Tag: lsass

3 Attack Reports | 0 Vulnerabilities

Attack reports

You've Got Malware: FINALDRAFT Hides in Your Drafts

While investigating REF7707, Elastic Security Labs discovered a new family of previously unknown malware that leverages Outlook as a communication channel via the Microsoft Graph API. This post-exploitation kit includes a loader, a backdoor, and multiple submodules that enable advanced post-exploit…
linux
powershell
shell
lsass
mimikatz
finaldraft
ref7707
pathloader
2025-02-14
elf
microsoft graph
outlook
elf variant
ntlm hash
pe
updatetask
Published: February 14, 2025
Downloadable IOCs: 9

China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

python
plugx
lsass
trojan
2024-06-18
sygnia
c server
shadowpad
wmiexec
virustotal
earthworm
impacket
f5 bigip
command
f5 appliance
svchost
velvet ant
wireshark
guard
protect
Published: June 18, 2024
Downloadable IOCs: 5

Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself

Following the 2023 holiday season, Akamai researchers uncovered a significant amount of highly likely malicious activity and domains purporting to be associated with the United States Postal Service (USPS). Akamai researchers compared five months of DNS traffic to the legitimate domain, usps.com, w…
powershell
cobalt strike
icedid
sharefinder
lsass
javascript file
amazon
usps
dns query
dll file
Published: April 29, 2024
Downloadable IOCs: 34
Click here to see more Attack Reports