Click here to download all references as Bib-File.

Enter keywords to filter the library entries below or Propose new Entry
2022-07-18SecurityScorecardVlad Pasca
@online{pasca:20220718:deep:86577a8, author = {Vlad Pasca}, title = {{A Deep Dive Into ALPHV/BlackCat Ransomware}}, date = {2022-07-18}, organization = {SecurityScorecard}, url = {https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware}, language = {English}, urldate = {2022-07-19} } A Deep Dive Into ALPHV/BlackCat Ransomware
BlackCat
2022-07-17ResecurityResecurity
@online{resecurity:20220717:shortcutbased:6cd77fb, author = {Resecurity}, title = {{Shortcut-Based (LNK) Attacks Delivering Malicious Code On The Rise}}, date = {2022-07-17}, organization = {Resecurity}, url = {https://resecurity.com/blog/article/shortcut-based-lnk-attacks-delivering-malicious-code-on-the-rise}, language = {English}, urldate = {2022-07-28} } Shortcut-Based (LNK) Attacks Delivering Malicious Code On The Rise
AsyncRAT BumbleBee Emotet IcedID QakBot
2022-07-14MicrosoftMicrosoft Threat Intelligence Center (MSTIC), Microsoft Digital Security Unit (DSU)
@online{mstic:20220714:north:876e680, author = {Microsoft Threat Intelligence Center (MSTIC) and Microsoft Digital Security Unit (DSU)}, title = {{North Korean threat actor (H0lyGh0st /DEV-0530) targets small and midsize businesses with H0lyGh0st ransomware}}, date = {2022-07-14}, organization = {Microsoft}, url = {https://www.microsoft.com/security/blog/2022/07/14/north-korean-threat-actor-targets-small-and-midsize-businesses-with-h0lygh0st-ransomware/}, language = {English}, urldate = {2022-07-15} } North Korean threat actor (H0lyGh0st /DEV-0530) targets small and midsize businesses with H0lyGh0st ransomware
SiennaBlue SiennaPurple
2022-07-14Cert-UACert-UA
@online{certua:20220714:uac0100:6e00cea, author = {Cert-UA}, title = {{UAC-0100 - Online fraud using the subject of "monetary compensation" (CERT-UA#4964)}}, date = {2022-07-14}, organization = {Cert-UA}, url = {https://cert.gov.ua/article/761668}, language = {Ukrainian}, urldate = {2022-07-25} } UAC-0100 - Online fraud using the subject of "monetary compensation" (CERT-UA#4964)
2022-07-14DragosSam Hanson
@online{hanson:20220714:trojan:831b636, author = {Sam Hanson}, title = {{The Trojan Horse Malware & Password “Cracking” Ecosystem Targeting Industrial Operators}}, date = {2022-07-14}, organization = {Dragos}, url = {https://www.dragos.com/blog/the-trojan-horse-malware-password-cracking-ecosystem-targeting-industrial-operators/}, language = {English}, urldate = {2022-07-18} } The Trojan Horse Malware & Password “Cracking” Ecosystem Targeting Industrial Operators
Sality
2022-07-14SophosAndrew Brandt, Sergio Bestulic, Harinder Bhathal, Andy French, Bill Kearney, Lee Kirkpatrick, Elida Leite, Peter Mackenzie, Robert Weiland
@online{brandt:20220714:blackcat:745470a, author = {Andrew Brandt and Sergio Bestulic and Harinder Bhathal and Andy French and Bill Kearney and Lee Kirkpatrick and Elida Leite and Peter Mackenzie and Robert Weiland}, title = {{BlackCat ransomware attacks not merely a byproduct of bad luck}}, date = {2022-07-14}, organization = {Sophos}, url = {https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/}, language = {English}, urldate = {2022-07-25} } BlackCat ransomware attacks not merely a byproduct of bad luck
BlackCat BlackCat
2022-07-14BlackberryThe BlackBerry Research & Intelligence Team
@online{team:20220714:gootloader:5b31240, author = {The BlackBerry Research & Intelligence Team}, title = {{GootLoader, From SEO Poisoning to Multi-Stage Downloader}}, date = {2022-07-14}, organization = {Blackberry}, url = {https://blogs.blackberry.com/en/2022/07/gootloader-from-seo-poisoning-to-multi-stage-downloader}, language = {English}, urldate = {2022-07-18} } GootLoader, From SEO Poisoning to Multi-Stage Downloader
GootLoader
2022-07-14ProofpointCrista Giering, Joshua Miller, Michael Raggi, Proofpoint Threat Research Team
@online{giering:20220714:above:06891ca, author = {Crista Giering and Joshua Miller and Michael Raggi and Proofpoint Threat Research Team}, title = {{Above the Fold and in Your Inbox: Tracing State-Aligned Activity Targeting Journalists, Media}}, date = {2022-07-14}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/blog/threat-insight/above-fold-and-your-inbox-tracing-state-aligned-activity-targeting-journalists}, language = {English}, urldate = {2022-07-15} } Above the Fold and in Your Inbox: Tracing State-Aligned Activity Targeting Journalists, Media
Chinoxy
2022-07-14CloudflareOmer Yoachimik
@online{yoachimik:20220714:mantis:a759692, author = {Omer Yoachimik}, title = {{Mantis - the most powerful botnet to date}}, date = {2022-07-14}, organization = {Cloudflare}, url = {https://blog.cloudflare.com/mantis-botnet/}, language = {English}, urldate = {2022-07-15} } Mantis - the most powerful botnet to date
2022-07-13TrellixSushant Kumar Arya, Mohsin Dalla
@online{arya:20220713:targeted:82e3d8c, author = {Sushant Kumar Arya and Mohsin Dalla}, title = {{Targeted Attack on Government Agencies}}, date = {2022-07-13}, organization = {Trellix}, url = {https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/targeted-attack-on-government-agencies.html}, language = {English}, urldate = {2022-07-14} } Targeted Attack on Government Agencies
AsyncRAT LimeRAT
2022-07-13NCC GroupRIFT: Research and Intelligence Fusion Team
@online{team:20220713:climbing:eea784b, author = {RIFT: Research and Intelligence Fusion Team}, title = {{Climbing Mount Everest: Black-Byte Bytes Back?}}, date = {2022-07-13}, organization = {NCC Group}, url = {https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/}, language = {English}, urldate = {2022-07-15} } Climbing Mount Everest: Black-Byte Bytes Back?
BlackByte
2022-07-13Malwarebytes LabsRoberto Santos, Hossein Jazi
@online{santos:20220713:cobalt:5d47ba1, author = {Roberto Santos and Hossein Jazi}, title = {{Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign}}, date = {2022-07-13}, organization = {Malwarebytes Labs}, url = {https://blog.malwarebytes.com/threat-intelligence/2022/07/cobalt-strikes-again-uac-0056-continues-to-target-ukraine-in-its-latest-campaign/}, language = {English}, urldate = {2022-07-14} } Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign
Cobalt Strike
2022-07-13Check PointCheck Point Research
@online{research:20220713:hit:79199ac, author = {Check Point Research}, title = {{A Hit is made: Suspected India-based Sidewinder APT successfully cyber attacks Pakistan military focused targets}}, date = {2022-07-13}, organization = {Check Point}, url = {https://blog.checkpoint.com/2022/07/13/a-hit-is-made-suspected-india-based-sidewinder-apt-successfully-cyber-attacks-pakistan-military-focused-targets/}, language = {English}, urldate = {2022-07-15} } A Hit is made: Suspected India-based Sidewinder APT successfully cyber attacks Pakistan military focused targets
Unidentified 093 (Sidewinder)
2022-07-12ZscalerTarun Dewan, Aditya Sharma
@online{dewan:20220712:rise:1cc657e, author = {Tarun Dewan and Aditya Sharma}, title = {{Rise in Qakbot attacks traced to evolving threat techniques}}, date = {2022-07-12}, organization = {Zscaler}, url = {https://www.zscaler.com/blogs/security-research/rise-qakbot-attacks-traced-evolving-threat-techniques}, language = {English}, urldate = {2022-07-14} } Rise in Qakbot attacks traced to evolving threat techniques
QakBot
2022-07-12Artik BlueArtik Blue
@online{blue:20220712:malware:744a58a, author = {Artik Blue}, title = {{Malware analysis with IDA/Radare2 - Multiple unpacking (Ramnit worm)}}, date = {2022-07-12}, organization = {Artik Blue}, url = {https://artik.blue/malware4}, language = {English}, urldate = {2022-07-15} } Malware analysis with IDA/Radare2 - Multiple unpacking (Ramnit worm)
Ramnit
2022-07-12Team CymruKyle Krejci
@online{krejci:20220712:analysis:de83dd7, author = {Kyle Krejci}, title = {{An Analysis of Infrastructure linked to the Hagga Threat Actor}}, date = {2022-07-12}, organization = {Team Cymru}, url = {https://team-cymru.com/blog/2022/07/12/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor}, language = {English}, urldate = {2022-07-15} } An Analysis of Infrastructure linked to the Hagga Threat Actor
Agent Tesla
2022-07-12MicrosoftMicrosoft Threat Intelligence Center (MSTIC), Microsoft 365 Defender Research Team
@online{mstic:20220712:from:3d3a8e3, author = {Microsoft Threat Intelligence Center (MSTIC) and Microsoft 365 Defender Research Team}, title = {{From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud}}, date = {2022-07-12}, organization = {Microsoft}, url = {https://www.microsoft.com/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/}, language = {English}, urldate = {2022-07-15} } From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud
2022-07-11Soc InvestigationBalaGanesh
@online{balaganesh:20220711:threat:3847e38, author = {BalaGanesh}, title = {{Threat Actors Delivers New Rozena backdoor with Follina Bug – Detection & Response}}, date = {2022-07-11}, organization = {Soc Investigation}, url = {https://www.socinvestigation.com/threat-actors-delivers-new-rozena-backdoor-with-follina-bug-detection-response/}, language = {English}, urldate = {2022-07-12} } Threat Actors Delivers New Rozena backdoor with Follina Bug – Detection & Response
Rozena
2022-07-11BBCJoe Tidy
@online{tidy:20220711:predatory:441dbbc, author = {Joe Tidy}, title = {{Predatory Sparrow: Who are the hackers who say they started a fire in Iran?}}, date = {2022-07-11}, organization = {BBC}, url = {https://www.bbc.com/news/technology-62072480}, language = {English}, urldate = {2022-07-13} } Predatory Sparrow: Who are the hackers who say they started a fire in Iran?
Predatory Sparrow
2022-07-11Cert-UACert-UA
@online{certua:20220711:uac0056:f690298, author = {Cert-UA}, title = {{UAC-0056 attack on Ukrainian state organizations using Cobalt Strike Beacon (CERT-UA#4941)}}, date = {2022-07-11}, organization = {Cert-UA}, url = {https://cert.gov.ua/article/703548}, language = {Ukrainian}, urldate = {2022-07-15} } UAC-0056 attack on Ukrainian state organizations using Cobalt Strike Beacon (CERT-UA#4941)
Cobalt Strike