SecuriTricks - defense evasion

Snakes by the riverbank

ESET researchers have identified new MuddyWater activity targeting organizations in Israel and Egypt. The Iran-aligned cyberespionage group deployed custom tools to improve defense evasion and persistence, including a Fooder loader to execute the MuddyViper backdoor. The campaign demonstrates a mor…

backdoor

spearphishing

critical infrastructure

Published: December 2, 2025

Downloadable IOCs: 0

A Deep Dive Into Warlock Ransomware Deployed Via ToolShell SharePoint Chained Vulnerabilities

Warlock ransomware, exploiting SharePoint vulnerabilities CVE-2025-53770 and CVE-2025-53771, represents an advanced threat combining sophisticated encryption methods with targeted defense evasion techniques. The malware employs a multi-stage attack, terminating security services, removing recovery …

Published: October 30, 2025

Downloadable IOCs: 1

From Scripts to Systems: A Comprehensive Look at Tangerine Turkey Operations

Tangerine Turkey is a cryptomining campaign that uses VBScript worms to spread via USB drives, leveraging living-off-the-land binaries for execution and persistence. The group employs defense evasion techniques by modifying registry keys and masquerading malicious binaries as legitimate system file…

Published: October 29, 2025

Downloadable IOCs: 3

Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed

The Gentlemen ransomware group has emerged as a sophisticated threat actor targeting multiple industries across 17 countries, with a focus on the Asia-Pacific region. Their campaign demonstrates advanced capabilities, including the use of custom tools to bypass enterprise endpoint protections, expl…

the gentlemen ransomware

group policy manipulation

enterprise targeting

Published: September 9, 2025

Downloadable IOCs: 0

Malware Analysis Report: UMBRELLA STAND - Malware targeting Fortinet devices

UMBRELLA STAND is a sophisticated malware targeting FortiGate 100D series firewalls produced by Fortinet. It contains remote shell execution functionality, configurable beacon frequency, and AES-encrypted C2 communications. The malware uses fake TLS on port 443 to beacon to its C2 server and has th…

Published: June 23, 2025

Downloadable IOCs: 11

StaryDobry campaign targets gamers with XMRig miner

A cybercriminal campaign launched on December 31 exploited reduced vigilance during the holiday season by distributing trojanized versions of popular games via torrent sites. The attack, which lasted a month, affected users worldwide by spreading the XMRig cryptominer. The sophisticated infection c…

Published: February 18, 2025

Downloadable IOCs: 15

GetSmoked: UAC-0006 Returns With SmokeLoader Targeting Ukraine's Largest State-Owned Bank

UAC-0006, a financially motivated cyber threat group, has resurfaced with a sophisticated phishing campaign targeting customers of Ukraine’s largest state-owned bank, PrivatBank.

Published: February 10, 2025

Downloadable IOCs: 62

Tag: defense evasion

Attack reports

Snakes by the riverbank

A Deep Dive Into Warlock Ransomware Deployed Via ToolShell SharePoint Chained Vulnerabilities

From Scripts to Systems: A Comprehensive Look at Tangerine Turkey Operations

Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed

Malware Analysis Report: UMBRELLA STAND - Malware targeting Fortinet devices

StaryDobry campaign targets gamers with XMRig miner

GetSmoked: UAC-0006 Returns With SmokeLoader Targeting Ukraine's Largest State-Owned Bank

Understanding the Initial Stages of Web Shell and VPN Threats: An MXDR Analysis

SIEM agent being used in SilentCryptoMiner attacks

Threat Brief: Understanding Akira Ransomware