In-depth analysis of malware, threat actors, attack campaigns, techniques, and emerging cyber threats.
2509 articles
Huntress analysts traced a suspicious .NET executable that compiled and loaded a DLL, extracted a payload disguised as an embedded image, and concealed malware capabilities including password theft and keylogging.
Huntress reported widespread exploitation of on-premises Exchange flaws, finding 350+ webshells across roughly 3,000 servers. Its analysis traced multi-stage PowerShell payloads, persistence, and suspected Mimikatz activity; Microsoft had issued emergency patches.
Huntress traces a PowerShell payload launched from a registry Run key through base64 and gzip layers to shellcode that uses VirtualAlloc and CreateThread and loads WinInet, indicating downloader behavior.
Huntress traced a Windows persistence mechanism to VBS/Satoban.A: a service used a Windows XP svchost.exe copy to launch an encoded VBScript, revealing malware behaviors including USB spreading, downloads, and shadow-volume deletion.
Huntress analyzed a TrickBot v100 launcher that uses Windows batch variables to obscure a command. The article explains how the script reconstructs a command to start the malware executable and why the obfuscation may challenge automated detection.
Huntress analyzed multi-stage malware that used obfuscated PowerShell and DNS-over-HTTPS TXT records to conceal data, select external servers, and retrieve a final payload.
Huntress analyzed a malware foothold that mimicked a legitimate Windows task, used renamed mshta and PowerShell executables, and concealed commands in a fake log file. The payload could bypass AMSI and collect host information.
DarkOwl’s analysis of leaked SyTech documents describes Russia’s HOPE project to monitor and route internet traffic, and finds similarities to the Sovereign Internet Law. The documents indicate prototype-scale work; a direct link remains unproven.
Huntress analyzes malware launched by a LNK file that uses mshta.exe and obfuscated PowerShell to retrieve and execute staged payloads, collect system and security-software details, and communicate with remote servers.
Huntress describes attackers using trusted Windows utilities and scripts to evade process analysis, execute payloads, and establish persistence through logon mechanisms and scheduled tasks.
Huntress analyzed a PowerShell payload that used registry-stored scripts and disguised scheduled tasks to persist. Attackers later changed registry paths and task behavior to evade Kaseya’s removal procedure; Dropbox removed identified malicious files.
Huntress reconstructs an MSSQL breach in which attackers brute-forced credentials, used xp_cmdshell to disable antivirus and download malware, then created registry and service persistence.
Huntress analyzed a packed Redosdru dropper that downloaded an encrypted DLL, decrypted it in memory, and exposed capabilities including keylogging, clipboard harvesting, and user and group management.
