Introduction In late 2023 and early 2024, the ransomware ecosystem experienced repeated disruption of its most prolific Ransomware-as-a-Service (RaaS) groups at the hands of international Law Enforcement (LE). Alphv’s dark web data leak site was seized, then unseized, then re-seized in a December 20…
Category: Interesting Stuff
Summary Trigona ransomware is a sophisticated and evolving threat that leverages vulnerabilities, legitimate tools, and double extortion tactics to target organizations, particularly in the technology and healthcare sectors. Collaboration with other threat actors like ALPHV enhances its capabilities…
💡 Akamai security researcher Tomer Peled discovered a spoofing vulnerability in Microsoft Themes, allowing an attacker to coerce NTLM credentials. 💻 The vulnerability affects all Windows versions and was fixed in January’s Patch Tuesday 2024. 🔒 Exploiting the vulnerability requires the victim to dow…
🕵️ Akamai researchers discovered a new privilege escalation technique in Active Directory environments using the DHCP administrators group. 🛡️ The technique leverages legitimate features and doesn’t rely on any vulnerability, making it challenging to fix. 🔄 It can be used not only for privilege esca…
Experience Level required: Intermediate In this report, we will analyze the CryptNet Ransomware, starting with deobfuscating the sample and proceeding through the ransomware’s techniques: Obfuscated strings encrypted strings AES & RSA Encryption algorithms CryptNet is a NET ransomware that has b…
Sextortion scam is defined as the crime of blackmailing victims using their sensitive information to inflict great psychological distress and extort them. Victims not only suffer from immediate financial losses but also immense shock and terror, some to the point of having their daily lives severely impacted. Contents DefinitionScamming is defined…
Methodology-based scams Target-Based Scams Platform-Based Scams Online The fraudulent activities take place across online platforms. Travel Fake vacation packages which offer hidden fees or non-existent accommodations. Utility Impersonating utility companies to demand immediate payment or threaten w…
For CISA, understanding adversary behavior is often the first step in protecting networks and data. The success network defenders have in detecting and mitigating cyberattacks depends on this understanding. The MITRE ATT&CK® framework is a globally accessible knowledge base of adversary tac…
OVERVIEW: REMOTE ACCESS SOFTWARE Remote access software and tools comprise a broad array of capabilities used to maintain and improve IT, operational technology (OT), and industrial control systems (ICS) services; they allow a proactive and flexible approach for organizations to remotely oversee net…
In this report, we will analyze the MATANBUCHUS loader, a C++ malware, to determine its function and capabilities: API Hashing Stack Strings Checks number of running process PEB Traversal Anti-Sandbox techniques We’ll start with resolving APIs and decoding the strings, then proceed through the loade…
A bug bounty program is essentially a legalized hacking arrangement where organizations offer rewards to ethical hackers (also called bug bounty hunters) for discovering and reporting vulnerabilities in their software, systems, or websites. Here’s a deeper dive into how bug bounties work: Benefits f…
Microsoft 365 (formerly Office 365) is Microsoft’s cloud-based suite of productivity tools, which includes email, collaboration platforms, and office applications. All are integrated with Entra ID (referred to as Azure AD in this post) for identity and access management. M365’s centra…
The digital device that we use the most in our daily lives is mobile phone. It is used in a wide range of daily activities such as communication, searching, shopping, making payment, verifying identity, and investing. Some people do not own personal computers, but almost everyone these days have mobile phones….
The COM Hijacking technique is often utilized by threat actors and various malware families to achieve both persistence and privilege escalation in target systems. It relies on manipulating Component Object Model (COM), exploiting the core architecture of Windows that enables com…
The New Technology File System (NTFS) is a file system developed and introduced by Microsoft in 1995, It was produced to overcome some limitations and offer new features. Hard-links Improved performance, reliability, and disk space utilization Security access control lists File system journaling Her…