SecuriTricks - cobalt strike

SAP Zero – Frostbite: How Russian RaaS Actor Qilin Exploited CVE-2025-31324 Weeks Before its Public Disclosure

CVE-2025-31324 hit the security world like a tsunami – an easily exploitable SAP vulnerability affecting enterprise environments across the globe. But while most assumed its exploitation began post-disclosure, new evidence suggests otherwise. During an incident response led by OP Innovate for a maj…

cobalt strike

sap netweaver

2025-05-20

ransomware-as-a-service (raas)

qilin ransomware

Published: May 20, 2025

Downloadable IOCs: 5

Modern Incident Response: Tackling Malicious ML Artifacts

This analysis explores the emerging threat of machine learning model-based breaches, detailing their anatomy, detection methods, and real-world examples. It highlights the risks associated with sharing ML models, particularly through platforms like Hugging Face, and the potential for malicious acto…

Published: May 14, 2025

Downloadable IOCs: 2

Targeting Taiwan & Japan with DLL Implants

A newly discovered APT campaign dubbed Swan Vector is targeting educational institutes and mechanical engineering industries in Taiwan and Japan. The attack uses a sophisticated multi-stage infection chain involving malicious LNK files, DLL implants (Pterois and Isurus), and Cobalt Strike payloads.…

Published: May 12, 2025

Downloadable IOCs: 16

DragonForce Ransomware Gang | From Hacktivists to High Street Extortionists

The DragonForce ransomware group, initially a pro-Palestine hacktivist operation, has evolved into a profit-driven extortion enterprise targeting UK retailers and various global entities. Emerging in August 2023, the group now employs a multi-extortion model, threatening data leaks and reputational…

dragonforce ransomware

white-label

Published: May 3, 2025

Downloadable IOCs: 0

Nitrogen Dropping Cobalt Strike – A Combination of 'Chemical Elements'

The Nitrogen ransomware group has expanded its operations from North America to Africa and Europe since September 2024. They utilize malvertising tactics, disguising malicious payloads as legitimate software like WinSCP. The group employs DLL sideloading for initial access, followed by Cobalt Strik…

Published: May 2, 2025

Downloadable IOCs: 2

Finding Minhook in a sideloading attack – and Sweden too

A threat actor campaign targeting multiple locations was observed in late 2023 and early 2024. Initially focused on the Far East, it later shifted to Sweden. The attacks used DLL sideloading techniques, employing the Minhook library to detour Windows API calls. The clean loader was obtained from in…

Published: May 1, 2025

Downloadable IOCs: 0

Two sides of the same coin

This intelligence report analyzes the similarities between two previously separate APT groups, Team46 and TaxOff, concluding they are likely the same entity. The analysis covers their shared tactics, techniques, and procedures, including similar PowerShell commands, loader functionality, and infras…

Published: April 18, 2025

Downloadable IOCs: 0

Inside BRUTED: Black Basta (RaaS) Used Automated Brute Forcing Framework to Target Edge Network Devices

Black Basta, a ransomware-as-a-service group, has been using an automated brute forcing framework called BRUTED to target edge network devices since 2023. The framework performs internet scanning and credential stuffing against firewalls and VPN solutions in corporate networks. Black Basta prioriti…

Published: April 16, 2025

Downloadable IOCs: 18

CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild

A critical vulnerability (CVE-2025-30406) in Gladinet CentreStack and Triofox software has been discovered and is being actively exploited. The flaw involves hardcoded cryptographic keys in configuration files, allowing attackers to abuse ASPX ViewState for remote code execution. Affected versions …

cobalt strike

privilege escalation

remote code execution

Published: April 15, 2025

Linked vulnerabilities : CVE-2025-30406

Downloadable IOCs: 6

Operation HollowQuill: Russian R&D Networks Targeted via Decoy PDFs

Operation HollowQuill targets Russian research and defense networks, particularly the Baltic State Technical University, using weaponized decoy documents disguised as research invitations. The attack chain involves a malicious RAR file containing a .NET dropper, which deploys a Golang-based shellco…

academic institutions

baltic state technical university

operation hollowquill

Published: March 31, 2025

Downloadable IOCs: 2

Fake Zoom Ends in BlackSuit Ransomware

A malicious website mimicking Zoom led to the installation of a trojanized installer, initiating a multi-stage attack. The initial payload, d3f@ckloader, downloaded additional components, including SectopRAT. After nine days, the threat actor deployed Brute Ratel and Cobalt Strike beacons for later…

Published: March 31, 2025

Downloadable IOCs: 0

Unmasking the new persistent attacks on Japan

An unknown attacker has been targeting organizations in Japan since January 2025, exploiting CVE-2024-4577, a remote code execution vulnerability in PHP-CGI on Windows. The attacker uses the Cobalt Strike kit 'TaoWu' for post-exploitation activities, including reconnaissance, privilege escalation, …

Published: March 6, 2025

Linked vulnerabilities : CVE-2024-4577 (CVSS 9.8)

Downloadable IOCs: 3

2024 Malicious Infrastructure Insights: Key Trends and Threats

The report highlights significant trends in malicious infrastructure for 2024, including the rise of malware-as-a-service infostealers, continued dominance of Cobalt Strike among offensive security tools, and increased use of legitimate services by threat actors. Key findings include LummaC2's domi…

malicious infrastructure

remote access trojans

2025-02-28

traffic distribution systems

mozi botnet

state-sponsored groups

command-and-control servers

solarmarker rat

offensive security tools

Published: February 28, 2025

Downloadable IOCs: 0

Ghostwriter | New Campaign Targets Ukrainian Government and Belarusian Opposition

A new campaign attributed to the Ghostwriter threat actor has been observed targeting opposition activists in Belarus and Ukrainian military and government organizations. The operation, which began preparation in mid-2024 and entered an active phase in late 2024, employs weaponized Excel documents …

Published: February 26, 2025

Downloadable IOCs: 10

Trimble Cityworks: CVE-2025-0994: Active Exploitation

A high-severity deserialization vulnerability in Trimble Cityworks, CVE-2025-0994, affects versions before 15.8.9 and Office Companion versions before 23.10. This flaw allows authenticated attackers to execute remote code on Microsoft IIS web servers. Exploitation indicators suggest the use of Rust…

cobalt strike

remote code execution

critical infrastructure

deserialization vulnerability

Published: February 20, 2025

Linked vulnerabilities : CVE-2025-0994 (CVSS 8.8)

Downloadable IOCs: 16

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

A sophisticated cyberespionage campaign targeting high-value entities in South Asia, particularly a telecommunications organization, has been identified. The threat actor, tracked as CL-STA-0048, employed rare techniques like 'Hex Staging' for payload delivery and DNS-based data exfiltration. The o…

Published: January 30, 2025

Linked vulnerabilities : CVE-2025-0282 (CVSS 9.0), CVE-2025-0283 (CVSS 7.0)

Downloadable IOCs: 21

Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware

This report details an intrusion that began with the execution of a Cobalt Strike beacon masquerading as a Windows Media Configuration Utility. The threat actor used various tools for persistence, lateral movement, and data exfiltration, including SystemBC and GhostSOCKS proxies, Rclone, and PsExec…

Published: January 27, 2025

Downloadable IOCs: 21

Tracking Adversaries: Ghostwriter APT Infrastructure

This analysis examines the infrastructure used by the Ghostwriter APT group, focusing on their phishing campaign targeting Ukrainian military. By pivoting on overlapping indicators of compromise (IOCs) from multiple threat reports, a cluster of malicious domains was identified. These domains share …

Published: January 24, 2025

Linked vulnerabilities : CVE-2022-30190

Downloadable IOCs: 25

APT32 Poisoning GitHub, Targeting Chinese Cybersecurity Professionals and Specific Large Enterprises

APT32 (OceanLotus) has launched a sophisticated attack targeting Chinese cybersecurity professionals and specific large enterprises. The group released a Cobalt Strike exploit plugin with a Trojan on GitHub, embedding a malicious .suo file into a Visual Studio project. When compiled, the Trojan exe…

Published: January 9, 2025

Downloadable IOCs: 0

Recent Cases of Watering Hole Attacks, Part 1

This analysis focuses on a watering hole attack targeting a Japanese university research laboratory website in 2023. The attack used social engineering to trick users into downloading and executing malware disguised as an Adobe Flash Player update. The malware, identified as a modified Cobalt Strik…

flashupdateinstall.exe

university

Published: December 20, 2024

Linked vulnerabilities : CVE-2022-1388

Downloadable IOCs: 10

The Curious Case of an Excellent Resume

This report details a malicious campaign where the threat actor gained initial access through a resume lure as part of a TA4557/FIN6 operation. The actor employed techniques like abusing legitimate binaries, establishing Cobalt Strike and Pyramid C2, exploiting CVE-2023-27532 for lateral movement, …

Published: December 4, 2024

Linked vulnerabilities : CVE-2023-27532

Downloadable IOCs: 20

Threat Assessment: Distributors of BlackSuit Ransomware

Ignoble Scorpius, previously known as Royal ransomware, has rebranded as BlackSuit ransomware and increased its activity since March 2024. The group has targeted at least 93 victims globally, with a focus on the construction and manufacturing industries. Their initial ransom demands average 1.6% of…

Published: November 20, 2024

Downloadable IOCs: 2

Spot the Difference: New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

Earth Kasha, a threat group targeting Japan since 2019, has launched a new campaign with significant updates to their tactics and arsenals. The group has expanded its targets to include Taiwan and India, focusing on advanced technology organizations and government agencies. They now exploit public-…

Published: November 19, 2024

Linked vulnerabilities : CVE-2023-3519, CVE-2023-27997, CVE-2023-45727, CVE-2023-28461, CVE-2013-3900, CVE-2023-3467, CVE-2023-3466

Downloadable IOCs: 7

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

A Chinese state-sponsored threat group, TAG-112, has compromised two Tibetan websites to deliver Cobalt Strike malware. The attackers embedded malicious JavaScript in the sites, spoofing a TLS certificate error to trick visitors into downloading a disguised security certificate. This campaign highl…

joomla vulnerabilities

tls certificate spoofing

evasive panda

tag-102

Published: November 13, 2024

Downloadable IOCs: 19

EDR Bypass Testing Reveals Extortion Actor's Toolkit

Unit 42 investigated an extortion attempt where threat actors tested an AV/EDR bypass tool on rogue systems with Cortex XDR installed. The actors purchased network access via Atera RMM and used a BYOVD technique for the bypass tool. Researchers gained visibility into the actors' systems, uncovering…

threat actor profiling

av/edr bypass

Published: November 2, 2024

Downloadable IOCs: 0

Chinese Hackers Toolkit Uncovered And Activity History Uncovered

A Chinese hacking group called 'You Dun' was discovered through an exposed open directory, revealing their comprehensive attack infrastructure. The group utilized sophisticated reconnaissance tools and exploited Zhiyuan OA software via SQL injection attacks, targeting South Korean pharmaceutical or…

Published: October 28, 2024

Linked vulnerabilities : CVE-2021-25003

Downloadable IOCs: 7

Inside the Open Directory of the “You Dun” Threat Group

An open directory exposed a Chinese-speaking threat actor's toolkit and operational history. The actor conducted extensive scanning and exploitation targeting organizations in South Korea, China, Thailand, Taiwan, and Iran using tools like WebLogicScan, Vulmap, and Xray. The Viper C2 framework and …

weblogic exploitation

viper c2

chinese threat actor

Published: October 28, 2024

Downloadable IOCs: 3

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan

A sophisticated cyber espionage campaign dubbed Operation Cobalt Whisper has been uncovered, targeting various industries in Hong Kong and Pakistan. The threat actor focuses on the defense sector, engineering researchers, and key entities in these regions, using tailored lures related to electrotec…

Published: October 24, 2024

Downloadable IOCs: 0

New Bumblebee Loader Infection Chain Signals Possible Resurgence

A new infection chain for the Bumblebee loader malware has been discovered, potentially indicating its resurgence after Operation Endgame. The sophisticated downloader, first identified in March 2022, is used by cybercriminals to access corporate networks and deliver payloads like Cobalt Strike bea…

Published: October 21, 2024

Downloadable IOCs: 11

No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection

This article analyzes four previously undisclosed DNS tunneling campaigns identified through a new campaign monitoring system. The system detects tunneling domains based on common techniques and attributes used in malicious campaigns. Four new campaigns were uncovered: FinHealthXDS (targeting finan…

covert communications

hiloti

finhealthxds

Published: October 5, 2024

Downloadable IOCs: 0

Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware

A BlackCat ransomware intrusion began with a Nitrogen malware campaign impersonating Advanced IP Scanner. The attackers used Sliver and Cobalt Strike beacons for post-exploitation, leveraging Python scripts for memory loading. They performed network enumeration using various tools and moved lateral…

credential harvesting

Published: October 1, 2024

Downloadable IOCs: 45

Storm-0501: Ransomware attacks expanding to hybrid cloud environments

Microsoft has observed Storm-0501, a financially motivated cybercriminal group, conducting multi-staged attacks targeting hybrid cloud environments. The group compromises on-premises networks, performs lateral movement to cloud environments, exfiltrates data, steals credentials, creates persistent …

Published: September 30, 2024

Linked vulnerabilities : CVE-2023-4966, CVE-2023-38203, CVE-2023-29300, CVE-2022-47966

Downloadable IOCs: 14

Unraveling SloppyLemming’s Operations Across South Asia

An investigation reveals SloppyLemming, an advanced threat actor targeting South and East Asian countries, particularly Pakistan. The group uses multiple cloud services for credential harvesting, malware delivery, and command and control. Their operations focus on government, law enforcement, energ…

Published: September 27, 2024

Linked vulnerabilities : CVE-2023-38831

Downloadable IOCs: 96

From initial compromise to ransomware and wipers

The Twelve group, formed in April 2023 amid the Russian-Ukrainian conflict, specializes in attacking Russian government organizations. Their attacks involve encrypting and deleting victims' data, causing maximum damage without seeking financial gain. The group uses publicly available tools like Cob…

Published: September 23, 2024

Linked vulnerabilities : CVE-2021-22005, CVE-2021-21972

Downloadable IOCs: 20

Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC

Earth Baxia, a suspected China-based threat actor, targeted government organizations, telecommunication businesses, and the energy industry in multiple Asia-Pacific countries. The group employed sophisticated techniques, including spear-phishing emails and exploitation of a GeoServer vulnerability …

Published: September 20, 2024

Downloadable IOCs: 29

Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders

A long-term intrusion targeting a Vietnamese human rights non-profit organization has been discovered, likely spanning at least four years. The attack shows significant overlaps with techniques used by APT32/OceanLotus, a threat actor known for targeting Vietnamese activists. The intrusion involved…

Published: September 3, 2024

Downloadable IOCs: 46

The Malware That Must Not Be Named: Suspected Espionage Campaign Delivers 'Voldemort'

Proofpoint researchers uncovered an unusual campaign delivering custom malware named "Voldemort". The activity impersonated tax authorities from various countries and targeted dozens of organizations worldwide. The attack chain combines popular and uncommon techniques, including using Google Sheets…

Published: September 2, 2024

Downloadable IOCs: 27

StopRansomware: RansomHub Ransomware

RansomHub is a ransomware-as-a-service variant that has targeted over 210 victims across various critical infrastructure sectors since February 2024. It employs a double-extortion model, encrypting systems and exfiltrating data. The ransom note provides victims with a client ID and instructions to …

ransomware-as-a-service

critical-infrastructure

CVE-2020-0787

lateral-movement

Published: August 30, 2024

Linked vulnerabilities : CVE-2020-1472, CVE-2023-46604, CVE-2023-22515, CVE-2020-0787, CVE-2017-0144, CVE-2023-3519, CVE-2023-27997, CVE-2023-48788, CVE-2023-46747

Downloadable IOCs: 14

BlackSuit Ransomware

The report meticulously chronicles a sophisticated intrusion which began in December 2023 and culminated in the deployment of BlackSuit ransomware approximately 15 days later. The threat actor demonstrated an array of tactics, leveraging tools like Cobalt Strike, Sharphound, and SystemBC, alongside…

Published: August 27, 2024

Downloadable IOCs: 16

A Dive into Latest Campaign

Earth Baku, an advanced persistent threat actor, has broadened its operations from the Indo-Pacific region to Europe, the Middle East, and Africa, targeting countries like Italy, Germany, UAE, and Qatar. The group leverages public-facing applications like IIS servers as entry points, deploying soph…

Published: August 9, 2024

Downloadable IOCs: 30

Likely compromise of Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

A government-affiliated Taiwanese research institute specializing in computing technologies experienced a cyber intrusion likely carried out by the Chinese hacking group APT41. The attackers employed ShadowPad malware, Cobalt Strike, and custom tools, exploiting vulnerabilities like CVE-2018-0824 f…

Published: August 2, 2024

Linked vulnerabilities : CVE-2018-0824

Downloadable IOCs: 13

Fake update puts visitors at risk

This intelligence report discusses SocGholish, a JavaScript downloader used by threat actors to deliver malware payloads disguised as fake browser updates. It analyzes the recent tactics, techniques, and procedures employed by threat groups like Evil Corp in compromising WordPress websites, fingerp…

Published: July 24, 2024

Downloadable IOCs: 10

GrimResource - Microsoft Management Console for initial access and evasion

A novel, in-the-wild code execution technique leveraging Microsoft Management Console files (MSC) has been identified by Elastic Security researchers and was first spotted in the wild in June 2016 and is currently being investigated by VirusTotal.

Published: June 27, 2024

Downloadable IOCs: 3

Chamelgang & Friends | Cyberespionage Groups Attacking Critical Infrastructure with Ransomware

In collaboration with Recorded Future, SentinelLabs has been tracking two distinct activity clusters targeting government and critical infrastructure sectors globally between 2021 and 2023.

Published: June 26, 2024

Downloadable IOCs: 8

Attackers Exploiting Public Cobalt Strike Profiles

This report discusses recent findings of malicious Cobalt Strike infrastructure and malicious Cobalt Strike samples that leverage publicly available Malleable C2 profiles for evasion. Despite its defensive cybersecurity use, threat actors continue exploiting Cobalt Strike's malleable and evasive na…

Published: June 26, 2024

Linked vulnerabilities : CVE-2024-3400

Downloadable IOCs: 6

Dissecting SSLoad Malware: A Comprehensive Technical Analysis

This in-depth analysis explores the intricate inner workings of SSLoad, a stealthy and adaptable malware known for its sophisticated delivery methods and evasion techniques. The comprehensive investigation unravels the malware's multistage infection chain, dissecting the various loaders, decryption…

cobalt strike

ssload

2024-06-10

Published: June 10, 2024

Downloadable IOCs: 7

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

This report details an intrusion that commenced with a spam campaign distributing a forked IcedID loader. After gaining initial access, the threat actor deployed ScreenConnect and established Cobalt Strike beacons, enabling remote command execution. They also utilized CSharp Streamer, a capable RAT…

Published: June 10, 2024

Downloadable IOCs: 33

Operation Crimson Palace: A Technical Deep Dive

Sophos Managed Detection and Response initiated a threat hunt across customers after detecting abuse of a vulnerable VMware executable. The hunt uncovered a complex, persistent cyberespionage campaign by Chinese state-sponsored actors targeting a high-profile government organization in Southeast As…

Published: June 6, 2024

Downloadable IOCs: 138

Ongoing Malvertising Campaign leads to Ransomware

Rapid7 detected an ongoing malware distribution campaign involving trojanized installers of WinSCP and PuTTY, delivered via malicious search engine ads. The infection chain employs DLL side-loading, credential access, and deploys Sliver beacons followed by Cobalt Strike. In one case, the threat act…

Published: May 15, 2024

Downloadable IOCs: 78

Leveraging DNS Tunneling for Tracking and Scanning

This article presents a case study on new applications of domain name system (DNS) tunneling PaloAlto Unit42 have found in the wild. These techniques expand beyond DNS tunneling only for command and control (C2) and virtual private network (VPN) purposes.

Published: May 13, 2024

Downloadable IOCs: 63

Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

Following the 2023 holiday season, Akamai researchers uncovered a significant amount of highly likely malicious activity and domains purporting to be associated with the United States Postal Service (USPS). Akamai researchers compared five months of DNS traffic to the legitimate domain, usps.com, w…

Published: April 29, 2024

Downloadable IOCs: 34

Uncorking Old Wine: Zero-Day from 2017 + Loader in Unholy Alliance

An analysis uncovered a suspected malicious campaign targeting entities in Ukraine. The attack employed an old vulnerability from 2017, CVE-2017-8570, as the initial entry vector. The operation utilized a customized loader to deliver the Cobalt Strike Beacon payload. While the specific threat actor…

Published: April 29, 2024

Downloadable IOCs: 6

From IcedID to Dagon Locker Ransomware in 29 Days

This intrusion started in August 2023 with a phishing campaign that distributed IcedID malware. The phishing operation utilized the Prometheus Traffic Direction System (TDS) to deliver the malware and victims were directed to a fraudulent website, mimicking an Azure download portal.

Published: April 29, 2024

Downloadable IOCs: 33

Tag: cobalt strike

Attack reports

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

Custom Arsenal Developed to Target Multiple Industries

Exploits Cityworks zero-day vulnerability to deliver malware

New Nitrogen Ransomware Targets Financial Firms in the US, UK and Canada

SAP Zero – Frostbite: How Russian RaaS Actor Qilin Exploited CVE-2025-31324 Weeks Before its Public Disclosure

Modern Incident Response: Tackling Malicious ML Artifacts

Targeting Taiwan & Japan with DLL Implants

DragonForce Ransomware Gang | From Hacktivists to High Street Extortionists

Nitrogen Dropping Cobalt Strike – A Combination of 'Chemical Elements'

Finding Minhook in a sideloading attack – and Sweden too

Two sides of the same coin

Inside BRUTED: Black Basta (RaaS) Used Automated Brute Forcing Framework to Target Edge Network Devices

CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild

Operation HollowQuill: Russian R&D Networks Targeted via Decoy PDFs

Fake Zoom Ends in BlackSuit Ransomware

Unmasking the new persistent attacks on Japan

2024 Malicious Infrastructure Insights: Key Trends and Threats

Ghostwriter | New Campaign Targets Ukrainian Government and Belarusian Opposition

Trimble Cityworks: CVE-2025-0994: Active Exploitation

CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware

Tracking Adversaries: Ghostwriter APT Infrastructure

APT32 Poisoning GitHub, Targeting Chinese Cybersecurity Professionals and Specific Large Enterprises

Recent Cases of Watering Hole Attacks, Part 1

The Curious Case of an Excellent Resume

Threat Assessment: Distributors of BlackSuit Ransomware

Spot the Difference: New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

EDR Bypass Testing Reveals Extortion Actor's Toolkit

Chinese Hackers Toolkit Uncovered And Activity History Uncovered

Inside the Open Directory of the “You Dun” Threat Group

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan

New Bumblebee Loader Infection Chain Signals Possible Resurgence

No Way to Hide: Uncovering New Campaigns from Daily Tunneling Detection

Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware

Storm-0501: Ransomware attacks expanding to hybrid cloud environments

Unraveling SloppyLemming’s Operations Across South Asia

From initial compromise to ransomware and wipers

Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC

Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders

The Malware That Must Not Be Named: Suspected Espionage Campaign Delivers 'Voldemort'

StopRansomware: RansomHub Ransomware

BlackSuit Ransomware

A Dive into Latest Campaign

Likely compromise of Taiwanese government-affiliated research institute with ShadowPad and Cobalt Strike

Fake update puts visitors at risk

GrimResource - Microsoft Management Console for initial access and evasion

Chamelgang & Friends | Cyberespionage Groups Attacking Critical Infrastructure with Ransomware

Attackers Exploiting Public Cobalt Strike Profiles

Dissecting SSLoad Malware: A Comprehensive Technical Analysis

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

Operation Crimson Palace: A Technical Deep Dive

Ongoing Malvertising Campaign leads to Ransomware

Leveraging DNS Tunneling for Tracking and Scanning

Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

Uncorking Old Wine: Zero-Day from 2017 + Loader in Unholy Alliance

From IcedID to Dagon Locker Ransomware in 29 Days