Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2026-05-06 ⋅ Elastic ⋅ Daniel Stepanic, Jia Yu Chan, Seth Goodwin, Terrance DeJesus
TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook
TCLBANKER
2025-10-21 ⋅ Elastic ⋅ Andrew Pease, Braxton Williams, Daniel Stepanic, Jia Yu Chan, Salim Bitam, Seth Goodwin
TOLLBOOTH: What's yours, IIS mine
TOLLBOOTH
2025-02-13 ⋅ Elastic ⋅ Andrew Pease, Seth Goodwin
From South America to Southeast Asia: The Fragile Web of REF7707
FINALDRAFT FINALDRAFT GUIDLOADER PATHLOADER REF7707
2024-12-12 ⋅ Elastic ⋅ Daniel Stepanic, Elastic Security Labs, Jia Yu Chan, Salim Bitam, Seth Goodwin
Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite
Gosar Quasar RAT SADBRIDGE
2024-08-01 ⋅ Elastic ⋅ Daniel Stepanic, Seth Goodwin
BITS and Bytes: Analyzing BITSLOTH, a newly identified backdoor
BITSloth
2023-10-31 ⋅ Elastic ⋅ Andrew Pease, Colson Wilhoit, Ricardo Ungureanu, Seth Goodwin
Elastic catches DPRK passing out KANDYKORN
HLOADER KANDYKORN SUGARLOADER
2023-10-03 ⋅ Elastic ⋅ Andrew Pease, Cyril François, Daniel Stepanic, Salim Bitam, Seth Goodwin
Introducing the REF5961 intrusion set (RUDEBIRD, DOWNTOWN, and EAGERBEE)
EagerBee SManager REF2924 REF5961
2023-06-29 ⋅ Elastic ⋅ Andrew Pease, Colson Wilhoit, Ricardo Ungureanu, Salim Bitam, Seth Goodwin
The DPRK strikes using a new variant of RUSTBUCKET
RustBucket
2023-06-21 ⋅ Elastic ⋅ Andrew Pease, Colson Wilhoit, Ricardo Ungureanu, Salim Bitam, Seth Goodwin
Initial research exposing JOKERSPY
JokerSpy
2023-06-09 ⋅ Elastic ⋅ Cyril François, Daniel Stepanic, Seth Goodwin
Elastic charms SPECTRALVIPER
2023-06-09 ⋅ Elastic ⋅ Cyril François, Daniel Stepanic, Seth Goodwin
Elastic charms SPECTRALVIPER
SPECTRALVIPER
2023-02-02 ⋅ Elastic ⋅ Andrew Pease, Cyril François, Devon Kerr, Remco Sprooten, Salim Bitam, Seth Goodwin
Update to the REF2924 intrusion set and related campaigns
DoorMe ShadowPad SiestaGraph
2022-12-16 ⋅ Elastic ⋅ Andrew Pease, Daniel Stepanic, Devon Kerr, Salim Bitam, Samir Bousseaden, Seth Goodwin
SiestaGraph: New implant uncovered in ASEAN member foreign ministry
DoorMe SiestaGraph
2022-10-31 ⋅ Elastic ⋅ Andrew Pease, Daniel Stepanic, Derek Ditch, Seth Goodwin
ICEDIDs network infrastructure is alive and well
IcedID
2022-07-27 ⋅ Elastic ⋅ Andrew Pease, Cyril François, Seth Goodwin
Exploring the QBOT Attack Pattern
QakBot
2022-06-01 ⋅ Elastic ⋅ Andrew Pease, Daniel Stepanic, Derek Ditch, Salim Bitam, Seth Goodwin
CUBA Ransomware Campaign Analysis
Cobalt Strike Cuba Meterpreter MimiKatz SystemBC
2022-01-19 ⋅ Elastic ⋅ Andrew Pease, Daniel Stepanic, Derek Ditch, Seth Goodwin
Extracting Cobalt Strike Beacon Configurations
Cobalt Strike
2022-01-19 ⋅ Elastic ⋅ Andrew Pease, Daniel Stepanic, Derek Ditch, Seth Goodwin
Collecting Cobalt Strike Beacons with the Elastic Stack
Cobalt Strike
2022-01-18 ⋅ Elastic ⋅ Andrew Pease, Daniel Stepanic, Derek Ditch, Seth Goodwin
FORMBOOK Adopts CAB-less Approach
Formbook
2020-02-13 ⋅ Elastic ⋅ Andrew Pease, Daniel Stepanic, Seth Goodwin
Playing defense against Gamaredon Group
Pteranodon