SecuriTricks - lateral movement

VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)

A critical remote code execution vulnerability (CVE-2026-1731) in BeyondTrust remote support software is being actively exploited. The flaw allows unauthenticated attackers to execute arbitrary OS commands with high privileges. Observed attacker activities include network reconnaissance, account cr…

data theft

lateral movement

webshell

sparkrat

remote code execution

Published: February 20, 2026

Linked vulnerabilities : CVE-2026-1731 (CVSS 9.9)

Downloadable IOCs: 14

Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day

UNC6201, a suspected PRC-nexus threat group, has been exploiting a zero-day vulnerability (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines since mid-2024. The group uses this flaw for lateral movement, persistent access, and deployment of malware including SLAYSTYLE, BRICKSTORM, and a new…

Published: February 18, 2026

Linked vulnerabilities : CVE-2026-22769 (CVSS 10.0)

Downloadable IOCs: 9

AI-assisted cloud intrusion achieves admin access in 8 minutes

An AWS environment was targeted in a sophisticated attack, with the threat actor gaining administrative privileges in under 10 minutes. The operation showed signs of leveraging large language models for automation and decision-making. Initial access was obtained through credentials found in public …

Published: February 4, 2026

Downloadable IOCs: 4

Interlock Ransomware: New Techniques, Same Old Tricks

The Interlock ransomware group continues to target organizations worldwide, particularly in the UK and US education sector. Unlike other ransomware groups, Interlock operates independently, developing and using their own malware. This article details a recent intrusion, highlighting the group's abi…

Published: January 30, 2026

Linked vulnerabilities : CVE-2025-61155

Downloadable IOCs: 8

Targets critical infrastructure sectors in North America

UAT-8837, assessed as a China-nexus advanced persistent threat actor, has been targeting critical infrastructure sectors in North America since 2025. The group exploits vulnerabilities, including zero-days, to gain initial access and deploys open-source tools for reconnaissance, credential harvesti…

apt

zero-day

credential harvesting

critical infrastructure

Published: January 16, 2026

Linked vulnerabilities : CVE-2025-53690

Downloadable IOCs: 29

How NTLM is being abused in 2025 cyberattacks

NTLM, a legacy authentication protocol, remains prevalent in Windows environments despite known vulnerabilities. Threat actors continue to exploit both old and newly discovered flaws in NTLM for credential theft, privilege escalation, and lateral movement. Recent vulnerabilities like CVE-2024-43451…

Published: November 26, 2025

Linked vulnerabilities : CVE-2024-43451 (CVSS 6.5), CVE-2025-24054 (CVSS 6.5), CVE-2025-24071 (CVSS 7.5), CVE-2023-38831, CVE-2025-33073 (CVSS 8.8)

Downloadable IOCs: 3

Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem

UNC1549, an Iranian-linked threat group, has been targeting aerospace, aviation, and defense industries since mid-2024. They employ sophisticated initial access techniques, including exploiting third-party relationships and targeted phishing. The group uses custom malware like TWOSTROKE, LIGHTRAIL,…

third-party compromise

Published: November 18, 2025

Downloadable IOCs: 16

Cat's Got Your Files: Lynx Ransomware

A threat actor gained initial access to a network via RDP using compromised credentials, likely obtained through an infostealer, data breach, or initial access broker. They quickly moved laterally to a domain controller, created multiple impersonation accounts with high privileges, and installed An…

network reconnaissance

Published: November 17, 2025

Downloadable IOCs: 7

Gootloader Returns: What Goodies Did They Bring?

Gootloader, a sophisticated JavaScript-based malware loader, has resurfaced with renewed activity. Used by threat actor Storm-0494, it grants access to Vanilla Tempest, which delivers various ransomware families. Recent infections have led to rapid domain controller compromises. The loader now uses…

wordpress exploitation

zeppelin

supper socks5 backdoor

Published: November 6, 2025

Downloadable IOCs: 136

Evasion and Persistence via Hidden Hyper-V Virtual Machines

This investigation uncovered new tools and techniques used by the Curly COMrades threat actor to establish covert, long-term access to victim networks. The attackers exploited Hyper-V virtualization on compromised Windows 10 machines to create hidden remote operating environments. They deployed a m…

Published: November 5, 2025

Downloadable IOCs: 4

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

A user executed a malicious JavaScript file linked to Lunar Spider, initiating a two-month intrusion. The file downloaded a Brute Ratel DLL, which then injected Latrodectus malware. The threat actor used various tools including Cobalt Strike, BackConnect, and a custom .NET backdoor for persistence …

credential-harvesting

cobalt-strike

2025-09-29

Published: September 29, 2025

Downloadable IOCs: 0

Warlock operation joins busy ransomware landscape

GOLD SALEM, also known as Warlock Group, has emerged as a significant player in the ransomware landscape since March 2025. The group has compromised networks across North America, Europe, and South America, targeting a range of organizations from small entities to large corporations. GOLD SALEM ope…

sharepoint exploitation

warlock group

Published: September 17, 2025

Linked vulnerabilities : CVE-2024-51324 (CVSS 3.8), CVE-2025-53770 (CVSS 9.8), CVE-2025-53771 (CVSS 7.1), CVE-2025-49704, CVE-2025-49706

Downloadable IOCs: 2

Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed

The Gentlemen ransomware group has emerged as a sophisticated threat actor targeting multiple industries across 17 countries, with a focus on the Asia-Pacific region. Their campaign demonstrates advanced capabilities, including the use of custom tools to bypass enterprise endpoint protections, expl…

the gentlemen ransomware

group policy manipulation

enterprise targeting

Published: September 9, 2025

Downloadable IOCs: 0

Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs

This intelligence report details a sophisticated cyber intrusion with links to three major ransomware groups: Play, RansomHub, and DragonForce. The attack began with a malicious file impersonating DeskSoft's EarthTime application, which deployed SectopRAT malware. The threat actors used various too…

multi-group affiliation

betruger

multi-group operation

Published: September 8, 2025

Downloadable IOCs: 0

ViewState Deserialization Zero-Day Vulnerability in Sitecore Products (CVE-2025-53690)

A critical ViewState deserialization vulnerability (CVE-2025-53690) was discovered in Sitecore products, affecting deployments using an exposed sample machine key. The attacker exploited this to achieve remote code execution, progressing from initial compromise to privilege escalation. Key events i…

remote code execution

Published: September 4, 2025

Downloadable IOCs: 0

From SharePoint Vulnerability Exploit to Enterprise Ransomware

The Warlock ransomware group exploited unpatched Microsoft SharePoint servers to gain initial access and deploy ransomware across enterprise environments. The attack chain involved exploiting vulnerabilities, privilege escalation through Group Policy modification, credential theft using Mimikatz, l…

Published: August 20, 2025

Downloadable IOCs: 0

SOC files: an APT41 attack on government IT services in Africa

Kaspersky's MDR team detected a targeted attack by APT41 against government IT services in Africa. The attackers used Impacket tools, Cobalt Strike, and custom agents for lateral movement and data collection. They leveraged DLL sideloading techniques and publicly available tools like Mimikatz and R…

credential harvesting

Published: August 20, 2025

Downloadable IOCs: 0

A New Threat Actor Targeting Geopolitical Hotbeds

Bitdefender Labs has uncovered a new threat actor group named Curly COMrades, operating since mid-2024 to support Russian interests. The group targets critical organizations in countries experiencing geopolitical shifts, focusing on judicial and government bodies in Georgia and an energy distributi…

Published: August 12, 2025

Downloadable IOCs: 0

From ClickFix to Command: A Full PowerShell Attack Chain

A targeted intrusion campaign impacting Israeli organizations has been identified, leveraging compromised internal email infrastructure to distribute phishing messages. The attack uses a multi-stage, PowerShell-based infection chain, culminating in the delivery of a remote access trojan (RAT). Key …

Published: August 11, 2025

Downloadable IOCs: 0

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

A sophisticated cyber attack campaign leveraged SEO poisoning to compromise organizations through trojanized IT management tool installers. The attack began when users searching for ManageEngine OpManager were directed to a malicious website, downloading a compromised MSI file that installed Bumble…

Published: August 7, 2025

Downloadable IOCs: 0

Bumblebee Malware SEO Poisoning Campaign Leads to Akira Ransomware Deployment

A coordinated threat campaign has been identified leveraging SEO poisoning to distribute Bumblebee malware via trojanized installers of IT management tools. The campaign targets users searching for legitimate software like ManageEngine OpManager. Upon execution, Bumblebee establishes initial access…

trojanized installers

2025-08-05

Published: August 5, 2025

Downloadable IOCs: 19

Active Exploitation of SonicWall VPNs

A potential zero-day vulnerability in SonicWall VPNs is being actively exploited to bypass MFA and deploy ransomware. The attack chain begins with a breach of the SonicWall appliance, followed by post-exploitation techniques including enumeration, detection evasion, lateral movement, and credential…

Published: August 4, 2025

Downloadable IOCs: 12

Hide Your RDP: Password Spray Leads to RansomHub Deployment

This report details a cyberattack where threat actors gained initial access through a password spray attack on an exposed RDP server. They used Mimikatz and Nirsoft for credential harvesting, and employed living-off-the-land techniques along with tools like Advanced IP Scanner for network discovery…

Published: June 30, 2025

Downloadable IOCs: 9

Cybercriminals Abuse Open-Source Tools To Target Africa's Financial Sector

A series of attacks targeting financial organizations across Africa has been observed since July 2023. The threat actor, tracked as CL-CRI-1014, uses open-source and publicly available tools like PoshC2, Chisel, and Classroom Spy to establish attack frameworks, create tunnels for network communicat…

Published: June 26, 2025

Downloadable IOCs: 32

Fog Ransomware: Unusual Toolset Used in Recent Attack

A financial institution in Asia was targeted by Fog ransomware in May 2025, using an atypical toolset including legitimate employee monitoring software and open-source pentesting tools. The attackers deployed Syteca, GC2, Adaptix, and Stowaway, which are uncommon in ransomware attacks. They remaine…

employee monitoring software

financial institution

pentesting tools

2025-06-17

Published: June 17, 2025

Linked vulnerabilities : CVE-2024-40711 (CVSS 9.8)

Downloadable IOCs: 0

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

TheWizards, a China-aligned threat actor, employs Spellbinder, a lateral movement tool that enables adversary-in-the-middle attacks through IPv6 SLAAC spoofing. This technique allows the group to intercept network traffic and redirect legitimate Chinese software updates to malicious servers. The at…

china

lateral movement

adversary-in-the-middle

2025-04-30

software update hijacking

Published: May 9, 2025

Downloadable IOCs: 8

Investigating Iranian Intrusion into Strategic Middle East Critical Infrastructure

This report details a prolonged Iranian state-sponsored intrusion into critical national infrastructure in the Middle East from May 2023 to February 2025. The threat actors employed various tactics including web shells, custom malware, and legitimate tools to maintain persistent access across multi…

apt

credential harvesting

critical infrastructure

Published: May 6, 2025

Downloadable IOCs: 35

Nitrogen Dropping Cobalt Strike – A Combination of 'Chemical Elements'

The Nitrogen ransomware group has expanded its operations from North America to Africa and Europe since September 2024. They utilize malvertising tactics, disguising malicious payloads as legitimate software like WinSCP. The group employs DLL sideloading for initial access, followed by Cobalt Strik…

Published: May 2, 2025

Downloadable IOCs: 2

Navigating Through The Fog

An open directory linked to a Fog ransomware affiliate was discovered, containing tools for reconnaissance, exploitation, lateral movement, and persistence. Initial access was gained through compromised SonicWall VPN credentials, while other tools facilitated credential theft and exploitation of Ac…

Published: April 28, 2025

Linked vulnerabilities : CVE-2021-42287, CVE-2021-42278, CVE-2020-1472

Downloadable IOCs: 1

Fake Zoom Ends in BlackSuit Ransomware

A malicious website mimicking Zoom led to the installation of a trojanized installer, initiating a multi-stage attack. The initial payload, d3f@ckloader, downloaded additional components, including SectopRAT. After nine days, the threat actor deployed Brute Ratel and Cobalt Strike beacons for later…

Published: March 31, 2025

Downloadable IOCs: 0

Weaver Ant, the Web Shell Whisperer: Tracking a China-Nexus Cyber Operation

Sygnia uncovered a sophisticated China-nexus threat actor, Weaver Ant, targeting a major Asian telecom company. The group employed web shells and tunneling techniques for persistence and lateral movement, maintaining access for over four years. They utilized encrypted China Chopper and custom 'INMe…

Published: March 25, 2025

Downloadable IOCs: 1

New Ransomware Operator Exploits Fortinet Vulnerability Duo

A new ransomware operator, dubbed Mora_001, has been exploiting Fortinet firewall vulnerabilities CVE-2024-55591 and CVE-2025-24472 to gain unauthorized access and deploy a modified version of LockBit ransomware. The threat actor creates persistent admin accounts, exfiltrates firewall configuration…

Published: March 14, 2025

Downloadable IOCs: 23

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal

The Black Basta and Cactus ransomware groups have incorporated BackConnect malware into their attack strategies to maintain persistent control over compromised systems. The attackers use social engineering tactics, including email flooding and impersonation of IT support, to gain initial access. Th…

onedrive exploitation

Published: March 3, 2025

Downloadable IOCs: 0

Confluence Exploit Leads to LockBit Ransomware

An intrusion began with the exploitation of CVE-2023-22527 on an exposed Windows Confluence server, leading to LockBit ransomware deployment across the environment. The threat actor utilized various tools including Mimikatz, Metasploit, and AnyDesk. They leveraged RDP for lateral movement and deplo…

Published: February 24, 2025

Linked vulnerabilities : CVE-2017-0199, CVE-2023-22515, CVE-2023-22527, CVE-2023-22518

Downloadable IOCs: 15

Not-so-SimpleHelp exploits enabling deployment of Sliver backdoor

A sophisticated breach was identified where threat actors exploited vulnerabilities in SimpleHelp's Remote Monitoring and Management client to infiltrate a network. The attack involved post-compromise tactics including network discovery, administrator account creation, and persistence establishment…

Published: February 7, 2025

Downloadable IOCs: 6

Analysis of Interlock Ransomware Attack on Healthcare Facilities

The Interlock ransomware group has been actively targeting healthcare facilities in the United States, causing significant disruptions and exposing sensitive patient data. The attacks involve drive-by compromise techniques, using fake software updaters to deploy malware. The group employs double-ex…

Published: January 28, 2025

Downloadable IOCs: 0

Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware

This report details an intrusion that began with the execution of a Cobalt Strike beacon masquerading as a Windows Media Configuration Utility. The threat actor used various tools for persistence, lateral movement, and data exfiltration, including SystemBC and GhostSOCKS proxies, Rclone, and PsExec…

Published: January 27, 2025

Downloadable IOCs: 21

RansomHub Affiliate leverages Python-based backdoor

A threat actor utilized a Python-based backdoor to maintain access to compromised endpoints, later deploying RansomHub encryptors across the impacted network. The malware, an updated version of a previously documented backdoor, features obfuscation, deployment via RDP, and unique indicators of comp…

Published: January 16, 2025

Downloadable IOCs: 6

Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

A recent campaign targeting Fortinet FortiGate firewall devices with exposed management interfaces has been observed. The threat actors gained unauthorized access to the firewalls' administrative controls, created new accounts, established SSL VPN connections, and made various configuration changes…

zero-day

lateral movement

fortigate

vulnerability scanning

Published: January 11, 2025

Downloadable IOCs: 0

Attackers exploiting a FortiClient EMS vulnerability in the wild

Kaspersky's GERT team identified an attack exploiting a patched vulnerability (CVE-2023-48788) in FortiClient EMS versions 7.0.1 to 7.0.10 and 7.2.0 to 7.2.2. The attackers used SQL injection to infiltrate a company's network through an exposed Windows server. They deployed remote access tools like…

Published: December 19, 2024

Downloadable IOCs: 0

U.S. Organization in China Targeted by Attackers

A large U.S. entity with significant operations in China faced a four-month-long cyber intrusion, likely conducted by a China-based threat actor. The attackers obtained persistent network access, laterally moved across systems, compromised Exchange servers to harvest emails, and deployed exfiltrati…

Published: December 6, 2024

Downloadable IOCs: 13

The Curious Case of an Excellent Resume

This report details a malicious campaign where the threat actor gained initial access through a resume lure as part of a TA4557/FIN6 operation. The actor employed techniques like abusing legitimate binaries, establishing Cobalt Strike and Pyramid C2, exploiting CVE-2023-27532 for lateral movement, …

Published: December 4, 2024

Linked vulnerabilities : CVE-2023-27532

Downloadable IOCs: 20

Know Thy Enemy: A Novel November Case on Persistent Remote Access

In early November 2024, a threat actor gained initial access to a network via brute-forcing a public-facing RD-Web instance. Using PsExec, they executed batch files across multiple machines to enable RDP connections and install a malicious MeshAgent. The actor renamed the MeshAgent to mimic a virtu…

Published: November 26, 2024

Downloadable IOCs: 6

Threat Assessment: Distributors of BlackSuit Ransomware

Ignoble Scorpius, previously known as Royal ransomware, has rebranded as BlackSuit ransomware and increased its activity since March 2024. The group has targeted at least 93 victims globally, with a focus on the construction and manufacturing industries. Their initial ransom demands average 1.6% of…

Published: November 20, 2024

Downloadable IOCs: 2

Dissecting A Multi-Stage PowerShell Campaign Using Chisel

A sophisticated multi-stage PowerShell campaign has been identified, utilizing an LNK file to initiate a sequence of obfuscated scripts. The attack maintains persistence and stealth by connecting with a command-and-control server. It employs Chisel, a fast TCP/UDP tunneling tool, and a Netskope pro…

Published: November 12, 2024

Downloadable IOCs: 17

QSC: new modular framework in CloudComputating campaigns

Kaspersky researchers discovered QSC, a multi-plugin malware framework used by the CloudComputating group in cyber espionage campaigns. QSC consists of a Loader, Core module, Network module, File Manager module, and Command Shell module, allowing attackers to load specific plugins on demand. The fr…

Published: November 8, 2024

Downloadable IOCs: 0

Investigating a SharePoint Compromise: IR Tales from the Field

An incident response investigation uncovered an attacker who exploited a SharePoint vulnerability (CVE-2024-38094) to gain initial access. The attacker remained undetected for two weeks, moving laterally across the network and compromising the entire domain. Key tactics included installing Horoung …

credential harvesting

fast reverse proxy (frp)

Published: November 5, 2024

Downloadable IOCs: 8

Understanding the Initial Stages of Web Shell and VPN Threats: An MXDR Analysis

This analysis examines two cybersecurity incidents: a web shell attack and a VPN compromise. The web shell attack involved uploading malicious files to a server, executing commands, creating a local admin account, and attempting to establish persistence. The VPN compromise led to lateral movement, …

Published: October 24, 2024

Linked vulnerabilities : CVE-2020-1472

Downloadable IOCs: 1

Unmasking Prometei: A Deep Dive Into MXDR Findings

This analysis examines the Prometei botnet's infiltration of a customer's system through a targeted brute force attack. Leveraging Trend Vision One, the investigation traced the botnet's detailed installation routine and stealthy tactics. Prometei, a modular malware family used for cryptocurrency m…

cryptocurrency mining

Published: October 23, 2024

Downloadable IOCs: 0

Analyzing the familiar tools used by the Crypt Ghouls hacktivists

The Crypt Ghouls group is targeting Russian businesses and government agencies with ransomware attacks. They utilize a toolkit including utilities like Mimikatz, XenAllPasswordPro, PingCastle, and others. The group employs LockBit 3.0 and Babuk ransomware as final payloads. Initial access is often …

credential harvesting

Published: October 18, 2024

Downloadable IOCs: 1

Threat actor believed to be spreading new MedusaLocker variant since 2022

A financially motivated threat actor has been active since 2022, delivering a MedusaLocker ransomware variant called 'BabyLockerKZ'. The group targets organizations worldwide, with a focus shift from EU countries to South American countries in mid-2023. The actor uses a combination of publicly know…

financially motivated

2024-10-04

babylockerkz

medusalocker

Published: October 4, 2024

Downloadable IOCs: 11

Threat Brief: Understanding Akira Ransomware

Akira is a prolific ransomware operating since March 2023, targeting multiple industries in North America, the UK, and Australia. It functions as Ransomware as a Service (RaaS) and employs double extortion tactics. Akira has connections to the disbanded Conti group, sharing code similarities and op…

Published: October 4, 2024

Linked vulnerabilities : CVE-2023-20269, CVE-2021-21972, CVE-2019-6693, CVE-2022-40684

Downloadable IOCs: 3

Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware

A BlackCat ransomware intrusion began with a Nitrogen malware campaign impersonating Advanced IP Scanner. The attackers used Sliver and Cobalt Strike beacons for post-exploitation, leveraging Python scripts for memory loading. They performed network enumeration using various tools and moved lateral…

credential harvesting

Published: October 1, 2024

Downloadable IOCs: 45

Storm-0501: Ransomware attacks expanding to hybrid cloud environments

Microsoft has observed Storm-0501, a financially motivated cybercriminal group, conducting multi-staged attacks targeting hybrid cloud environments. The group compromises on-premises networks, performs lateral movement to cloud environments, exfiltrates data, steals credentials, creates persistent …

Published: September 30, 2024

Linked vulnerabilities : CVE-2023-4966, CVE-2023-38203, CVE-2023-29300, CVE-2022-47966

Downloadable IOCs: 14

Hadooken Malware Targets Weblogic Applications

Aqua Nautilus researchers identified a Linux malware, named Hadooken, targeting Oracle WebLogic servers. Upon gaining initial access through an exploited weak password, Hadooken deploys a cryptominer and the Tsunami malware. The report details the attack flow, techniques employed by the threat acto…

Published: September 13, 2024

Downloadable IOCs: 4

StopRansomware: RansomHub Ransomware

RansomHub is a ransomware-as-a-service variant that has targeted over 210 victims across various critical infrastructure sectors since February 2024. It employs a double-extortion model, encrypting systems and exfiltrating data. The ransom note provides victims with a client ID and instructions to …

ransomware-as-a-service

critical-infrastructure

CVE-2020-0787

lateral-movement

Published: August 30, 2024

Linked vulnerabilities : CVE-2020-1472, CVE-2023-46604, CVE-2023-22515, CVE-2020-0787, CVE-2017-0144, CVE-2023-3519, CVE-2023-27997, CVE-2023-48788, CVE-2023-46747

Downloadable IOCs: 14

BlackSuit Ransomware

The report meticulously chronicles a sophisticated intrusion which began in December 2023 and culminated in the deployment of BlackSuit ransomware approximately 15 days later. The threat actor demonstrated an array of tactics, leveraging tools like Cobalt Strike, Sharphound, and SystemBC, alongside…

Published: August 27, 2024

Downloadable IOCs: 16

CheckMesh: Hidden Threats in Your FW

This report examines an advanced cyber-attack targeting an Israeli enterprise, where a sophisticated threat actor compromised a Check Point firewall by deploying a malicious ELF implant known as MeshAgent. The implant, disguised as a legitimate process, enabled encrypted communication with the atta…

encrypted communication

advanced persistent threat

firewall compromise

Published: August 5, 2024

Downloadable IOCs: 9

BITS and Bytes: Analyzing BITSLOTH, a newly identified backdoor

Elastic Security Labs uncovered a new Windows backdoor called BITSLOTH that utilizes the Background Intelligent Transfer Service (BITS) for command-and-control communication. This malware, discovered during an intrusion into a South American government's Foreign Ministry, possesses capabilities for…

Published: August 2, 2024

Downloadable IOCs: 8

Lost in the Fog: A New Ransomware Threat

Arctic Wolf Labs began monitoring the deployment of a new ransomware variant called Fog in early May 2024. The ransomware attacks targeted organizations in the education and recreation sectors within the United States. Evidence suggests threat actors gained initial access through compromised VPN cr…

Published: June 7, 2024

Linked vulnerabilities : CVE-2024-4358 (CVSS 9.8), CVE-2024-1800

Downloadable IOCs: 5

Operation Crimson Palace: A Technical Deep Dive

Sophos Managed Detection and Response initiated a threat hunt across customers after detecting abuse of a vulnerable VMware executable. The hunt uncovered a complex, persistent cyberespionage campaign by Chinese state-sponsored actors targeting a high-profile government organization in Southeast As…

Published: June 6, 2024

Downloadable IOCs: 138

Technical Deep Dive: Understanding the Anatomy of a Cyber Intrusion

This report details a sophisticated cyber intrusion targeting MITRE's research network (NERVE) through the exploitation of Ivanti Connect Secure zero-day vulnerabilities. The threat actor, suspected to be UNC5221, initiated the attack by gaining unauthorized access and subsequently deploying variou…

Published: May 24, 2024

Downloadable IOCs: 4

Tag: lateral movement

Attack reports

Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack

Targets Education Sector with Oracle PeopleSoft Exploit

Ransomware Analysis: Go Binary and Fast Encryption

Multi-Stage Malware Execution Chain Analysis

VECT: Ransomware by design, Wiper by accident

The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

Using KATA and KEDR to detect the AdaptixC2 agent

An Overview of The Gentlemen's TTPs

Beast Ransomware Toolkit: A Proactive Threat Intelligence Report

Casting a Wider Net: Scaling Threat

Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack

Stolen Service Accounts Lead to Rogue Workstations and Deep AD Compromise

Fake Tech Support Delivers Havoc Command & Control

Signed malware impersonating workplace apps deploys RMM backdoors

Nefilim Ransomware

Apache ActiveMQ Exploit Leads to LockBit Ransomware

VShell and SparkRAT Observed in Exploitation of BeyondTrust Critical Vulnerability (CVE-2026-1731)

Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day

AI-assisted cloud intrusion achieves admin access in 8 minutes

Interlock Ransomware: New Techniques, Same Old Tricks

Targets critical infrastructure sectors in North America

How NTLM is being abused in 2025 cyberattacks

Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem

Cat's Got Your Files: Lynx Ransomware

Gootloader Returns: What Goodies Did They Bring?

Evasion and Persistence via Hidden Hyper-V Virtual Machines

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

Warlock operation joins busy ransomware landscape

Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed

Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs

ViewState Deserialization Zero-Day Vulnerability in Sitecore Products (CVE-2025-53690)

From SharePoint Vulnerability Exploit to Enterprise Ransomware

SOC files: an APT41 attack on government IT services in Africa

A New Threat Actor Targeting Geopolitical Hotbeds

From ClickFix to Command: A Full PowerShell Attack Chain

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

Bumblebee Malware SEO Poisoning Campaign Leads to Akira Ransomware Deployment

Active Exploitation of SonicWall VPNs

Hide Your RDP: Password Spray Leads to RansomHub Deployment

Cybercriminals Abuse Open-Source Tools To Target Africa's Financial Sector

Fog Ransomware: Unusual Toolset Used in Recent Attack

TheWizards APT group uses SLAAC spoofing to perform adversary-in-the-middle attacks

Investigating Iranian Intrusion into Strategic Middle East Critical Infrastructure

Nitrogen Dropping Cobalt Strike – A Combination of 'Chemical Elements'

Navigating Through The Fog

Fake Zoom Ends in BlackSuit Ransomware

Weaver Ant, the Web Shell Whisperer: Tracking a China-Nexus Cyber Operation

New Ransomware Operator Exploits Fortinet Vulnerability Duo

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal

Confluence Exploit Leads to LockBit Ransomware

Not-so-SimpleHelp exploits enabling deployment of Sliver backdoor

Analysis of Interlock Ransomware Attack on Healthcare Facilities

Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware

RansomHub Affiliate leverages Python-based backdoor

Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

Attackers exploiting a FortiClient EMS vulnerability in the wild

U.S. Organization in China Targeted by Attackers

The Curious Case of an Excellent Resume

Know Thy Enemy: A Novel November Case on Persistent Remote Access

Threat Assessment: Distributors of BlackSuit Ransomware

Dissecting A Multi-Stage PowerShell Campaign Using Chisel

QSC: new modular framework in CloudComputating campaigns

Investigating a SharePoint Compromise: IR Tales from the Field

Understanding the Initial Stages of Web Shell and VPN Threats: An MXDR Analysis

Unmasking Prometei: A Deep Dive Into MXDR Findings

Analyzing the familiar tools used by the Crypt Ghouls hacktivists

Threat actor believed to be spreading new MedusaLocker variant since 2022

Threat Brief: Understanding Akira Ransomware

Nitrogen Campaign Drops Sliver and Ends With BlackCat Ransomware

Storm-0501: Ransomware attacks expanding to hybrid cloud environments

Hadooken Malware Targets Weblogic Applications

StopRansomware: RansomHub Ransomware

BlackSuit Ransomware

CheckMesh: Hidden Threats in Your FW

BITS and Bytes: Analyzing BITSLOTH, a newly identified backdoor

Lost in the Fog: A New Ransomware Threat

Operation Crimson Palace: A Technical Deep Dive

Technical Deep Dive: Understanding the Anatomy of a Cyber Intrusion