SVG files have been increasingly abused to smuggle malicious payloads since 2015, with use of the AutoSmuggle tool (published May 2022) enabling easy embedding of .zip archives and executables into SVG/HTML for delivery. Recent campaigns in late 2023 and early…
A Konni APT–linked campaign distributed an “attached.zip” archive containing a deceptive LNK file that executes obfuscated PowerShell to create a DOCX, drop a CAB (UHCYbG.cab), and run VBS/BAT scripts for data collection, persistence, and additional payload re…
LTair is an SRSran-based tool that emulates LTE network elements (eNodeB, core, UE) to test and demonstrate control-plane attacks over the air interface, including paging interception, identifier persistence checks, spoofed RRC connections, TAU reject-based do…
In this report, we will analyze the MATANBUCHUS loader, a C++ malware, to determine its function and capabilities: API Hashing Stack Strings Checks number of running process PEB Traversal Anti-Sandbox techniques We’ll start with resolving APIs and decoding the strings, then proceed through the loade…
DocLink Defender provides real-time protection by analyzing documents and embedded URLs, mimicking user actions to test downloads and blocking malicious content at the source. It has demonstrated defense against advanced threats like Agent Tesla and integrates…
Osquery turns the OS into a SQL database to enable cross-platform malware analysis, and this post demonstrates how to use it for macOS malware analysis (OSX/Dummy). It also compares osquery with sandboxing and walks through a real-world analysis showing how to…
GhostSec, a prominent actor within The Five Families, has evolved from hacktivism toward ransomware activity, including a twin attack with Stormous. The group promotes its own tools and a GhostLocker RaaS ecosystem, with operations spanning dark-web tutorials,…
PRESS RELEASEDENVER, March 5, 2024 – Red Canary today announced full coverage of its detection and response capabilities to include all major cloud infrastructure and platform services providers, such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). Red Canary can dete…
PRESS RELEASEHERNDON, Va., March 13, 2024 — (BUSINESS WIRE) — Expel, the leading managed detection and response (MDR) provider, today unveiled the updated version of its National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) Getting Started toolkit. The kit, which includ…
SAN FRANCISCO, March 13, 2024 — Nozomi Networks Inc. today announced a $100 million Series E funding round to help accelerate innovative cyber defenses and expand cost-efficient go-to-market expansion globally. This latest round includes investments from Mitsubishi Electric, a global leader in digit…
A new variant of StopCrypt ransomware (aka STOP) was spotted in the wild, employing a multi-stage execution process that involves shellcodes to evade security tools. […]…
Here’s what IoT device manufacturers need to know to earn a cybersecurity stamp of approval from the government….
CVE-2024-48788, like many other recent Fortinet flaws, will likely be an attractive target, especially for nation-state backed actors….
SIM swappers have adapted their attacks to steal a target’s phone number by porting it into a new eSIM card, a digital SIM stored in a rewritable chip present on many recent smartphone models. […]…
In a recent cyber incident, the Handala team has purportedly infiltrated the servers of Viber Messenger, a popular messaging platform. According to their claims, the group successfully extracted a comprehensive array of sensitive data and the source code of Viber Messenger. The volume of data compro…