022-08-12 ⋅ SANS ISC ⋅ Brad Duncan
Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike
Cobalt Strike DarkVNC IcedID
2022-07-27 ⋅ SANS ISC ⋅ Brad Duncan
IcedID (Bokbot) with Dark VNC and Cobalt Strike
DarkVNC IcedID
2022-07-07 ⋅ SANS ISC ⋅ Brad Duncan
Emotet infection with Cobalt Strike
Cobalt Strike Emotet
2022-06-17 ⋅ SANS ISC ⋅ Brad Duncan
Malspam pushes Matanbuchus malware, leads to Cobalt Strike
Cobalt Strike Matanbuchus
2022-06-16 ⋅ SANS ISC ⋅ Xavier Mertens
Houdini is Back Delivered Through a JavaScript Dropper
Houdini
2022-06-13 ⋅ SANS ISC ⋅ Renato Marinho
Translating Saitama's DNS tunneling messages
Saitama Backdoor
2022-06-09 ⋅ SANS ISC ⋅ Brad Duncan
TA570 Qakbot (Qbot) tries CVE-2022-30190 (Follina) exploit (ms-msdt)
QakBot TA570
2022-05-20 ⋅ SANS ISC ⋅ Xavier Mertens
A 'Zip Bomb' to Bypass Security Controls & Sandboxes
BitRAT
2022-05-11 ⋅ SANS ISC ⋅ Brad Duncan
TA578 using thread-hijacked emails to push ISO files for Bumblebee malware
BumbleBee
2022-04-25 ⋅ SANS ISC ⋅ Xavier Mertens
Simple PDF Linking to Malicious Content
2022-04-20 ⋅ SANS ISC ⋅ Brad Duncan
'aa' distribution Qakbot (Qbot) infection with DarkVNC traffic
QakBot