In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2505 articles
Huntress investigated an encoded PowerShell command on a partner’s system, tracing it to an SSH reverse shell and scheduled-task persistence. The process lineage pointed to the partner’s ScreenConnect instance.
Huntress documented NPPSPY deployed during an intrusion to capture cleartext credentials via a malicious Windows network provider. The investigation details the configuration, detection opportunities, and remediation.
Wiz researchers describe PostgreSQL service flaws in Google Cloud and Azure that enabled operating-system command execution. They report escalating access in Google Cloud and achieving cross-tenant database access in Azure.
Wiz researchers explain how CVE-2022-29149 let attackers predict OMI’s time-seeded secretString, forge privileged messages, and escalate to root. OMI versions before 1.6.9-1 are affected; Microsoft recommends updating.
Talos describes a Qakbot campaign that used old email threads likely harvested during ProxyLogon compromises to craft phishing emails, and outlines indicators that distinguish this external thread hijacking from attacks using a victim’s own email system.
Huntress describes tracing an intrusion to brute-forcing of an internet-facing SQL server, then using Defender alerts, EDR data and server logs to investigate a malicious script that added antivirus exclusions.
Talos detailed an AvosLocker campaign that exploited vulnerable VMware Horizon gateways affected by Log4Shell, then used tools including Sliver, Cobalt Strike and Mimikatz to move through a victim network and encrypt files.
Huntress analyzed how malicious Office documents could invoke MSDT to execute code, including through RTF preview. The article details the exploit, detection and mitigations, and reports that a Microsoft patch was later validated for Windows 10 and 11.
Huntress examines seven defense-evasion examples, including security-tool exclusions, agent removal, obfuscated scripts, malicious LNK files, AMSI/ETW bypass, user deception and reflective loading.
Cisco Talos reports BlackByte remained active worldwide, using phishing or unpatched systems for access, then tools such as AnyDesk and LoLBins for lateral movement before deploying ransomware.
Wiz found an Azure PostgreSQL Flexible Server flaw chain enabling cross-tenant database replication via privilege escalation and certificate-authentication bypass. Microsoft patched it; public-access servers were affected, while VNet-private servers were not.
Huntress analyzed a JScript sample identified in the community as Valak, tracing registry-loaded code, C2 endpoint generation and task execution. The sample polls multiple C2 domains for commands.
DarkOwl reports darknet and Telegram offers for tax-refund fraud using stolen identities and falsified documents, alongside sales of checks stolen from mail, including checks payable to the IRS and state revenue departments.
Huntress reconstructed a BABYSHARK intrusion at a think tank linked to North Korean tradecraft. A fake Voice of America exchange delivered malicious Word macros, enabling persistence, C2 communications and nearly a year of undetected activity.
DarkOwl analyzed Ukrainian government and civilian data offered on darknet forums and services, finding no evidence it was obtained in January’s cyberattacks. The review documented exposed personal and medical data while noting uncertainty about sellers and attribution.
Huntress researchers found that changing API-hashing logic in Cobalt Strike and Metasploit shellcode evaded many tested detections. They also developed a YARA rule targeting the hashing routine rather than fixed hashes.
Huntress traced Cobalt Strike alerts to VMware Horizon servers, found web shells on exploited hosts, and recreated a trigger that ran a command. Its Process Insights EDR exposed the process tree and enabled a detector for web shell activity.
Huntress found 18 of 180 analyzed VMware Horizon servers backdoored and reported a later Log4Shell exploitation wave delivering Cobalt Strike. Process-parent analysis suggested the new deployments exploited Horizon directly, not web shells.
Wiz details how ChaosDB chained Jupyter Notebook misconfigurations to expose Azure Cosmos DB customer keys and internal infrastructure. Microsoft disabled the vulnerable feature in August 2021; researchers observed some credentials being revoked.
Talos detailed a Kimsuky campaign targeting South Korean research institutions with malicious Blogspot content that delivered modular malware for reconnaissance, file exfiltration, keylogging, and credential theft. The blogs were taken down before publication.
Cisco Talos details Tortilla’s campaign exploiting ProxyShell vulnerabilities in Microsoft Exchange to deploy Babuk, disable backups, delete shadow copies and encrypt files. The chain uses PowerShell, staged loaders and pastebin[.]pl.
Cisco Talos details SQUIRRELWAFFLE malspam campaigns that use stolen email threads and malicious Office documents to infect systems, then deliver Qakbot or Cobalt Strike. The article analyzes the loader, C2, and evasion methods.
Cisco Talos details a campaign targeting Afghan and Indian entities with malicious documents exploiting CVE-2017-11882, custom document infectors, and RATs including dcRAT, QuasarRAT and AndroRAT.
Talos found a fake Amnesty International site offering anti-Pegasus software that installs Sarwent RAT, enabling remote access, command execution and data theft. The actor’s identity and motives remain uncertain.
