Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2022-02-02 ⋅ ZDNet ⋅ Jonathan Greig
BlackCat ransomware implicated in attack on German oil companies
BlackCat BlackCat
2022-02-01 ⋅ Medium walmartglobaltech ⋅ Jason Reaves, Jonathan Mccay, Joshua Platt
Sugar Ransomware, a new RaaS
Sugar
2022-01-27 ⋅ Medium jonahacks ⋅ Jon
Malware Analysis —Manual Unpacking of Redaman
RTM
2022-01-27 ⋅ ANALYST1 ⋅ Jon DiMaggio
A History of Revil
REvil REvil
2021-12-17 ⋅ Trend Micro ⋅ Abraham Camba, Gilbert Sison, Jay Yaneza, Jonna Santos
Staging a Quack: Reverse Analyzing a Fileless QAKBOT Stager
QakBot
2021-12-06 ⋅ Mandiant ⋅ Ashraf Abdalhalim, Ben Read, Doug Bienstock, Gabriella Roncone, Jonathan Leathery, Josh Madeley, Juraj Sucik, Luis Rocha, Luke Jenkins, Manfred Erjak, Marius Fodoreanu, Microsoft Detection and Response Team (DART), Microsoft Threat Intelligence Center (MSTIC), Mitchell Clarke, Parnian Najafi, Sarah Hawley, Wojciech Ledzion
Suspected Russian Activity Targeting Government and Business Entities Around the Globe (UNC2452)
Cobalt Strike CryptBot
2021-12-01 ⋅ ESET Research ⋅ Alexis Dorais-Joncas, Facundo Muñoz
Jumping the air gap: 15 years of nation‑state effort
Agent.BTZ Fanny Flame Gauss PlugX Ramsay Retro Stuxnet USBCulprit USBferry
2021-11-26 ⋅ Twitter (@jhencinski) ⋅ Jon Hencinski
Twitter Thread on weelky MDR recap from expel.io
GootKit Squirrelwaffle
2021-09-23 ⋅ Cloudmark ⋅ Adam McNeil, Andrew Conway, Felipe Naves, W. Stuart Jones
TangleBot: New Advanced SMS Malware Targets Mobile Users Across U.S. and Canada with COVID-19 Lures
2021-08-11 ⋅ ANALYST1 ⋅ Jon DiMaggio
Nation State Ransomware
Ryuk Stealer
2021-06-29 ⋅ Medium MITRE-Engenuity ⋅ Jon Baker, Nicholas Amon
Security Control Mappings: A Starting Point for Threat-Informed Defense
2021-06-17 ⋅ ⋅ Norwegian Police Security Service (PST) ⋅ Dafina Shala
Etterforskningen av datanettverksoperasjonen mot statsforvalterembeter henlegges
APT31
2021-06-01 ⋅ SpecterOps ⋅ Jonathan Johnson
Evadere Classifications
2021-05-27 ⋅ FireEye ⋅ Dan Perez, Emiel Haeghebaert, Greg Wood, Sarah Jones, Stephen Eckels
Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices
UNC2630 UNC2717
2021-05-05 ⋅ zimperium ⋅ Jon Paterson
Flubot vs. Zimperium
FluBot
2021-04-20 ⋅ FireEye ⋅ Dan Perez, Dimiter Andonov, Greg Wood, Jacob Thompson, Jonathan Lepore, Josh Triplett, Joshua Villanueva, Regina Elwell, Sarah Jones, Stephen Eckels, Stroz Friedberg
Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day
2021-04-07 ⋅ ANALYST1 ⋅ Jon DiMaggio
Ransom Mafia - Analysis of the World's First Ransomware Cartel
Conti Egregor LockBit Maze RagnarLocker SunCrypt VIKING SPIDER
2021-04-07 ⋅ ANALYST1 ⋅ Jon DiMaggio
Ransom Mafia Analysis of the World's First Ransomware Cartel
Conti Egregor LockBit Maze RagnarLocker Ryuk SunCrypt TA2101 VIKING SPIDER
2021-03-04 ⋅ FireEye ⋅ Ben Read, Jonathan Leathery, Lindsay Smith
New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452
UNC2452
2021-02-16 ⋅ The Wall Street Journal ⋅ Sara Randazzo, Tawnell D. Hobbs
Hacker Claims to Have Stolen Files Belonging to Prominent Law Firm Jones Day