Click here to download all references as Bib-File.•

Enter keywords to filter the library entries below or Propose new Entry
2025-11-12 ⋅ ISC ⋅ Brad Duncan
SmartApeSG campaign uses ClickFix page to push NetSupport RAT
SmartApeSG NetSupportManager RAT
2025-10-10 ⋅ Palo Alto Networks Unit 42 ⋅ Matthew Brady
Scattered Lapsus$ Hunters: What Retail and Hospitality Organizations Should Know
Scattered Lapsus Hunters
2025-09-24 ⋅ Google ⋅ Ashley Pearson, Austin Larsen, BRAD SLAYBAUGH, Doug Bienstock, Geoff Carstairs, John Wolfram, Josh Madeley, Josh Murchie, Matt Lin, Sarah Yoder
Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors
BRICKSTORM
2025-01-25 ⋅ Sophos ⋅ Anthony Bradshaw, Colin Cowie, Daniel Souter, Hunter Neal, Mark Parsons, Sean Baird, Sean Gallagher
Sophos MDR tracks two ransomware campaigns using “email bombing,” Microsoft Teams “vishing”
ReedBed STAC5143 UNC4393
2025-01-23 ⋅ Github (PaloAltoNetworks) ⋅ Brad Duncan
Cluster of Infrastructure likely used by Affiliate of Dark Scorpius (Black Basta)
ReedBed
2024-03-07 ⋅ Malware Traffic Analysis ⋅ Brad Duncan
2024-03-07 (THURSDAY): LATRODECTUS INFECTION LEADS TO LUMMA STEALER
Latrodectus Lumma Stealer
2024-01-19 ⋅ paloalto Networks Unit 42 ⋅ Ben Zhang, Billy Melicher, Bo Qu, Brad Duncan, Qi Deng, Zhanglin He
Parrot TDS: A Persistent and Evolving Malware Campaign
Parrot TDS Parrot TDS WebShell
2023-10-03 ⋅ Malware Traffic Analysis ⋅ Brad Duncan
2023-10-03 (Tuesday) - PikaBot infection with Cobalt Strike
Cobalt Strike Pikabot
2023-06-13 ⋅ Mandiant ⋅ Alexander Marvi, BRAD SLAYBAUGH, Ron Craft, Rufus Brown
VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors (UNC3886)
UNC3886
2023-06-05 ⋅ Malware Traffic Analysis ⋅ Brad Duncan
30 DAYS OF FORMBOOK: DAY 1, MONDAY 2023-06-05
Formbook
2023-05-30 ⋅ SANS ISC ⋅ Brad Duncan
Malspam pushes ModiLoader (DBatLoader) infection for Remcos RAT
DBatLoader
2023-05-30 ⋅ Palo Alto Networks Unit 42 ⋅ Brad Duncan
Cold as Ice: Answers to Unit 42 Wireshark Quiz for IcedID
IcedID PhotoLoader
2023-04-21 ⋅ Jamf Blog ⋅ Ferdous Saljooki, Jaron Bradley
BlueNoroff APT group targets macOS with ‘RustBucket’ Malware
RustBucket
2023-04-12 ⋅ InfoSec Handlers Diary Blog ⋅ Brad Duncan
Recent IcedID (Bokbot) activity
IcedID PhotoLoader
2023-04-12 ⋅ SANS ISC ⋅ Brad Duncan
Recent IcedID (Bokbot) activity
IcedID
2023-03-16 ⋅ Mandiant ⋅ Alexander Marvi, BRAD SLAYBAUGH, DAN EBREO, Muhammad Umair, TINA JOHNSON, Tufail Ahmed
Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation
UNC3886
2023-02-23 ⋅ Jamf Blog ⋅ Ferdous Saljooki, Jaron Bradley, Matt Benyo
Evasive cryptojacking malware targeting macOS found lurking in pirated applications
2023-01-18 ⋅ SANS ISC ⋅ Brad Duncan
Malicious Google Ad --> Fake Notepad++ Page --> Aurora Stealer malware
Aurora Stealer
2023-01-03 ⋅ Malware Traffic Analysis ⋅ Brad Duncan
2023-01-03 (TUESDAY) - GOOGLE AD --> FAKE NOTPAD++ PAGE --> RHADAMANTHYS STEALER
Rhadamanthys
2022-12-15 ⋅ ISC ⋅ Brad Duncan
Google ads lead to fake software pages pushing IcedID (Bokbot)
IcedID