Click here to download all references as Bib-File.
| 2022-11-14 ⋅ Twitter (@embee_research) ⋅ Twitter thread on Yara Signatures for Qakbot Encryption Routines IcedID QakBot |
| 2022-11-03 ⋅ paloalto Netoworks: Unit42 ⋅ Cobalt Strike Analysis and Tutorial: Identifying Beacon Team Servers in the Wild Cobalt Strike |
| 2022-07-06 ⋅ Trend Micro ⋅ Brand-New HavanaCrypt Ransomware Poses as Google Software Update App, Uses Microsoft Hosting Service IP Address as C&C Server HavanaCrypt |
| 2022-05-05 ⋅ NCC Group ⋅ North Korea’s Lazarus: their initial access trade-craft using social media and social engineering LCPDot |
| 2022-04-28 ⋅ nccgroup ⋅ LAPSUS$: Recent techniques, tactics and procedures |
| 2022-04-12 ⋅ Sophos ⋅ Attackers linger on government agency computers before deploying Lockbit ransomware LockBit |
| 2022-02-22 ⋅ Bankinfo Security ⋅ Cybercrime Moves: Conti Ransomware Absorbs TrickBot Malware Conti TrickBot |
| 2022-02-18 ⋅ Huntress Labs ⋅ Hackers No Hashing: Randomizing API Hashes to Evade Cobalt Strike Shellcode Detection Cobalt Strike |
| 2022-02-15 ⋅ Sophos ⋅ Vulnerable Exchange server hit by Squirrelwaffle and financial fraud Squirrelwaffle |
| 2022-01-27 ⋅ CrowdStrike ⋅ Programs Hacking Programs: How to Extract Memory Information to Spot Linux Malware |
| 2022-01-20 ⋅ BrightTALK (Mandiant) ⋅ Anticipating and Preparing for Russian Cyber Activity |
| 2022-01-18 ⋅ Trend Micro ⋅ New Ransomware Spotted: White Rabbit and Its Evasion Tactics |
| 2022-01-14 ⋅ Mandiant ⋅ Proactive Preparation and Hardening to Protect Against Destructive Attacks |
| 2021-12-15 ⋅ Mandiant ⋅ Log4Shell Initial Exploitation and Mitigation Recommendations |
| 2021-10-19 ⋅ Proofpoint ⋅ Whatta TA: TA505 Ramps Up Activity, Delivers New FlawedGrace Variant FlawedGrace MirrorBlast |
| 2021-08-17 ⋅ Huntress Labs ⋅ Snakes on a Domain: An Analysis of a Python Malware Loader |
| 2021-08-17 ⋅ Volatility Labs ⋅ North Korean APT37 / InkySquid Infects Victims Using Browser Exploits APT37 |
| 2021-06-24 ⋅ Proofpoint ⋅ JSSLoader: Recoded and Reloaded JSSLoader |
| 2021-06-15 ⋅ NCC Group ⋅ Handy guide to a new Fivehands ransomware variant FiveHands |
| 2021-05-27 ⋅ Volexity ⋅ Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns Cobalt Strike |