Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2021-11-23 ⋅ Trend Micro ⋅ Ian Kenefick
BazarLoader Adds Compromised Installers, ISO to Arrival and Delivery Vectors
BazarBackdoor
2021-11-18 ⋅ Group-IB ⋅ Ivan Pisarev
The awakening: Group-IB uncovers new corporate espionage attacks by RedCurl
2021-11-18 ⋅ Mandiant ⋅ Chris Sistrunk, Daniel Kapellmann, Glen Chason, Ken Proska
Introducing Mandiant's Digital Forensics and Incident Response Framework for Embedded OT Systems
2021-11-17 ⋅ Group-IB ⋅ Group-IB
RedCurl: The awakening
2021-11-16 ⋅ Intezer ⋅ Alik Koldobsky, Joakim Kennedy
New Type of Supply Chain Attack Could Put Popular Admin Tools at Risk
2021-11-16 ⋅ Blackberry ⋅ Dean Given, Eoin Wickens, Jim Simpson, Marta Janus, T.J. O'Leary, Tom Bonner
Finding Beacons in the dark
Cobalt Strike
2021-11-13 ⋅ Trend Micro ⋅ Ian Kenefick, Vladimir Kropotov
QAKBOT Loader Returns With New Techniques and Tools
QakBot
2021-11-12 ⋅ Trend Micro ⋅ Ian Kenefick, Vladimir Kropotov
The Prelude to Ransomware: A Look into Current QAKBOT Capabilities and Global Activities
QakBot
2021-11-10 ⋅ Group-IB ⋅ Group-IB
REDCURL: The awakening
RedCurl
2021-11-10 ⋅ Cisco Talos ⋅ Asheer Malhotra, Jungsoo An, Kendall McKay
North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets
GoldDragon
2021-10-27 ⋅ Mandiant ⋅ Corey Hildebrandt, Daniel Kapellmann Zafra, Ken Proska, Nathan Brubaker
Portable Executable File Infecting Malware Is Increasingly Found in OT Networks
CCleaner Backdoor Floxif neshta Ramnit Sality Virut
2021-10-22 ⋅ Darkowl ⋅ Darkowl
“Page Not Found”: REvil Darknet Services Offline After Attack Last Weekend
REvil REvil
2021-10-21 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team
Franken-phish: TodayZoo built from other phishing kits
2021-10-07 ⋅ Mandiant ⋅ Adam Brunner, Genevieve Stark, Jennifer Brooks, Jeremy Kennelly, Joshua Shilko, Kimberly Goody, Zach Riddle
FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets
BazarBackdoor GRIMAGENT Ryuk
2021-09-13 ⋅ Intezer ⋅ Avigayil Mechtinger, Joakim Kennedy, Ryan Robinson
Vermilion Strike: Linux and Windows Re-implementation of Cobalt Strike
Vermilion Strike Vermilion Strike
2021-09-03 ⋅ Sophos ⋅ Anand Ajjan, Andrew Ludgate, Gabor Szappanos, Peter Mackenzie, Sean Gallagher, Sergio Bestulic, Syed Zaidi
Conti affiliates use ProxyShell Exchange exploit in ransomware attacks
Cobalt Strike Conti
2021-08-30 ⋅ zero day initiative ⋅ Simon Zuckerbraun
ProxyToken: An Authentication Bypass in Microsoft Exchange Server
2021-08-05 ⋅ Twitter (@AltShiftPrtScn) ⋅ Peter Mackenzie
Tweet on Conti ransomware affiliates using AnyDesk, Atera, Splashtop, Remote Utilities and ScreenConnect to maintain network access
Conti
2021-08-05 ⋅ Twitter (@AltShiftPrtScn) ⋅ Peter Mackenzie
Tweet on Lorenz ransomware tricking user into allowing OAuth permissions to "Thunderbird with ExQuilla" for O365
Lorenz
2021-07-21 ⋅ Twitter (@AltShiftPrtScn) ⋅ Peter Mackenzie
Tweet on Conti ransomware actor installing AnyDesk for remote access in victim environment
Conti