Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2025-04-22 ⋅ Volexity ⋅ Charlie Gardner, Josh Duke, Matthew Meltzer, Sean Koessel, Steven Adair, Tom Lancaster
Phishing for Codes: Russian Threat Actors Target Microsoft 365 OAuth Workflows
UTA0352 UTA0355
2025-04-17 ⋅ Proofpoint ⋅ Greg Lesnewich, Josh Miller, Mark Kelly, Saher Naumaan
Around the World in 90 Days: State-Sponsored Actors Try ClickFix
Quasar RAT UNK_RemoteRogue
2025-04-03 ⋅ Mandiant ⋅ Jacob Thompson, John Wolfram, Josh Murchie, Matt Lin, Michael Edie
Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)
SPAWNSNARE
2025-02-28 ⋅ Medium walmartglobaltech ⋅ Joshua Platt
Agent AI, Basta Parser Extraordinaire
Black Basta Black Basta
2025-01-20 ⋅ Medium walmartglobaltech ⋅ Jason Reaves, Jonathan Mccay, Joshua Platt
Qbot is Back.Connect
ReedBed UNC4393
2024-09-05 ⋅ Intego ⋅ Joshua Long
New macOS malware HZ RAT gives attackers backdoor access to Macs
HZ RAT
2024-08-29 ⋅ Google ⋅ Clement Lecigne, Josh Atkins, Luke Jenkins
State-backed attackers and commercial surveillance vendors repeatedly use the same exploits
ANDROSNATCH Unidentified APK 009 (Chrome Recon) COOKIESNATCH VALIDVICTOR
2024-08-19 ⋅ Aon ⋅ Daniel Stein, Joshua Pivirotto, Stroz Friedberg, Zachary Reichert
Unveiling "sedexp": A Stealthy Linux Malware Exploiting udev Rules
sedexp
2024-07-29 ⋅ Mandiant ⋅ Ashley Pearson, Jake Nicastro, Joseph Pisano, Josh Murchie, Joshua Shilko, Raymond Leong
UNC4393 Goes Gently into the SILENTNIGHT
Black Basta QakBot sRDI SystemBC Zloader UNC3973 UNC4393
2024-06-19 ⋅ Joshua Penny, vc0RExor
Akira: The old-new style crime
Akira
2024-06-19 ⋅ Medium walmartglobaltech ⋅ Jason Reaves, Joshua Platt
Spectre (SPC) v9 Campaigns and Updates
Spectre Rat
2024-06-11 ⋅ Invoke RE ⋅ Josh Reynolds
Parser Script for Havoc Config
Havoc
2024-04-04 ⋅ Mandiant ⋅ Ashley Pearson, Austin Larsen, Billy Wong, John Wolfram, Joseph Pisano, Josh Murchie, Lukasz Lamparski, Matt Lin, Ron Craft, Ryan Hall, Shawn Chew, Tyler McLellan
Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies
UNC3569 UNC5266 UNC5291 UNC5330 UNC5337 UTA0178
2024-04-04 ⋅ Mandiant ⋅ Ashley Pearson, Austin Larsen, Billy Wong, John Wolfram, Joseph Pisano, Josh Murchie, Lukasz Lamparski, Matt Lin, Ron Craft, Ryan Hall, Shawn Chew, Tyler McLellan
Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies
TONERJAM
2024-03-28 ⋅ Fox-IT ⋅ Joshua Kamp
Android Malware Vultur Expands Its Wingspan
Brunhilda Vultur
2024-03-13 ⋅ Medium walmartglobaltech ⋅ Jason Reaves, Joshua Platt
NewBot Loader
NewBot Loader
2024-03-05 ⋅ Medium walmartglobaltech ⋅ Jason Reaves, Joshua Platt
Unknown Nim Loader using PSBypassCLM
Unidentified 115 (Nim Loader)
2024-02-22 ⋅ Dragos ⋅ Josh Hanrahan
VOLTZITE Espionage Operations Targeting U.S. Critical Systems
2024-02-21 ⋅ Invoke RE ⋅ Josh Reynolds
Automating Qakbot Malware Analysis with Binary Ninja
QakBot
2024-02-21 ⋅ YouTube (Invoke RE) ⋅ Josh Reynolds
Analyzing Qakbot Using Binary Ninja Automation Part 3
QakBot