Click here to download all references as Bib-File.

Enter keywords to filter the library entries below or Propose new Entry
2021-09-08Arash's BlogArash Parsa
@online{parsa:20210908:hook:4dff1b6, author = {Arash Parsa}, title = {{Hook Heaps and Live Free}}, date = {2021-09-08}, organization = {Arash's Blog}, url = {https://www.arashparsa.com/hook-heaps-and-live-free/}, language = {English}, urldate = {2021-09-10} } Hook Heaps and Live Free
Cobalt Strike
2021-09-01YouTube (Black Hat)Tsuyoshi Taniguchi, Christian Doerr
@online{taniguchi:20210901:how:98ed0d5, author = {Tsuyoshi Taniguchi and Christian Doerr}, title = {{How Did the Adversaries Abusing the Bitcoin Blockchain Evade Our Takeover?}}, date = {2021-09-01}, organization = {YouTube (Black Hat)}, url = {https://www.youtube.com/watch?v=y8Z9KnL8s8s}, language = {English}, urldate = {2021-09-12} } How Did the Adversaries Abusing the Bitcoin Blockchain Evade Our Takeover?
Cerber Pony
2021-08-31Cisco TalosEdmund Brumaghin, Vitor Ventura
@online{brumaghin:20210831:attracting:5d141c1, author = {Edmund Brumaghin and Vitor Ventura}, title = {{Attracting flies with Honey(gain): Adversarial abuse of proxyware}}, date = {2021-08-31}, organization = {Cisco Talos}, url = {https://blog.talosintelligence.com/2021/08/proxyware-abuse.html}, language = {English}, urldate = {2021-09-02} } Attracting flies with Honey(gain): Adversarial abuse of proxyware
2021-08-11BleepingComputerLawrence Abrams
@online{abrams:20210811:kaseyas:93f86e6, author = {Lawrence Abrams}, title = {{Kaseya's universal REvil decryption key leaked on a hacking forum}}, date = {2021-08-11}, organization = {BleepingComputer}, url = {https://www.bleepingcomputer.com/news/security/kaseyas-universal-revil-decryption-key-leaked-on-a-hacking-forum/}, language = {English}, urldate = {2021-08-16} } Kaseya's universal REvil decryption key leaked on a hacking forum
REvil
2021-07-22Bleeping ComputerLawrence Abrams
@online{abrams:20210722:kaseya:7ec0805, author = {Lawrence Abrams}, title = {{Kaseya obtains universal decryptor for REvil ransomware victims}}, date = {2021-07-22}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/kaseya-obtains-universal-decryptor-for-revil-ransomware-victims/}, language = {English}, urldate = {2021-07-26} } Kaseya obtains universal decryptor for REvil ransomware victims
REvil
2021-07-15ReversingLabsRobert Simmons
@online{simmons:20210715:data:8286b8f, author = {Robert Simmons}, title = {{Data Exfiltrator - A New Tactic for Ransomware Adversaries}}, date = {2021-07-15}, organization = {ReversingLabs}, url = {https://blog.reversinglabs.com/blog/data-exfiltrator}, language = {English}, urldate = {2021-07-20} } Data Exfiltrator - A New Tactic for Ransomware Adversaries
DataExfiltrator
2021-07-12ProofpointJoshua Miller, Crista Giering, Threat Research Team
@online{miller:20210712:operation:c819876, author = {Joshua Miller and Crista Giering and Threat Research Team}, title = {{Operation SpoofedScholars: A Conversation with TA453}}, date = {2021-07-12}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/blog/threat-insight/operation-spoofedscholars-conversation-ta453}, language = {English}, urldate = {2021-07-20} } Operation SpoofedScholars: A Conversation with TA453
2021-06-30Advanced IntelligenceYelisey Boguslavskiy, Brandon Rudisel, AdvIntel Security & Development Team
@online{boguslavskiy:20210630:ransomwarecve:deae6a7, author = {Yelisey Boguslavskiy and Brandon Rudisel and AdvIntel Security & Development Team}, title = {{Ransomware-&-CVE: Industry Insights Into Exclusive High-Value Target Adversarial Datasets}}, date = {2021-06-30}, organization = {Advanced Intelligence}, url = {https://www.advanced-intel.com/post/adversarial-perspective-advintel-breach-avoidance-through-monitoring-initial-vulnerabilities}, language = {English}, urldate = {2021-07-01} } Ransomware-&-CVE: Industry Insights Into Exclusive High-Value Target Adversarial Datasets
BlackKingdom Ransomware Clop dearcry Hades REvil
2021-06-29Silverado Policy AcceleratorAnne Neuberger, Dmitri Alperovitch
@online{neuberger:20210629:cyber:dbbba1d, author = {Anne Neuberger and Dmitri Alperovitch}, title = {{Cyber Strategy in the Biden Era: A Conversation with Anne Neuberger}}, date = {2021-06-29}, organization = {Silverado Policy Accelerator}, url = {https://www.youtube.com/watch?v=vm4p1_qDO2M}, language = {English}, urldate = {2021-06-29} } Cyber Strategy in the Biden Era: A Conversation with Anne Neuberger
2021-06-03SecureworksSecureworks Adversary Group, Counter Threat Unit ResearchTeam
@online{group:20210603:oauths:50516b7, author = {Secureworks Adversary Group and Counter Threat Unit ResearchTeam}, title = {{OAuth’s Device Code Flow Abused in Phishing Attacks}}, date = {2021-06-03}, organization = {Secureworks}, url = {https://www.secureworks.com/blog/oauths-device-code-flow-abused-in-phishing-attacks}, language = {English}, urldate = {2021-06-22} } OAuth’s Device Code Flow Abused in Phishing Attacks
2021-05-20WiredAndy Greenberg
@online{greenberg:20210520:full:8e8ec72, author = {Andy Greenberg}, title = {{The Full Story of the Stunning RSA Hack Can Finally Be Told}}, date = {2021-05-20}, organization = {Wired}, url = {https://www.wired.com/story/the-full-story-of-the-stunning-rsa-hack-can-finally-be-told/}, language = {English}, urldate = {2021-05-26} } The Full Story of the Stunning RSA Hack Can Finally Be Told
2021-05-18SophosJohn Shier, Mat Gangwer, Greg Iddon, Peter Mackenzie
@online{shier:20210518:active:f313ac5, author = {John Shier and Mat Gangwer and Greg Iddon and Peter Mackenzie}, title = {{The Active Adversary Playbook 2021}}, date = {2021-05-18}, organization = {Sophos}, url = {https://news.sophos.com/en-us/2021/05/18/the-active-adversary-playbook-2021/?cmp=37153}, language = {English}, urldate = {2021-05-25} } The Active Adversary Playbook 2021
Cobalt Strike MimiKatz
2021-05-06Black HatTsuyoshi Taniguchi, Christian Doerr
@techreport{taniguchi:20210506:how:45b144d, author = {Tsuyoshi Taniguchi and Christian Doerr}, title = {{How Did the Adversaries Abusing Bitcoin Blockchain Evade Our Takeover}}, date = {2021-05-06}, institution = {Black Hat}, url = {https://i.blackhat.com/asia-21/Thursday-Handouts/as21-Taniguchi-How-Did-The-Adversaries-Abusing-The-Bitcoin-Blockchain-Evade-Our-Takeover.pdf}, language = {English}, urldate = {2021-09-12} } How Did the Adversaries Abusing Bitcoin Blockchain Evade Our Takeover
Cerber Pony
2021-04-17Advanced IntelligenceVitali Kremez, Al Calleo, Yelisey Boguslavskiy
@online{kremez:20210417:adversary:197fcfa, author = {Vitali Kremez and Al Calleo and Yelisey Boguslavskiy}, title = {{Adversary Dossier: Ryuk Ransomware Anatomy of an Attack in 2021}}, date = {2021-04-17}, organization = {Advanced Intelligence}, url = {https://www.advanced-intel.com/post/adversary-dossier-ryuk-ransomware-anatomy-of-an-attack-in-2021}, language = {English}, urldate = {2021-04-19} } Adversary Dossier: Ryuk Ransomware Anatomy of an Attack in 2021
Ryuk
2021-02-09Medium (@alex.birsan)Alex Birsan
@online{birsan:20210209:dependency:44eaf05, author = {Alex Birsan}, title = {{Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies}}, date = {2021-02-09}, organization = {Medium (@alex.birsan)}, url = {https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610}, language = {English}, urldate = {2021-02-10} } Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies
2021-01-07Recorded FutureInsikt Group®
@techreport{group:20210107:aversary:9771829, author = {Insikt Group®}, title = {{Aversary Infrastructure Report 2020: A Defender's View}}, date = {2021-01-07}, institution = {Recorded Future}, url = {https://go.recordedfuture.com/hubfs/reports/cta-2021-0107.pdf}, language = {English}, urldate = {2021-01-11} } Aversary Infrastructure Report 2020: A Defender's View
Octopus pupy Cobalt Strike Empire Downloader Meterpreter PoshC2
2020-12-16FortinetFred Gutierrez, Val Saengphaibul
@online{gutierrez:20201216:adversary:3b3781a, author = {Fred Gutierrez and Val Saengphaibul}, title = {{Adversary Playbook: JavaScript RAT Looking for that Government Cheese}}, date = {2020-12-16}, organization = {Fortinet}, url = {https://www.fortinet.com/blog/threat-research/adversary-playbook-javascript-rat-looking-for-that-government-cheese}, language = {English}, urldate = {2021-01-18} } Adversary Playbook: JavaScript RAT Looking for that Government Cheese
JSOutProx
2020-11-11DomainToolsJoe Slowik
@online{slowik:20201111:extrapolating:8998b55, author = {Joe Slowik}, title = {{Extrapolating Adversary Intent Through Infrastructure}}, date = {2020-11-11}, organization = {DomainTools}, url = {https://www.domaintools.com/resources/blog/extrapolating-adversary-intent-through-infrastructure}, language = {English}, urldate = {2020-11-19} } Extrapolating Adversary Intent Through Infrastructure
2020-11-05Github (scythe-io)SCYTHE
@online{scythe:20201105:ryuk:8d7c4de, author = {SCYTHE}, title = {{Ryuk Adversary Emulation Plan}}, date = {2020-11-05}, organization = {Github (scythe-io)}, url = {https://github.com/scythe-io/community-threats/tree/master/Ryuk}, language = {English}, urldate = {2020-11-11} } Ryuk Adversary Emulation Plan
Ryuk
2020-10-27Sophos Managed Threat Response (MTR)Greg Iddon
@online{iddon:20201027:mtr:3b62ca9, author = {Greg Iddon}, title = {{MTR Casebook: An active adversary caught in the act}}, date = {2020-10-27}, organization = {Sophos Managed Threat Response (MTR)}, url = {https://news.sophos.com/en-us/2020/10/27/mtr-casebook-an-active-adversary-caught-in-the-act/}, language = {English}, urldate = {2020-11-02} } MTR Casebook: An active adversary caught in the act
Cobalt Strike