Click here to download all references as Bib-File.

Enter keywords to filter the library entries below or Propose new Entry
2020-11-20DomainToolsJoe Slowik, Black Lotus Labs, Lumen
@online{slowik:20201120:current:f9956c6, author = {Joe Slowik and Black Lotus Labs and Lumen}, title = {{Current Events to Widespread Campaigns: Pivoting from Samples to Identify Activity}}, date = {2020-11-20}, organization = {DomainTools}, url = {https://www.domaintools.com/resources/blog/current-events-to-widespread-campaigns-pivoting-from-samples-to-identify}, language = {English}, urldate = {2020-11-23} } Current Events to Widespread Campaigns: Pivoting from Samples to Identify Activity
2020-11-18DomainToolsJoe Slowik
@online{slowik:20201118:analyzing:abccd43, author = {Joe Slowik}, title = {{Analyzing Network Infrastructure as Composite Objects}}, date = {2020-11-18}, organization = {DomainTools}, url = {https://www.domaintools.com/resources/blog/analyzing-network-infrastructure-as-composite-objects}, language = {English}, urldate = {2020-11-19} } Analyzing Network Infrastructure as Composite Objects
Ryuk
2020-11-11DomainToolsJoe Slowik
@online{slowik:20201111:extrapolating:8998b55, author = {Joe Slowik}, title = {{Extrapolating Adversary Intent Through Infrastructure}}, date = {2020-11-11}, organization = {DomainTools}, url = {https://www.domaintools.com/resources/blog/extrapolating-adversary-intent-through-infrastructure}, language = {English}, urldate = {2020-11-19} } Extrapolating Adversary Intent Through Infrastructure
2020-11-04Stranded on Pylos BlogJoe Slowik
@online{slowik:20201104:enigmatic:c2d7b4e, author = {Joe Slowik}, title = {{The Enigmatic Energetic Bear}}, date = {2020-11-04}, organization = {Stranded on Pylos Blog}, url = {https://pylos.co/2020/11/04/the-enigmatic-energetic-bear/}, language = {English}, urldate = {2020-11-06} } The Enigmatic Energetic Bear
EternalPetya Havex RAT
2020-10-30ReutersRaphael Satter, Christopher Bing, Joel Schectman
@online{satter:20201030:russian:4fdafef, author = {Raphael Satter and Christopher Bing and Joel Schectman}, title = {{Russian hackers targeted California, Indiana Democratic parties}}, date = {2020-10-30}, organization = {Reuters}, url = {https://www.reuters.com/article/us-usa-election-cyber-russia-exclusive-idUSKBN27F1CP}, language = {English}, urldate = {2020-11-02} } Russian hackers targeted California, Indiana Democratic parties
2020-09-24MicrosoftBen Koehl, Joe Hannon, Microsoft Identity Security Team
@online{koehl:20200924:microsoft:adbe527, author = {Ben Koehl and Joe Hannon and Microsoft Identity Security Team}, title = {{Microsoft Security—detecting empires in the cloud}}, date = {2020-09-24}, organization = {Microsoft}, url = {https://www.microsoft.com/security/blog/2020/09/24/gadolinium-detecting-empires-cloud/}, language = {English}, urldate = {2020-09-24} } Microsoft Security—detecting empires in the cloud
CACTUSTORCH LazyCat Leviathan
2020-09-24Github (FortyNorthSecurity)Matt Grandy, Joe Leon
@techreport{grandy:20200924:offensive:8c9687e, author = {Matt Grandy and Joe Leon}, title = {{Offensive Maldocs in 2020}}, date = {2020-09-24}, institution = {Github (FortyNorthSecurity)}, url = {https://github.com/FortyNorthSecurity/Presentations/blob/master/Offensive%20Maldocs%20in%202020.pdf}, language = {English}, urldate = {2020-09-25} } Offensive Maldocs in 2020
2020-09-23Stranded on Pylos BlogJoe Slowik
@online{slowik:20200923:understanding:47cffee, author = {Joe Slowik}, title = {{Understanding Uncertainty while Undermining Democracy}}, date = {2020-09-23}, organization = {Stranded on Pylos Blog}, url = {https://pylos.co/2020/09/23/understanding-uncertainty-while-undermining-democracy/}, language = {English}, urldate = {2020-09-24} } Understanding Uncertainty while Undermining Democracy
2020-09-21Cisco TalosNick Mavis, Joe Marshall, JON MUNSHAW
@techreport{mavis:20200921:art:d9702a4, author = {Nick Mavis and Joe Marshall and JON MUNSHAW}, title = {{The art and science of detecting Cobalt Strike}}, date = {2020-09-21}, institution = {Cisco Talos}, url = {https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf}, language = {English}, urldate = {2020-09-23} } The art and science of detecting Cobalt Strike
Cobalt Strike
2020-07-13JoeSecurityJoe Security
@online{security:20200713:trickbots:a164ba5, author = {Joe Security}, title = {{TrickBot's new API-Hammering explained}}, date = {2020-07-13}, organization = {JoeSecurity}, url = {https://www.joesecurity.org/blog/498839998833561473}, language = {English}, urldate = {2020-07-15} } TrickBot's new API-Hammering explained
TrickBot
2020-06-18DragosJoe Slowik
@online{slowik:20200618:ekans:e768da1, author = {Joe Slowik}, title = {{EKANS Ransomware Misconceptions and Misunderstandings}}, date = {2020-06-18}, organization = {Dragos}, url = {https://www.dragos.com/blog/industry-news/ekans-ransomware-misconceptions-and-misunderstandings/}, language = {English}, urldate = {2020-06-19} } EKANS Ransomware Misconceptions and Misunderstandings
Snake Ransomware
2020-06-11Talos IntelligenceKendall McKay, Joe Marshall
@online{mckay:20200611:tor2mine:ee5dda6, author = {Kendall McKay and Joe Marshall}, title = {{Tor2Mine is up to their old tricks — and adds a few new ones}}, date = {2020-06-11}, organization = {Talos Intelligence}, url = {https://blog.talosintelligence.com/2020/06/tor2mine-is-up-to-their-old-tricks-and_11.html}, language = {English}, urldate = {2020-06-12} } Tor2Mine is up to their old tricks — and adds a few new ones
Azorult Remcos
2020-06-09RAND CorporationBilyana Lilly, Joe Cheravitch
@techreport{lilly:20200609:past:d6656a1, author = {Bilyana Lilly and Joe Cheravitch}, title = {{The Past, Present, and Future of Russia’s Cyber Strategy and Forces}}, date = {2020-06-09}, institution = {RAND Corporation}, url = {https://ccdcoe.org/uploads/2020/05/CyCon_2020_8_Lilly_Cheravitch.pdf}, language = {English}, urldate = {2020-06-10} } The Past, Present, and Future of Russia’s Cyber Strategy and Forces
2020-05-28Stranded on Pylos BlogJoe Slowik
@online{slowik:20200528:silos:3527589, author = {Joe Slowik}, title = {{Silos of Excellence}}, date = {2020-05-28}, organization = {Stranded on Pylos Blog}, url = {https://pylos.co/2020/05/28/silos-of-excellence/}, language = {English}, urldate = {2020-05-29} } Silos of Excellence
2020-05-12Trend MicroJoey Chen
@online{chen:20200512:tropic:8fff7a4, author = {Joey Chen}, title = {{Tropic Trooper’s Back: USBferry Attack Targets Air-gapped Environments}}, date = {2020-05-12}, organization = {Trend Micro}, url = {https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-troopers-back-usbferry-attack-targets-air-gapped-environments/}, language = {English}, urldate = {2020-05-14} } Tropic Trooper’s Back: USBferry Attack Targets Air-gapped Environments
USBferry
2020-05-12Trend MicroJoey Chen
@techreport{chen:20200512:tropic:a3285d0, author = {Joey Chen}, title = {{Tropic Trooper’s Back: USBferry Attack Targets Air-gapped Environments (Technical Brief)}}, date = {2020-05-12}, institution = {Trend Micro}, url = {https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf}, language = {English}, urldate = {2020-05-14} } Tropic Trooper’s Back: USBferry Attack Targets Air-gapped Environments (Technical Brief)
USBferry
2020-03DragosJoe Slowik
@techreport{slowik:202003:spyware:412ef8a, author = {Joe Slowik}, title = {{Spyware Stealer Locker Wiper Locker Goga Revisited}}, date = {2020-03}, institution = {Dragos}, url = {https://dragos.com/wp-content/uploads/Spyware-Stealer-Locker-Wiper-LockerGoga-Revisited.pdf}, language = {English}, urldate = {2020-03-18} } Spyware Stealer Locker Wiper Locker Goga Revisited
LockerGoga
2020-02-25RSA ConferenceJoel DeCapua
@online{decapua:20200225:feds:423f929, author = {Joel DeCapua}, title = {{Feds Fighting Ransomware: How the FBI Investigates and How You Can Help}}, date = {2020-02-25}, organization = {RSA Conference}, url = {https://www.youtube.com/watch?v=LUxOcpIRxmg}, language = {English}, urldate = {2020-03-04} } Feds Fighting Ransomware: How the FBI Investigates and How You Can Help
FastCash Cerber Defray Dharma FriedEx Gandcrab GlobeImposter Mamba Phobos Ransomware Rapid Ransom REvil Ryuk SamSam Zeus
2020-01DragosJoe Slowik
@techreport{slowik:202001:threat:d891011, author = {Joe Slowik}, title = {{Threat Intelligence and the Limits of Malware Analysis}}, date = {2020-01}, institution = {Dragos}, url = {https://pylos.co/wp-content/uploads/2020/02/Threat-Intelligence-and-the-Limits-of-Malware-Analysis.pdf}, language = {English}, urldate = {2020-06-10} } Threat Intelligence and the Limits of Malware Analysis
Exaramel Exaramel Industroyer Lookback NjRAT PlugX
2019-11-29Trend MicroJoey Chen, Hiroyuki Kakara, Masaoki Shoji
@techreport{chen:20191129:operation:16f5aaa, author = {Joey Chen and Hiroyuki Kakara and Masaoki Shoji}, title = {{Operation ENDTRADE:TICK: 2019s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data}}, date = {2019-11-29}, institution = {Trend Micro}, url = {https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf}, language = {English}, urldate = {2020-06-02} } Operation ENDTRADE:TICK: 2019s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data
BROLER