Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2019-09-02 ⋅ Volexity ⋅ Andrew Case, Matthew Meltzer, Steven Adair
Digital Crackdown: Large-Scale Surveillance and Exploitation of Uyghurs
scanbox POISON CARP
2019-08-19 ⋅ FireEye ⋅ Alex Pennino, Matt Bromiley
GAME OVER: Detecting and Stopping an APT41 Operation
ACEHASH CHINACHOPPER HIGHNOON
2019-07-18 ⋅ FireEye ⋅ Jessica Rocchio, Matt Bromiley, Nick Schroeder, Noah Klapprodt
Hard Pass: Declining APT34’s Invite to Join Their Professional Network
LONGWATCH PICKPOCKET TONEDEAF VALUEVAULT
2019-07-02 ⋅ Proofpoint ⋅ Dennis Schwarz, Matthew Mesa, Proofpoint Threat Insight Team
TA505 begins summer campaigns with a new pet malware downloader, AndroMut, in the UAE, South Korea, Singapore, and the United States
AndroMut FlawedAmmyy
2019-06-14 ⋅ Certego ⋅ Matteo Lodi
Malware Tales: Sodinokibi
REvil
2019-05-29 ⋅ ESET Research ⋅ Matthieu Faou, Romain Dumont
A dive into Turla PowerShell usage
PowerShellRunner TurlaRPC
2019-05-07 ⋅ ESET Research ⋅ Matthieu Faou
Turla LightNeuron: An email too far
LightNeuron
2019-05-01 ⋅ ESET Research ⋅ Matthieu Faou
TURLA LIGHTNEURON: One email away from remote code execution
LightNeuron
2019-04-30 ⋅ Cisco Talos ⋅ Colin Grady, Jaeson Schultz, Matt Valites, Pierre Cadieux
Sodinokibi ransomware exploits WebLogic Server vulnerability
REvil
2019-04-17 ⋅ Cisco Talos ⋅ Danny Adamitis, David Maynor, Matthew Olney, Paul Rascagnères, Warren Mercer
DNS Hijacking Abuses Trust In Core Internet Service
Sea Turtle
2019-02-20 ⋅ Cisco Talos ⋅ Edmund Brumaghin, Matthew Molyett, Nick Biasini
Combing Through Brushaloader Amid Massive Detection Uptick
BrushaLoader
2019-02-14 ⋅ Certego ⋅ Matteo Lodi
Malware Tales: Gootkit
GootKit
2019-01-25 ⋅ CrowdStrike ⋅ Matt Dahl
Widespread DNS Hijacking Activity Targets Multiple Sectors
DNSpionage
2019-01-17 ⋅ Accenture ⋅ Matthew Brady
Pond Loach delivers BadCake malware
Salgorea APT32
2018-11-23 ⋅ Certego ⋅ Matteo Lodi
Sload hits Italy. Unveil the power of powershell as a downloader
sLoad
2018-11-22 ⋅ nccgroup ⋅ Matt Lewis
Turla PNG Dropper is back
Uroburos Turla
2018-11-19 ⋅ FireEye ⋅ Andrew Thompson, Ben Withnell, Jonathan Leathery, Matthew Dunwoody, Michael Matonis, Nick Carr
Not So Cozy: An Uncomfortable Examination of a Suspected APT29 Phishing Campaign
Cobalt Strike
2018-09-05 ⋅ ESET Research ⋅ Matthieu Faou
PowerPool malware exploits ALPC LPE zero‑day vulnerability
ALPC Local PrivEsc PowerPool
2018-08-30 ⋅ Twitter (@mesa_matt) ⋅ Matthew Mesa
Tweet on PsiX
PsiX
2018-07-26 ⋅ IEEE Symposium on Security and Privacy (SP) ⋅ Alex C. Snoeren, Damon McCoy, Danny Yuxing Huang, Elie Bursztein, Jonathan Levin, Kirill Levchenko, Kylie McRoberts, Luca Invernizzi, Maxwell Matthaios Aliapoulios, Vector Guo Li
Tracking Ransomware End-to-end
Cerber Locky WannaCryptor