Tag: evasion
26 attack reports | 0 vulnerabilities
Attack reports
Published: October 4, 2024
Number of indicators: 9
A sophisticated Linux malware named 'perfctl' has been actively targeting millions of servers worldwide for the past 3-4 years. I…
Published: October 3, 2024
Number of indicators: 8
The report details sophisticated command and control (C2) techniques employed by the APT41 threat group. APT41 uses custom malwar…
Published: September 16, 2024
Number of indicators: 6
This comprehensive report analyzes Gomorrah Stealer, a sophisticated malware designed to exfiltrate sensitive information from co…
Published: September 10, 2024
Number of indicators: 11
The report provides insights into the evolving tactics and infrastructure of a threat group referred to as the 'Quad7 botnet oper…
Published: September 10, 2024
Number of indicators: 0
The report provides insights into the evolving tactics and infrastructure of a threat group referred to as the 'Quad7 botnet oper…
Published: August 30, 2024
Number of indicators: 5
Cybercriminals are employing a sophisticated two-stage malware campaign masquerading as the Palo Alto GlobalProtect tool to infil…
Published: August 28, 2024
Number of indicators: 13
Seqrite Labs APT-Team discovered a sophisticated malware campaign targeting government and military officials in the Czech Republ…
Published: August 23, 2024
Number of indicators: 3
Stroz Friedberg discovered sedexp, a stealthy Linux malware that utilizes udev rules to achieve persistence and evade detection. …
Published: August 16, 2024
Number of indicators: 68
Kaspersky has uncovered a complex malware campaign orchestrated by Russian-speaking cybercriminals. The threat actors create sub-…
Published: August 12, 2024
Number of indicators: 32
An investigation by The DFIR report revealed a collection of batch scripts designed for defense evasion and executing command-and…
Published: August 5, 2024
Number of indicators: 5
This comprehensive technical analysis delves into the intricate workings of an advanced and localized malware campaign employing …
Published: July 31, 2024
Number of indicators: 6
This analysis examines a recent malware campaign involving a dropper dubbed Gh0stGambit, which is employed to retrieve and execut…
Published: July 24, 2024
Number of indicators: 27
This report details a malicious campaign exploiting the CVE-2024-21412 vulnerability in Microsoft Windows SmartScreen to bypass s…
Published: July 12, 2024
Number of indicators: 3
This blog post examines MoonWalk, a new backdoor employed by APT41, a China-based threat actor known for campaigns in Southeast A…
Published: July 11, 2024
Number of indicators: 1
This blog post provides an in-depth technical analysis of a newly discovered malware loader called DodgeBox, which is attributed …
Published: July 8, 2024
Number of indicators: 10
This report details a recent campaign by the Turla threat group involving malicious LNK files that deliver a fileless backdoor. T…
Published: July 4, 2024
Number of indicators: 2
This article demonstrates how to circumvent anti-analysis techniques employed by GootLoader malware while utilizing Node.js debug…
Published: June 26, 2024
Number of indicators: 6
This report discusses recent findings of malicious Cobalt Strike infrastructure and malicious Cobalt Strike samples that leverage…
Published: June 6, 2024
Number of indicators: 21
The report describes a recent campaign targeting Apache RocketMQ platforms, where attackers exploited a known vulnerability (CVE-…
Published: June 4, 2024
Number of indicators: 10
A sophisticated multi-stage cyberattack was identified, utilizing an Excel file embedded with a VBA macro designed to deploy a DL…
Published: May 30, 2024
Number of indicators: 11
The report analyzes a campaign where threat actors distribute various malware strains like RATs, coinminers, and loaders disguise…
Published: May 21, 2024
Number of indicators: 29
This comprehensive analysis delves into the continuous evolution and refinement of sophisticated malware entities employed by a p…
Published: May 14, 2024
Number of indicators: 0
This analysis examines the infection process of the DanaBot malware, distributed through sophisticated spam emails containing mal…
Published: May 9, 2024
Number of indicators: 34
This comprehensive analysis provides a thorough examination of the REMCOS Remote Access Trojan (RAT), a prominent malware threat …
Published: May 7, 2024
Number of indicators: 11
HijackLoader, also known as IDAT Loader, is a modular malware loader capable of executing multiple payloads. It utilizes a variet…