Click here to download all references as Bib-File.

Enter keywords to filter the library entries below or Propose new Entry
2022-07-18Palo Alto Networks Unit 42Unit 42
@online{42:20220718:nascent:4d2484b, author = {Unit 42}, title = {{Nascent Ursa}}, date = {2022-07-18}, organization = {Palo Alto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/atoms/nascentursa/}, language = {English}, urldate = {2022-07-25} } Nascent Ursa
Saint Bot SaintBear
2022-07-18Palo Alto Networks Unit 42Unit 42
@online{42:20220718:ruinous:c0bf32d, author = {Unit 42}, title = {{Ruinous Ursa}}, date = {2022-07-18}, organization = {Palo Alto Networks Unit 42}, url = {https://unit42.paloaltonetworks.com/atoms/ruinousursa/}, language = {English}, urldate = {2022-07-25} } Ruinous Ursa
WhisperGate DEV-0586
2022-06-17ZscalerSudeep Singh, Kaivalya Khursale
@online{singh:20220617:resurgence:736636f, author = {Sudeep Singh and Kaivalya Khursale}, title = {{Resurgence of Voicemail-themed phishing attacks targeting key industry verticals in the US}}, date = {2022-06-17}, organization = {Zscaler}, url = {https://www.zscaler.com/blogs/security-research/resurgence-voicemail-themed-phishing-attacks-targeting-key-industry}, language = {English}, urldate = {2022-07-01} } Resurgence of Voicemail-themed phishing attacks targeting key industry verticals in the US
2022-06-15AttackIQJackson Wells, AttackIQ Adversary Research Team
@online{wells:20220615:attack:aa9fcfb, author = {Jackson Wells and AttackIQ Adversary Research Team}, title = {{Attack Graph Emulating the Conti Ransomware Team’s Behaviors}}, date = {2022-06-15}, organization = {AttackIQ}, url = {https://attackiq.com/2022/06/15/attack-graph-emulating-the-conti-ransomware-teams-behaviors/}, language = {English}, urldate = {2022-07-01} } Attack Graph Emulating the Conti Ransomware Team’s Behaviors
BazarBackdoor Conti TrickBot
2022-06-03AttackIQJackson Wells, AttackIQ Adversary Research Team
@online{wells:20220603:attack:5e4e9c6, author = {Jackson Wells and AttackIQ Adversary Research Team}, title = {{Attack Graph Response to US CERT AA22-152A: Karakurt Data Extortion Group}}, date = {2022-06-03}, organization = {AttackIQ}, url = {https://attackiq.com/2022/06/03/attack-graph-response-to-us-cert-aa22-152a-karakurt-data-extortion-group/}, language = {English}, urldate = {2022-06-18} } Attack Graph Response to US CERT AA22-152A: Karakurt Data Extortion Group
Cobalt Strike MimiKatz
2022-04-11Cluster25APT + Intelligence
@online{intelligence:20220411:dprknexus:48d0d85, author = {APT + Intelligence}, title = {{DPRK-Nexus Adversary Targets South-Korean Individuals In A New Chapter of Kitty Phishing Operation}}, date = {2022-04-11}, organization = {Cluster25}, url = {https://cluster25.io/2022/04/11/dprk-nexus-adversary-new-kitty-phishing/}, language = {English}, urldate = {2022-05-04} } DPRK-Nexus Adversary Targets South-Korean Individuals In A New Chapter of Kitty Phishing Operation
2022-04-04MandiantBryce Abdo, Zander Work, Ioana Teaca, Brendan McKeague
@online{abdo:20220404:fin7:305d62b, author = {Bryce Abdo and Zander Work and Ioana Teaca and Brendan McKeague}, title = {{FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7}}, date = {2022-04-04}, organization = {Mandiant}, url = {https://www.mandiant.com/resources/evolution-of-fin7}, language = {English}, urldate = {2022-06-27} } FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7
Griffon BABYMETAL Carbanak Cobalt Strike JSSLoader Termite
2022-04META
@techreport{meta:202204:adversarial:92d4268, author = {META}, title = {{Adversarial Threat Report}}, date = {2022-04}, institution = {}, url = {https://about.fb.com/wp-content/uploads/2022/04/Meta-Quarterly-Adversarial-Threat-Report_Q1-2022.pdf}, language = {English}, urldate = {2022-04-12} } Adversarial Threat Report
2022-03-30ZscalerMitesh Wani, Kaivalya Khursale
@online{wani:20220330:analysis:d8f8261, author = {Mitesh Wani and Kaivalya Khursale}, title = {{Analysis of BlackGuard - a new info stealer malware being sold in a Russian hacking forum}}, date = {2022-03-30}, organization = {Zscaler}, url = {https://www.zscaler.com/blogs/security-research/analysis-blackguard-new-info-stealer-malware-being-sold-russian-hacking}, language = {English}, urldate = {2022-03-31} } Analysis of BlackGuard - a new info stealer malware being sold in a Russian hacking forum
BlackGuard
2022-03-28InsomniHack 2022Georges-Bastien Michel
@techreport{michel:20220328:forging:9860016, author = {Georges-Bastien Michel}, title = {{Forging golden hammer against Android software protection tools - A deep dive inside anti-reverse & universal bypass with Frida}}, date = {2022-03-28}, institution = {InsomniHack 2022}, url = {https://raw.githubusercontent.com/FrenchYeti/unrasp/main/Slides/Forging_golden_hammer_against_android_app_protections_INSO22_FINAL.pdf}, language = {English}, urldate = {2022-09-20} } Forging golden hammer against Android software protection tools - A deep dive inside anti-reverse & universal bypass with Frida
2022-03-28IntezerJoakim Kennedy, Ryan Robinson
@online{kennedy:20220328:new:cede4da, author = {Joakim Kennedy and Ryan Robinson}, title = {{New Conversation Hijacking Campaign Delivering IcedID}}, date = {2022-03-28}, organization = {Intezer}, url = {https://www.intezer.com/blog/research/conversation-hijacking-campaign-delivering-icedid/}, language = {English}, urldate = {2022-04-05} } New Conversation Hijacking Campaign Delivering IcedID
IcedID PhotoLoader
2022-03-12Arash's BlogArash Parsa
@online{parsa:20220312:analyzing:5b0c5f2, author = {Arash Parsa}, title = {{Analyzing Malware with Hooks, Stomps, and Return-addresses}}, date = {2022-03-12}, organization = {Arash's Blog}, url = {https://www.arashparsa.com/catching-a-malware-with-no-name/}, language = {English}, urldate = {2022-03-28} } Analyzing Malware with Hooks, Stomps, and Return-addresses
Cobalt Strike
2022-01-31CyberScoopAJ Vicens
@online{vicens:20220131:conversation:464d1e3, author = {AJ Vicens}, title = {{Conversation with a top Ukrainian cyber official: What we know, what we don't, what it means}}, date = {2022-01-31}, organization = {CyberScoop}, url = {https://www.cyberscoop.com/ukrainian-cyber-attacks-russia-conflict-q-and-a/}, language = {English}, urldate = {2022-02-02} } Conversation with a top Ukrainian cyber official: What we know, what we don't, what it means
Saint Bot
2022-01-31CyberArkArash Parsa
@online{parsa:20220131:analyzing:c496cc6, author = {Arash Parsa}, title = {{Analyzing Malware with Hooks, Stomps and Return-addresses}}, date = {2022-01-31}, organization = {CyberArk}, url = {https://www.cyberark.com/resources/threat-research/analyzing-malware-with-hooks-stomps-and-return-addresses-2}, language = {English}, urldate = {2022-05-09} } Analyzing Malware with Hooks, Stomps and Return-addresses
Cobalt Strike
2022-01-27SCYTHENathali Cano, Jorge Orchilles, Christopher Peacock
@online{cano:20220127:adversary:244a480, author = {Nathali Cano and Jorge Orchilles and Christopher Peacock}, title = {{Adversary Emulation Diavol Ransomware #ThreatThursday}}, date = {2022-01-27}, organization = {SCYTHE}, url = {https://www.scythe.io/library/adversary-emulation-diavol-ransomware-threatthursday}, language = {English}, urldate = {2022-02-01} } Adversary Emulation Diavol Ransomware #ThreatThursday
Diavol
2022-01-18Recorded FutureInsikt Group®
@techreport{group:20220118:2021:9cff6fc, author = {Insikt Group®}, title = {{2021 Adversary Infrastructure Report}}, date = {2022-01-18}, institution = {Recorded Future}, url = {https://go.recordedfuture.com/hubfs/reports/cta-2022-0118.pdf}, language = {English}, urldate = {2022-01-24} } 2021 Adversary Infrastructure Report
BazarBackdoor Cobalt Strike Dridex IcedID QakBot TrickBot
2021-12-03vmwareVMWare
@online{vmware:20211203:tigerrat:3388e2c, author = {VMWare}, title = {{TigerRAT – Advanced Adversaries on the Prowl}}, date = {2021-12-03}, organization = {vmware}, url = {https://blogs.vmware.com/security/2021/12/tigerrat-advanced-adversaries-on-the-prowl.html}, language = {English}, urldate = {2021-12-06} } TigerRAT – Advanced Adversaries on the Prowl
Tiger RAT
2021-10-08Virus BulletinSeongsu Park
@techreport{park:20211008:multiuniverse:87fc078, author = {Seongsu Park}, title = {{Multi-universe of adversary: multiple campaigns of the Lazarus group and their connections}}, date = {2021-10-08}, institution = {Virus Bulletin}, url = {https://vblocalhost.com/uploads/VB2021-Park.pdf}, language = {English}, urldate = {2023-07-24} } Multi-universe of adversary: multiple campaigns of the Lazarus group and their connections
Dacls AppleJeus AppleJeus Bankshot BookCodes RAT Dacls DRATzarus LCPDot LPEClient
2021-09-22SecureworksCounter Threat Unit ResearchTeam
@online{researchteam:20210922:revil:5b97baf, author = {Counter Threat Unit ResearchTeam}, title = {{REvil Ransomware Reemerges After Shutdown; Universal Decryptor Released}}, date = {2021-09-22}, organization = {Secureworks}, url = {https://www.secureworks.com/blog/revil-ransomware-reemerges-after-shutdown-universal-decryptor-released}, language = {English}, urldate = {2021-09-28} } REvil Ransomware Reemerges After Shutdown; Universal Decryptor Released
REvil REvil
2021-09-17CrowdStrikeFalcon OverWatch Team
@online{team:20210917:falcon:76aa03b, author = {Falcon OverWatch Team}, title = {{Falcon OverWatch Hunts Down Adversaries Where They Hide}}, date = {2021-09-17}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/four-popular-defensive-evasion-techniques-in-2021/}, language = {English}, urldate = {2021-10-05} } Falcon OverWatch Hunts Down Adversaries Where They Hide
BazarBackdoor Cobalt Strike