Tag: process-termination

3 Attack Reports | 0 Vulnerabilities

Attack reports

Shedding light on the ABYSSWORKER driver

The ABYSSWORKER driver is a malicious tool used in conjunction with MEDUSA ransomware to disable anti-malware systems. It employs a HEARTCRYPT-packed loader and a revoked certificate-signed driver to target and silence EDR vendors. The driver imitates a legitimate CrowdStrike Falcon driver and uses…
obfuscation
ransomware
medusa
edr
driver
heartcrypt
process termination
2025-03-20
abyssworker
file manipulation
Published: March 20, 2025
Downloadable IOCs: 2

ICS Threat Analysis: New Malware Can Kill Engineering Processes

An analysis of a public malware repository reveals a persistent presence of OT/ICS malware, with engineering workstations being a significant target. Two notable clusters were identified: Mitsubishi engineering workstation software infected with the Ramnit worm, and a new experimental malware named…
2024-12-18
ramnit
ics
engineering workstations
ot
siemens
chaya_003
discord c2
process termination
mitsubishi
Published: December 18, 2024
Downloadable IOCs: 20

Fog Ransomware – Technical Analysis

A new ransomware called Fog has been identified, affecting education and recreation centers in the United States. The threat actors gain access through compromised VPN credentials, disable Windows Defender, and deploy the ransomware. Fog is a 32-bit EXE file compiled using Microsoft Visual C/C++. I…
ransomware
windows
encryption
vpn
cryptography
2024-10-21
fog ransomware
file-encryption
multi-threading
process-termination
service-stopping
Published: October 21, 2024
Downloadable IOCs: 1
Click here to see more Attack Reports