Tag: evasion

26 attack reports | 0 vulnerabilities

Attack reports

Published: October 4, 2024

Number of indicators: 9

A sophisticated Linux malware named 'perfctl' has been actively targeting millions of servers worldwide for the past 3-4 years. I…

Published: October 3, 2024

Number of indicators: 8

The report details sophisticated command and control (C2) techniques employed by the APT41 threat group. APT41 uses custom malwar…

Published: September 16, 2024

Number of indicators: 6

This comprehensive report analyzes Gomorrah Stealer, a sophisticated malware designed to exfiltrate sensitive information from co…

Published: September 10, 2024

Number of indicators: 11

The report provides insights into the evolving tactics and infrastructure of a threat group referred to as the 'Quad7 botnet oper…

Published: September 10, 2024

Number of indicators: 0

The report provides insights into the evolving tactics and infrastructure of a threat group referred to as the 'Quad7 botnet oper…

Published: August 30, 2024

Number of indicators: 5

Cybercriminals are employing a sophisticated two-stage malware campaign masquerading as the Palo Alto GlobalProtect tool to infil…

Published: August 28, 2024

Number of indicators: 13

Seqrite Labs APT-Team discovered a sophisticated malware campaign targeting government and military officials in the Czech Republ…

Published: August 23, 2024

Number of indicators: 3

Stroz Friedberg discovered sedexp, a stealthy Linux malware that utilizes udev rules to achieve persistence and evade detection. …

Published: August 16, 2024

Number of indicators: 68

Kaspersky has uncovered a complex malware campaign orchestrated by Russian-speaking cybercriminals. The threat actors create sub-…

Published: August 12, 2024

Number of indicators: 32

An investigation by The DFIR report revealed a collection of batch scripts designed for defense evasion and executing command-and…

Published: August 5, 2024

Number of indicators: 5

This comprehensive technical analysis delves into the intricate workings of an advanced and localized malware campaign employing …

Published: July 31, 2024

Number of indicators: 6

This analysis examines a recent malware campaign involving a dropper dubbed Gh0stGambit, which is employed to retrieve and execut…

Published: July 24, 2024

Number of indicators: 27

This report details a malicious campaign exploiting the CVE-2024-21412 vulnerability in Microsoft Windows SmartScreen to bypass s…

Published: July 12, 2024

Number of indicators: 3

This blog post examines MoonWalk, a new backdoor employed by APT41, a China-based threat actor known for campaigns in Southeast A…

Published: July 11, 2024

Number of indicators: 1

This blog post provides an in-depth technical analysis of a newly discovered malware loader called DodgeBox, which is attributed …

Published: July 8, 2024

Number of indicators: 10

This report details a recent campaign by the Turla threat group involving malicious LNK files that deliver a fileless backdoor. T…

Published: July 4, 2024

Number of indicators: 2

This article demonstrates how to circumvent anti-analysis techniques employed by GootLoader malware while utilizing Node.js debug…

Published: June 26, 2024

Number of indicators: 6

This report discusses recent findings of malicious Cobalt Strike infrastructure and malicious Cobalt Strike samples that leverage…

Published: June 6, 2024

Number of indicators: 21

The report describes a recent campaign targeting Apache RocketMQ platforms, where attackers exploited a known vulnerability (CVE-…

Published: June 4, 2024

Number of indicators: 10

A sophisticated multi-stage cyberattack was identified, utilizing an Excel file embedded with a VBA macro designed to deploy a DL…

Published: May 30, 2024

Number of indicators: 11

The report analyzes a campaign where threat actors distribute various malware strains like RATs, coinminers, and loaders disguise…

Published: May 21, 2024

Number of indicators: 29

This comprehensive analysis delves into the continuous evolution and refinement of sophisticated malware entities employed by a p…

Published: May 14, 2024

Number of indicators: 0

This analysis examines the infection process of the DanaBot malware, distributed through sophisticated spam emails containing mal…

Published: May 9, 2024

Number of indicators: 34

This comprehensive analysis provides a thorough examination of the REMCOS Remote Access Trojan (RAT), a prominent malware threat …

Published: May 7, 2024

Number of indicators: 11

HijackLoader, also known as IDAT Loader, is a modular malware loader capable of executing multiple payloads. It utilizes a variet…

Published: May 1, 2024

Number of indicators: 11

The report analyzes a new variant of the Adload adware that evades Apple's recent XProtect malware signature updates. Despite App…