Malpedia Library

Click here to download all references as Bib-File.

2023-04-19 ⋅ Microsoft ⋅ Justin Warner, Microsoft Threat Intelligence Center (MSTIC)
Exploring STRONTIUM's Abuse of Cloud Services
FusionDrive

2023-02-02 ⋅ YouTube (SLEUTHCON) ⋅ Christopher Glyer, Microsoft Threat Intelligence Center (MSTIC)
Lions, Tigers, and Infostealers - Oh my!
RecordBreaker RedLine Stealer Vidar

2022-10-10 ⋅ RiskIQ ⋅ Microsoft Threat Intelligence Center (MSTIC)
DEV-0832 Leverages Commodity Tools in Opportunistic Ransomware Campaigns
BlackCat Mount Locker SystemBC Zeppelin

2022-08-25 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Microsoft 365 Defender Research Team, Microsoft 365 Defender Threat Intelligence Team
MERCURY leveraging Log4j 2 vulnerabilities in unpatched systems to target Israeli organizations
MimiKatz

2022-08-24 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Detection and Response Team (DART), Microsoft 365 Defender Team
MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone

2022-08-15 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Office 365 Threat Research Team, Digital Threat Analysis Center (DTAC)
Disrupting SEABORGIUM’s ongoing phishing operations
Callisto

2022-08-15 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Office 365 Threat Research Team, Digital Threat Analysis Center (DTAC)
Disrupting SEABORGIUM’s ongoing phishing operations

2022-07-27 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Microsoft Security Response Center (MSRC), RiskIQ
Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits
Subzero

2022-07-14 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Microsoft Digital Security Unit (DSU)
North Korean threat actor (H0lyGh0st /DEV-0530) targets small and midsize businesses with H0lyGh0st ransomware
SiennaBlue SiennaPurple

2022-07-12 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Microsoft 365 Defender Research Team
From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud

2022-07-05 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC)
Hive ransomware gets upgrades in Rust
Hive

2022-06-02 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Microsoft Digital Security Unit (DSU)
Exposing POLONIUM activity and infrastructure targeting Israeli organizations
POLONIUM

2022-05-09 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center (MSTIC)
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself
AnchorDNS BlackCat BlackMatter Conti DarkSide HelloKitty Hive LockBit REvil FAKEUPDATES Griffon ATOMSILO BazarBackdoor BlackCat BlackMatter Blister Cobalt Strike Conti DarkSide Emotet FiveHands Gozi HelloKitty Hive IcedID ISFB JSSLoader LockBit LockFile Maze NightSky Pandora Phobos Phoenix Locker PhotoLoader QakBot REvil Rook Ryuk SystemBC TrickBot WastedLocker BRONZE STARLIGHT

2022-03-22 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Detection and Response Team (DART), Microsoft 365 Defender Threat Intelligence Team
DEV-0537 (UNC3661) criminal actor targeting organizations for data exfiltration and destruction
RedLine Stealer LAPSUS

2022-03-16 ⋅ Microsoft ⋅ Microsoft Defender for IoT Research Team, Microsoft Threat Intelligence Center (MSTIC)
Uncovering Trickbot’s use of IoT devices in command-and-control infrastructure
TrickBot

2022-02-04 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Microsoft Digital Security Unit (DSU)
ACTINIUM targets Ukrainian organizations
DilongTrash DinoTrain Pteranodon QuietSieve Gamaredon Group

2022-02-04 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Microsoft Digital Security Unit (DSU)
ACTINIUM targets Ukrainian organizations
Pteranodon Gamaredon Group

2021-12-11 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team, Microsoft Threat Intelligence Center (MSTIC)
Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability
Khonsari NightSky BRONZE STARLIGHT

2021-12-06 ⋅ Microsoft ⋅ Microsoft Threat Intelligence Center (MSTIC), Microsoft Digital Security Unit (DSU)
NICKEL targeting government organizations across Latin America and Europe
MimiKatz

2021-12-06 ⋅ Mandiant ⋅ Luke Jenkins, Sarah Hawley, Parnian Najafi, Doug Bienstock, Luis Rocha, Marius Fodoreanu, Mitchell Clarke, Manfred Erjak, Josh Madeley, Ashraf Abdalhalim, Juraj Sucik, Wojciech Ledzion, Gabriella Roncone, Jonathan Leathery, Ben Read, Microsoft Threat Intelligence Center (MSTIC), Microsoft Detection and Response Team (DART)
Suspected Russian Activity Targeting Government and Business Entities Around the Globe (UNC2452)
Cobalt Strike CryptBot