Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2021-01-20 ⋅ Team Cymru ⋅ Andy Kraus
MoqHao Part 1: Identifying Phishing Infrastructure
MoqHao
2021-01-20 ⋅ Twitter (@malwrhunterteam) ⋅ MalwareHunterTeam
Tweet on Vovalex ransomware
Vovalex
2021-01-20 ⋅ Trend Micro ⋅ Abraham Camba, Gilbert Sison, Ryan Maglaque
XDR investigation uncovers PlugX, unique technique in APT attack
PlugX
2021-01-20 ⋅ FireEye ⋅ Andrew Davis
Emulation of Kernel Mode Rootkits With Speakeasy
Winnti
2021-01-20 ⋅ Medium walmartglobaltech ⋅ Jason Reaves, Joshua Platt
Anchor and Lazarus together again?
Anchor TrickBot
2021-01-20 ⋅ Microsoft ⋅ Microsoft 365 Defender Research Team, Microsoft Cyber Defense Operations Center (CDOC), Microsoft Threat Intelligence Center (MSTIC)
Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop
Cobalt Strike SUNBURST TEARDROP
2021-01-20 ⋅ JPCERT/CC ⋅ Shusei Tomonaga
Commonly Known Tools Used by Lazarus
Lazarus Group
2021-01-19 ⋅ Twitter (@ConfiantIntel) ⋅ ConfiantIntel
Tweet on WizardUpdate macOS backdoor
Vigram
2021-01-19 ⋅ Medium validhorizon ⋅ Daniel Gordon
Oh, So You Got IOCs? Being a Good CTI Consumer
2021-01-19 ⋅ Palo Alto Networks Unit 42 ⋅ Brad Duncan
Wireshark Tutorial: Examining Emotet Infection Traffic
Emotet GootKit IcedID QakBot TrickBot
2021-01-19 ⋅ HP ⋅ Patrick Schläpfer
Dridex Malicious Document Analysis: Automating the Extraction of Payload URLs
Dridex
2021-01-19 ⋅ Malwarebytes ⋅ Marcin Kleczynski
Malwarebytes targeted by Nation State Actor implicated in SolarWinds breach. Evidence suggests abuse of privileged access to Microsoft Office 365 and Azure environments
2021-01-19 ⋅ Github (fireeye) ⋅ FireEye
Mandiant Azure AD Investigator: Focusing on UNC2452 TTPs
SUNBURST
2021-01-19 ⋅ ⋅ Twitter (@jpcert_ac) ⋅ JPCERT/CC
Tweet on LODEINFO ver 0.47 spotted ITW targeting Japan
LODEINFO
2021-01-19 ⋅ Mandiant ⋅ Douglas Bienstock, Matthew McWhirt, Mike Burns, Nick Bennett
Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452 (WHITE PAPER)
2021-01-19 ⋅ FireEye ⋅ Douglas Bienstock, Matthew McWhirt, Mike Burns, Nick Bennett
Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452
2021-01-19 ⋅ Checkpoint ⋅ Omer Ventura, Ori Hamama
FreakOut – Leveraging Newest Vulnerabilities for creating a Botnet
N3Cr0m0rPh
2021-01-19 ⋅ Trend Micro ⋅ Fernando Mercês, Stephen Hilt
VPNFilter Two Years Later: Routers Still Compromised
VPNFilter
2021-01-19 ⋅ Medium elis531989 ⋅ Eli Salem
Funtastic Packers And Where To Find Them
Get2 IcedID QakBot
2021-01-19 ⋅ ⋅ JPCERT/CC ⋅ Shusei Tomonaga
Tools used within the network invaded by attack group Lazarus