Click here to download all references as Bib-File.•
| 2025-10-01
⋅
SpyCloud
⋅
Bifrost Burned: Dissecting Asgard Protector’s Defenses Lumma Stealer |
| 2025-07-31
⋅
Twitter (@JAMESWT_WT)
⋅
Tweet about BQTlock BQTlock |
| 2025-06-17
⋅
DARKReading
⋅
Operation Endgame: Do Takedowns and Arrests Matter? BumbleBee Emotet Pikabot SmokeLoader TrickBot |
| 2025-04-05
⋅
The Record
⋅
Maryland pharmacist used keyloggers to spy on coworkers for a decade, victim alleges |
| 2025-03-25
⋅
SpyCloud
⋅
On the Hunt for Ghost(Socks) GhostSocks |
| 2024-12-19
⋅
SpyCloud
⋅
LummaC2 Revisited: What’s Making this Stealer Stealthier and More Lethal GhostSocks Lumma Stealer |
| 2024-09-06
⋅
SpyCloud
⋅
The Curious Case of an Open Source Stealer: Phemedrone Phemedrone Stealer |
| 2024-08-28
⋅
Talos Intelligence
⋅
BlackByte blends tried-and-true tradecraft with newly disclosed vulnerabilities to support ongoing attacks BlackByte |
| 2024-06-03
⋅
SpyCloud
⋅
Reversing Atomic macOS Stealer: Binaries, Backdoors & Browser Theft AMOS |
| 2024-03-29
⋅
Github (thesamsam)
⋅
Gist with XZ Backdoor analysis xzbot |
| 2024-02-27
⋅
Cisco Talos
⋅
TimbreStealer campaign targets Mexican users with financial lures TimbreStealer |
| 2023-11-21
⋅
Reliaquest
⋅
Scattered Spider Attack Analysis |
| 2023-10-13
⋅
Twitter (@JAMESWT_MHT)
⋅
Tweets on Wikiloader delivering ISFB ISFB WikiLoader |
| 2023-07-21
⋅
Mandiant
⋅
Exploitation of Citrix Zero-Day by Possible Espionage Actors (CVE-2023-3519) |
| 2023-03-20
⋅
Mandiant
⋅
Move, Patch, Get Out the Way: 2022 Zero-Day Exploitation Continues at an Elevated Pace |
| 2022-12-22
⋅
Fortinet
⋅
Ransomware Roundup – Play Ransomware PLAY |
| 2022-11-10
⋅
Fortinet
⋅
Ransomware Roundup: New Inlock and Xorist Variants Inlock Xorist |
| 2022-10-13
⋅
Fortinet
⋅
Ransomware Roundup: Royal Ransomware Royal Ransom |
| 2022-09-14
⋅
Mandiant
⋅
It's Time to PuTTY! DPRK Job Opportunity Phishing via WhatsApp BLINDINGCAN miniBlindingCan sRDI |
| 2022-08-29
⋅
Securonix
⋅
Securonix Threat Labs Security Advisory: New Golang Attack Campaign GO#WEBBFUSCATOR Leverages Office Macros and James Webb Images to Infect Systems |