Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2021-12-02 ⋅ Red Canary ⋅ Tony Lambert
KMSPico and Cryptbot: A spicy combo
CryptBot
2021-11-30 ⋅ Red Canary ⋅ Harrison van Riper
ProxyShell exploitation leads to BlackByte ransomware
BlackByte
2021-11-18 ⋅ Red Canary ⋅ The Red Canary Team
Intelligence Insights: November 2021
Andromeda Conti LockBit QakBot Squirrelwaffle
2021-09-22 ⋅ Red Canary ⋅ The Red Canary Team
Intelligence Insights: September 2021
2021-08-05 ⋅ Red Canary ⋅ Brian Donohue, Dan Cotton, Tony Lambert
When Dridex and Cobalt Strike give you Grief
Cobalt Strike DoppelDridex DoppelPaymer
2021-05-04 ⋅ Red Canary ⋅ Aaron Didier, Justin Schoenfeld
Transferring leverage in a ransomware attack
2021-03-31 ⋅ Red Canary ⋅ Red Canary
2021 Threat Detection Report
Shlayer Andromeda Cobalt Strike Dridex Emotet IcedID MimiKatz QakBot TrickBot
2021-03-09 ⋅ Red Canary ⋅ Brian Donohue, Katie Nickels, Tony Lambert
Microsoft Exchange server exploitation: how to detect, mitigate, and stay calm
CHINACHOPPER
2021-02-18 ⋅ Red Canary ⋅ Tony Lambert
Clipping Silver Sparrow’s wings: Outing macOS malware before it takes flight
Silver Sparrow
2021-01-06 ⋅ Red Canary ⋅ Tony Lambert
Hunting for GetSystem in offensive security tools
Cobalt Strike Empire Downloader Meterpreter PoshC2
2020-12-08 ⋅ Red Canary ⋅ Matt Graeber
The why, what, and how of threat research
2020-12-04 ⋅ Red Canary ⋅ Red Canary
Yellow Cockatoo: Search engine redirects, in-memory remote access trojan, and more
Yellow Cockatoo RAT
2020-12-02 ⋅ Red Canary ⋅ twitter (@redcanary)
Tweet on increased #Qbot activity delivering Cobalt Strike & #Egregor ransomware
Cobalt Strike Egregor QakBot
2020-10-29 ⋅ Red Canary ⋅ The Red Canary Team
A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak
Cobalt Strike Ryuk TrickBot
2020-07-22 ⋅ Red Canary ⋅ Tony Lambert
Connecting Kinsing malware to Citrix and SaltStack campaigns
Kinsing
2020-06-17 ⋅ Youtube (Red Canary) ⋅ Red Canary
Threat Detection: Blue Mockingbird
2020-06-17 ⋅ Youtube (Red Canary) ⋅ Adam Pennington, David Kaplan, Erika Noerenberg, Matt Graeber
ATT&CK® Deep Dive: Process Injection
ISFB Ramnit TrickBot
2020-05-07 ⋅ Red Canary ⋅ Jesse Brown
Detecting COR_PROFILER manipulation for persistence
2020-05-07 ⋅ Red Canary ⋅ Tony Lambert
Introducing Blue Mockingbird
2019-06-27 ⋅ Red Canary ⋅ Casey Smith, Michael Haag
Tracking driver inventory to unearth rootkits
NuggetPhantom
2019-05-01 ⋅ Red Canary ⋅ Tony Lambert
FrameworkPOS and the adequate persistent threat
Grateful POS