Click here to download all references as Bib-File.

Enter keywords to filter the library entries below or Propose new Entry
2023-09-08ZscalerZscaler
@online{zscaler:20230908:technical:32525b9, author = {Zscaler}, title = {{Technical Analysis of HijackLoader}}, date = {2023-09-08}, organization = {Zscaler}, url = {https://www.zscaler.com/blogs/security-research/technical-analysis-hijackloader}, language = {English}, urldate = {2023-09-13} } Technical Analysis of HijackLoader
HijackLoader
2023-08-30NisosVincas Čižiūnas
@online{iinas:20230830:trickbot:31efb65, author = {Vincas Čižiūnas}, title = {{Trickbot in Light of Trickleaks Data}}, date = {2023-08-30}, organization = {Nisos}, url = {https://www.nisos.com/research/trickbot-trickleaks-data-analysis/}, language = {English}, urldate = {2023-09-01} } Trickbot in Light of Trickleaks Data
TrickBot
2023-07-27X (@BlackLotusLabs)Black Lotus Labs
@online{labs:20230727:update:67b9dd6, author = {Black Lotus Labs}, title = {{Tweet on update on AVrecon bot's migration to new infrastructure}}, date = {2023-07-27}, organization = {X (@BlackLotusLabs)}, url = {https://twitter.com/BlackLotusLabs/status/1684290046235484160}, language = {English}, urldate = {2023-07-31} } Tweet on update on AVrecon bot's migration to new infrastructure
AVrecon
2023-07-15MSSP Labcocomelonc
@online{cocomelonc:20230715:malware:8986fa9, author = {cocomelonc}, title = {{Malware source code investigation: BlackLotus - part 1}}, date = {2023-07-15}, organization = {MSSP Lab}, url = {https://mssplab.github.io/threat-hunting/2023/07/15/malware-src-blacklotus.html}, language = {English}, urldate = {2023-07-17} } Malware source code investigation: BlackLotus - part 1
BlackLotus
2023-05-29kn0s-organization
@online{kn0sorganization:20230529:blacklotus:a73a7a0, author = {kn0s-organization}, title = {{BlackLotus stage 2 bootkit-rootkit analysis}}, date = {2023-05-29}, url = {https://kn0s-organization.gitbook.io/blacklotus-analysis-stage2-bootkit-rootkit-stage/}, language = {English}, urldate = {2023-06-05} } BlackLotus stage 2 bootkit-rootkit analysis
BlackLotus
2023-05-03unpac.meSean Wilson
@online{wilson:20230503:unpacme:ed52c88, author = {Sean Wilson}, title = {{UnpacMe Weekly: New Version of IcedId Loader}}, date = {2023-05-03}, organization = {unpac.me}, url = {https://blog.unpac.me/2023/05/03/unpacme-weekly-new-version-of-icedid-loader}, language = {English}, urldate = {2023-05-04} } UnpacMe Weekly: New Version of IcedId Loader
IcedID PhotoLoader
2023-04-19SophosAndreas Klopsch
@online{klopsch:20230419:aukill:cebf5d8, author = {Andreas Klopsch}, title = {{‘AuKill’ EDR killer malware abuses Process Explorer driver}}, date = {2023-04-19}, organization = {Sophos}, url = {https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/}, language = {English}, urldate = {2023-04-22} } ‘AuKill’ EDR killer malware abuses Process Explorer driver
AuKill
2023-04-11MicrosoftMicrosoft Incident Response
@online{response:20230411:guidance:ddf000c, author = {Microsoft Incident Response}, title = {{Guidance for investigating attacks using CVE-2022-21894: The BlackLotus campaign}}, date = {2023-04-11}, organization = {Microsoft}, url = {https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/}, language = {English}, urldate = {2023-04-18} } Guidance for investigating attacks using CVE-2022-21894: The BlackLotus campaign
BlackLotus
2023-03-09binarlyAleksandr Matrosov
@online{matrosov:20230309:untold:ccb6198, author = {Aleksandr Matrosov}, title = {{The Untold Story of the BlackLotus UEFI Bootkit}}, date = {2023-03-09}, organization = {binarly}, url = {https://www.binarly.io/posts/The_Untold_Story_of_the_BlackLotus_UEFI_Bootkit/index.html}, language = {English}, urldate = {2023-03-20} } The Untold Story of the BlackLotus UEFI Bootkit
BlackLotus
2023-03-04ThreatZeroRaphael Mendonça
@online{mendona:20230304:kl:7f80664, author = {Raphael Mendonça}, title = {{KL Remota -  Brazilian Malware Bank}}, date = {2023-03-04}, organization = {ThreatZero}, url = {https://blog.threatzero.io/kl-remota-brazilian-malware-bank-244ac569fb33}, language = {English}, urldate = {2023-03-13} } KL Remota -  Brazilian Malware Bank
2023-03-01ESET ResearchMartin Smolár
@online{smolr:20230301:blacklotus:5ce99dc, author = {Martin Smolár}, title = {{BlackLotus UEFI bootkit: Myth confirmed}}, date = {2023-03-01}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/}, language = {English}, urldate = {2023-03-04} } BlackLotus UEFI bootkit: Myth confirmed
BlackLotus
2023-01-09Twitter (@SethKingHi)SKII
@online{skii:20230109:huskloader:0ca3742, author = {SKII}, title = {{Tweet on HuskLoader}}, date = {2023-01-09}, organization = {Twitter (@SethKingHi)}, url = {https://twitter.com/SethKingHi/status/1612377098777133057}, language = {English}, urldate = {2023-04-28} } Tweet on HuskLoader
HuskLoader
2022-12-13SophosAndreas Klopsch, Andrew Brandt
@online{klopsch:20221213:signed:9d26a63, author = {Andreas Klopsch and Andrew Brandt}, title = {{Signed driver malware moves up the software trust chain}}, date = {2022-12-13}, organization = {Sophos}, url = {https://news.sophos.com/en-us/2022/12/13/signed-driver-malware-moves-up-the-software-trust-chain/}, language = {English}, urldate = {2023-09-13} } Signed driver malware moves up the software trust chain
KillAV
2022-10-04SophosAndreas Klopsch
@online{klopsch:20221004:remove:a8a9121, author = {Andreas Klopsch}, title = {{Remove All The Callbacks – BlackByte Ransomware Disables EDR Via RTCore64.sys Abuse}}, date = {2022-10-04}, organization = {Sophos}, url = {https://news.sophos.com/en-us/2022/10/04/blackbyte-ransomware-returns/}, language = {English}, urldate = {2022-10-24} } Remove All The Callbacks – BlackByte Ransomware Disables EDR Via RTCore64.sys Abuse
BlackByte
2022-09-28KasperskyGReAT
@online{great:20220928:prilex:63ddfb7, author = {GReAT}, title = {{Prilex: the pricey prickle credit card complex}}, date = {2022-09-28}, organization = {Kaspersky}, url = {https://securelist.com/prilex-atm-pos-malware-evolution/107551/}, language = {English}, urldate = {2022-09-30} } Prilex: the pricey prickle credit card complex
2022-09-27Github (blacklotuslabs)Black Lotus Labs
@online{labs:20220927:chaos:1389681, author = {Black Lotus Labs}, title = {{Chaos Is A Go-Based Swiss Army Knife Of Malware (IOCs)}}, date = {2022-09-27}, organization = {Github (blacklotuslabs)}, url = {https://github.com/blacklotuslabs/IOCs/blob/main/Chaos_IoCs.txt}, language = {English}, urldate = {2022-09-30} } Chaos Is A Go-Based Swiss Army Knife Of Malware (IOCs)
2022-09-22ComputerWeeklyAlex Scroxton
@online{scroxton:20220922:alphvblackcat:2f581b9, author = {Alex Scroxton}, title = {{ALPHV/BlackCat ransomware family becoming more dangerous}}, date = {2022-09-22}, organization = {ComputerWeekly}, url = {https://www.computerweekly.com/news/252525240/ALPHV-BlackCat-ransomware-family-becoming-more-dangerous}, language = {English}, urldate = {2023-01-05} } ALPHV/BlackCat ransomware family becoming more dangerous
BlackCat BlackCat FIN7
2022-08-04METABen Nimmo, David Agranovich, Margarita Franklin, Mike Dvilyanski, Nathaniel Gleicher
@techreport{nimmo:20220804:quarterly:012f23e, author = {Ben Nimmo and David Agranovich and Margarita Franklin and Mike Dvilyanski and Nathaniel Gleicher}, title = {{Quarterly Adversarial Threat Report AUGUST 2022}}, date = {2022-08-04}, institution = {META}, url = {https://about.fb.com/wp-content/uploads/2022/08/Quarterly-Adversarial-Threat-Report-Q2-2022.pdf}, language = {English}, urldate = {2022-08-11} } Quarterly Adversarial Threat Report AUGUST 2022
2022-05-19NetbyteSECFareed
@online{fareed:20220519:scam:1d261f3, author = {Fareed}, title = {{Scam and Malicious APK targeting Malaysian: MyMaidKL Technical Analysis}}, date = {2022-05-19}, organization = {NetbyteSEC}, url = {https://notes.netbytesec.com/2022/05/scam-and-malicious-apk-targeting.html}, language = {English}, urldate = {2022-10-30} } Scam and Malicious APK targeting Malaysian: MyMaidKL Technical Analysis
2022-05-04SophosAndreas Klopsch
@online{klopsch:20220504:attacking:750e07f, author = {Andreas Klopsch}, title = {{Attacking Emotet’s Control Flow Flattening}}, date = {2022-05-04}, organization = {Sophos}, url = {https://news.sophos.com/en-us/2022/05/04/attacking-emotets-control-flow-flattening/}, language = {English}, urldate = {2022-05-05} } Attacking Emotet’s Control Flow Flattening
Emotet