Cyentia Cybersecurity Research Library

Sources
Tags
About
Sponsors
More from Cyentia

Cyentia Cybersecurity Research Library

Subscribe to the Library Newsletter

List

Library

Search the Library

Report missing? Write to us today!

The Gamaredon Group Toolset Evolution

Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. (more available)

Added: November 15, 2018

Dimnie: Hiding In Plain Sight

This post discusses the reports of open-source developers receiving malicious emails.

Added: November 15, 2018

DragonOK Updates Toolset and Targets Multiple Geographic Regions

The DragonOK group has been actively launching attacks for years. We first discussed them in April 2015 when we witnessed them targeting a number of organizations in Japan. (more available)

Added: November 15, 2018

Turla group using Neuron and Nautilus tools alongside Snake malware

This report provides new intelligence by the NCSC on two tools used by the Turla group to target the UK. It contains IOCs and signatures for detection by network defenders. (more available)

Added: November 15, 2018

PLATINUM continues to evolve, find ways to maintain invisibility

Microsoft has come across an evolution of PLATINUM’s file-transfer tool, one that uses the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for communication. (more available)

Added: November 15, 2018

Threat Group APT28 Slips Office Malware into Doc Citing NYC Terror Attack

During our monitoring of activities around the APT28 threat group, McAfee Advanced Threat Research analysts identified a malicious Word document that appears to leverage the Microsoft Office Dynamic Data Exchange (DDE) technique that has been previously reported by Advanced Threat Research. (more available)

Added: November 15, 2018

ViperRAT: The mobile APT targeting the Israeli Defense Force that should be on your radar

Using data collected from the Lookout global sensor network, the Lookout research team was able to gain unique visibility into the ViperRAT malware, including 11 new, unreported applications. (more available)

Added: November 15, 2018

KingSlayer - A Supply Chain Attack

In this Kingslayer post-mortem report, RSA Research describes a sophisticated software application supply chain attack that may have otherwise gone unnoticed by its targets. (more available)

Added: November 15, 2018

A gut feeling of old acquaintances, new tools, and a common battleground

This blog post discusses how WannaCry is a pet project of the Lazarus group.

Added: November 15, 2018

From Shamoon To Stonedrill

This report provides new insights into the Shamoon 2.0 and StoneDrill attacks, including: 1. The discovery techniques and strategies we used for Shamoon and StoneDrill. (more available)

Added: November 15, 2018

Lazarus Under The Hood

This paper is the result of forensic investigations by Kaspersky Lab at banks in two countries far apart. It reveals new modules used by Lazarus group and strongly links the tools used to attack systems supporting SWIFT to the Lazarus Group’s arsenal of lateral movement tools. (more available)

Added: November 15, 2018

Introducing WhiteBear

“As a part of our Kaspersky APT Intelligence Reporting subscription, customers received an update in mid-February 2017 on some interesting APT activity that we called WhiteBear. (more available)

Added: November 15, 2018

Breaking The Weekest Link Of The Strongest Chain

This post regards the following event - “Around July last year, more than a 100 Israeli servicemen were hit by a cunning threat actor. (more available)

Added: November 15, 2018

BlackOasis APT and new targeted attacks leveraging zeroday exploit

This post discusses the following event - “On October 10, 2017, Kaspersky Lab’s advanced exploit prevention systems identified a new Adobe Flash zero day exploit used in the wild against our customers. (more available)

Added: November 15, 2018

ChChes – Malware that Communicates with C&C Servers Using Cookie Headers

Since around October 2016, JPCERT/CC has been confirming emails that are sent to Japanese organisations with a ZIP file attachment containing executable files. (more available)

Added: November 15, 2018

Evidence Aurora Operation Still Active Part 2: More Ties Uncovered Between CCleaner Hack & Chinese Hackers

This blog post continues discussion about the CCleaner supply chain attack.

Added: November 15, 2018

Evidence Aurora Operation Still Active: Supply Chain Attack Through CCleaner

This post provides information related to supply chain infections.

Added: November 15, 2018

The Full Shamoon: How the Devastating Malware Was Inserted Into Networks

Researchers from the IBM X-Force Incident Response and Intelligence Services (IRIS) team identified a missing link in the operations of a threat actor involved in recent Shamoon malware attacks against Gulf state organizations. (more available)

Added: November 15, 2018

MM Core In-Memory Backdoor Returns as "BigBoss" and "SillyGoose"

In this blog we will detail our discovery of the next two versions of MM Core, namely “BigBoss” (2.2-LNK) and “SillyGoose” (2. (more available)

Added: November 15, 2018

FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings

In late February 2017, FireEye as a Service (FaaS) identified a spear phishing campaign that appeared to be targeting personnel involved with United States Securities and Exchange Commission (SEC) filings at various organizations. (more available)

Added: November 15, 2018

Spear Phishing Techniques Used in Attacks Targeting the Mongolian Government

FireEye recently observed a sophisticated campaign targeting individuals within the Mongolian government. Targeted individuals that enabled macros in a malicious Microsoft Word document may have been infected with Poison Ivy, a popular remote access tool (RAT) that has been used for nearly a decade for key logging, screen and video capture, file transfers, password theft, system administration, traffic relaying, and more. (more available)

Added: November 15, 2018

82
83
84
85
86

© Cyentia Institute 2024

Library updated: November 26, 2024 04:15 UTC (build 0d96069)