Click here to download all references as Bib-File.

Enter keywords to filter the library entries below or Propose new Entry
2021-09-10GigamonJoe Slowik
@online{slowik:20210910:rendering:59082b0, author = {Joe Slowik}, title = {{Rendering Threats: A Network Perspective}}, date = {2021-09-10}, organization = {Gigamon}, url = {https://blog.gigamon.com/2021/09/10/rendering-threats-a-network-perspective/}, language = {English}, urldate = {2021-09-12} } Rendering Threats: A Network Perspective
Cobalt Strike
2021-09-09Stranded on Pylos BlogJoe Slowik
@online{slowik:20210909:spectrum:0b31314, author = {Joe Slowik}, title = {{A Spectrum of State Ransomware Responsibility}}, date = {2021-09-09}, organization = {Stranded on Pylos Blog}, url = {https://pylos.co/2021/09/09/a-spectrum-of-state-ransomware-responsibility/}, language = {English}, urldate = {2021-09-28} } A Spectrum of State Ransomware Responsibility
2021-09-01YouTube (Hack In The Box Security Conference)Yi-Jhen Hsieh, Joey Chen
@online{hsieh:20210901:shadowpad:f9ae111, author = {Yi-Jhen Hsieh and Joey Chen}, title = {{SHADOWPAD: Chinese Espionage Malware-as-a-Service}}, date = {2021-09-01}, organization = {YouTube (Hack In The Box Security Conference)}, url = {https://www.youtube.com/watch?v=IRh6R8o1Q7U}, language = {English}, urldate = {2022-08-08} } SHADOWPAD: Chinese Espionage Malware-as-a-Service
PlugX ShadowPad
2021-08-23SentinelOneYi-Jhen Hsieh, Joey Chen
@techreport{hsieh:20210823:shadowpad:58780f1, author = {Yi-Jhen Hsieh and Joey Chen}, title = {{ShadowPad: the Masterpiece of Privately Sold Malware in Chinese Espionage}}, date = {2021-08-23}, institution = {SentinelOne}, url = {https://conference.hitb.org/hitbsecconf2021sin/materials/D1T1%20-%20%20ShadowPad%20-%20A%20Masterpiece%20of%20Privately%20Sold%20Malware%20in%20Chinese%20Espionage%20-%20Yi-Jhen%20Hsieh%20&%20Joey%20Chen.pdf}, language = {English}, urldate = {2022-07-18} } ShadowPad: the Masterpiece of Privately Sold Malware in Chinese Espionage
PlugX ShadowPad
2021-08-19Sentinel LABSYi-Jhen Hsieh, Joey Chen
@online{hsieh:20210819:shadowpad:04bbb1e, author = {Yi-Jhen Hsieh and Joey Chen}, title = {{ShadowPad | A Masterpiece of Privately Sold Malware in Chinese Espionage}}, date = {2021-08-19}, organization = {Sentinel LABS}, url = {https://labs.sentinelone.com/shadowpad-a-masterpiece-of-privately-sold-malware-in-chinese-espionage/}, language = {English}, urldate = {2021-08-23} } ShadowPad | A Masterpiece of Privately Sold Malware in Chinese Espionage
ShadowPad
2021-08-12Edmund Brumaghin, Joe Marshall, Arnaud Zobec
@online{brumaghin:20210812:vice:c55624f, author = {Edmund Brumaghin and Joe Marshall and Arnaud Zobec}, title = {{Vice Society Leverages PrintNightmare In Ransomware Attacks}}, date = {2021-08-12}, url = {https://blog.talosintelligence.com/2021/08/vice-society-ransomware-printnightmare.html}, language = {English}, urldate = {2021-08-15} } Vice Society Leverages PrintNightmare In Ransomware Attacks
2021-08-04Trend MicroRyan Maglaque, Jessie Prevost, Joelson Soares, Janus Agcaoili
@online{maglaque:20210804:supply:1b4bee6, author = {Ryan Maglaque and Jessie Prevost and Joelson Soares and Janus Agcaoili}, title = {{Supply Chain Attacks from a Managed Detection and Response Perspective}}, date = {2021-08-04}, organization = {Trend Micro}, url = {https://www.trendmicro.com/en_us/research/21/h/supply-chain-attacks-from-a-managed-detection-and-response-persp.html}, language = {English}, urldate = {2021-08-31} } Supply Chain Attacks from a Managed Detection and Response Perspective
REvil
2021-07-27GigamonJoe Slowik
@online{slowik:20210727:ghosts:af3dc18, author = {Joe Slowik}, title = {{Ghosts on the Wire: Expanding Conceptions of Network Anomalies}}, date = {2021-07-27}, organization = {Gigamon}, url = {https://blog.gigamon.com/2021/07/27/ghosts-on-the-wire-expanding-conceptions-of-network-anomalies/}, language = {English}, urldate = {2021-08-02} } Ghosts on the Wire: Expanding Conceptions of Network Anomalies
SUNBURST
2021-07-19ProofpointJoe Wise, Konstantin Klinger, Selena Larson, Proofpoint Threat Research Team
@online{wise:20210719:new:cb02a85, author = {Joe Wise and Konstantin Klinger and Selena Larson and Proofpoint Threat Research Team}, title = {{New Threat Actor Uses Spanish Language Lures to Distribute Seldom Observed Bandook Malware}}, date = {2021-07-19}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/blog/threat-insight/new-threat-actor-uses-spanish-language-lures-distribute-seldom-observed-bandook}, language = {English}, urldate = {2021-07-26} } New Threat Actor Uses Spanish Language Lures to Distribute Seldom Observed Bandook Malware
Bandook
2021-07-08GigamonJoe Slowik
@online{slowik:20210708:observations:21f913b, author = {Joe Slowik}, title = {{Observations and Recommendations from the Ongoing REvil-Kaseya Incident}}, date = {2021-07-08}, organization = {Gigamon}, url = {https://blog.gigamon.com/2021/07/08/observations-and-recommendations-from-the-ongoing-revil-kaseya-incident/}, language = {English}, urldate = {2021-07-12} } Observations and Recommendations from the Ongoing REvil-Kaseya Incident
REvil
2021-06-24GigamonJoe Slowik
@techreport{slowik:20210624:baffling:d37b293, author = {Joe Slowik}, title = {{The Baffling Berserk Bear: A Decade's Activity targeting Critical Infrastructure}}, date = {2021-06-24}, institution = {Gigamon}, url = {https://vblocalhost.com/uploads/VB2021-Slowik.pdf}, language = {English}, urldate = {2021-10-26} } The Baffling Berserk Bear: A Decade's Activity targeting Critical Infrastructure
Havex RAT Heriplor Karagany
2021-06-22ProferoProfero, SecurityJoes
@techreport{profero:20210622:secrets:1781171, author = {Profero and SecurityJoes}, title = {{Secrets Behind Ever101 Ransomware}}, date = {2021-06-22}, institution = {Profero}, url = {https://shared-public-reports.s3.eu-west-1.amazonaws.com/Secrets_behind_the_mysterious_ever101_ransomware.pdf}, language = {English}, urldate = {2021-06-23} } Secrets Behind Ever101 Ransomware
Curator
2021-06-17GigamonJoe Slowik
@online{slowik:20210617:hold:dc6ce6d, author = {Joe Slowik}, title = {{Hold the Door: Examining Exfiltration Activity and Applying Countermeasures}}, date = {2021-06-17}, organization = {Gigamon}, url = {https://blog.gigamon.com/2021/06/17/hold-the-door-examining-exfiltration-activity-and-applying-countermeasures}, language = {English}, urldate = {2021-06-22} } Hold the Door: Examining Exfiltration Activity and Applying Countermeasures
2021-06-09Twitter (@SecurityJoes)SecurityJoes
@online{securityjoes:20210609:net:13f2b90, author = {SecurityJoes}, title = {{Tweet on .NET builder of a Ryuk imposter malware}}, date = {2021-06-09}, organization = {Twitter (@SecurityJoes)}, url = {https://twitter.com/SecurityJoes/status/1402603695578157057}, language = {English}, urldate = {2021-06-16} } Tweet on .NET builder of a Ryuk imposter malware
Ryuk
2021-05-17GigamonJoe Slowik
@online{slowik:20210517:tracking:060c759, author = {Joe Slowik}, title = {{Tracking DarkSide and Ransomware: The Network View}}, date = {2021-05-17}, organization = {Gigamon}, url = {https://blog.gigamon.com/2021/05/17/tracking-darkside-and-ransomware-the-network-view/}, language = {English}, urldate = {2021-05-17} } Tracking DarkSide and Ransomware: The Network View
DarkSide DarkSide
2021-05-13Stranded on Pylos BlogJoe Slowik
@online{slowik:20210513:mind:66194c8, author = {Joe Slowik}, title = {{Mind the (Air) Gap}}, date = {2021-05-13}, organization = {Stranded on Pylos Blog}, url = {https://pylos.co/2021/05/13/mind-the-air-gap/}, language = {English}, urldate = {2021-05-17} } Mind the (Air) Gap
DarkSide
2021-05-05ProferoProfero, SecurityJoes
@techreport{profero:20210505:cuba:bc183e8, author = {Profero and SecurityJoes}, title = {{Cuba Ransomware Group on a Roll}}, date = {2021-05-05}, institution = {Profero}, url = {https://shared-public-reports.s3-eu-west-1.amazonaws.com/Cuba+Ransomware+Group+-+on+a+roll.pdf}, language = {English}, urldate = {2021-05-07} } Cuba Ransomware Group on a Roll
Cuba
2021-04-29DomainToolsJoe Slowik
@online{slowik:20210429:leaping:b1c6f2f, author = {Joe Slowik}, title = {{Leaping Down a Rabbit Hole of Fraud and Misdirection}}, date = {2021-04-29}, organization = {DomainTools}, url = {https://www.domaintools.com/resources/blog/leaping-down-a-rabbit-hole-of-fraud-and-misdirection}, language = {English}, urldate = {2021-05-03} } Leaping Down a Rabbit Hole of Fraud and Misdirection
2021-04-22DomainToolsJoe Slowik
@online{slowik:20210422:undersea:b41a1d6, author = {Joe Slowik}, title = {{An Undersea Royal Road: Exploring Malicious Documents and Associated Malware}}, date = {2021-04-22}, organization = {DomainTools}, url = {https://www.domaintools.com/resources/blog/an-undersea-royal-road-exploring-malicious-documents-and-associated-malware}, language = {English}, urldate = {2021-04-28} } An Undersea Royal Road: Exploring Malicious Documents and Associated Malware
2021-04-17YouTube (Worcester DEFCON Group)Joel Snape, Nettitude
@online{snape:20210417:inside:2c3ae5c, author = {Joel Snape and Nettitude}, title = {{Inside IcedID: Anatomy Of An Infostealer}}, date = {2021-04-17}, organization = {YouTube (Worcester DEFCON Group)}, url = {https://www.youtube.com/watch?v=YEqLIR6hfOM}, language = {English}, urldate = {2021-04-20} } Inside IcedID: Anatomy Of An Infostealer
IcedID