Research reports

asiapacificdefencereporter.com · PDF · Added 12 Dec

Final-CRWD-2023-Threat-Hunting-Report.pdf

NOWHERE TO HIDE CROWDSTRIKE 2023 THREAT HUNTING REPORT Foreword Nearly 12 years ago, a scrappy group of technologists and security professionals came together with a simple idea: building world-class, cloud-delivered endpoint protection that leverages machine…

Virus Bulletin · PDF · Added 10 Dec

CrackedCantil-a-malware-symphony-delivered-by-cracked-software-performed-by-loaders-infostealers-ransomware-et-al.pdf

The digital landscape teems with diverse malware families, each engineered with distinct capabilities – ranging from data theft, deployment of additional malicious payloads, to destruction of data and more. Yet, beneath their varied functionalities, these…

Intrinsec · PDF · Added 26 Nov

Untitled

NCSC (UK) · PDF · Added 25 Nov

Advisory: Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns

Updated and new research, updated vulnerabilities, security updates and revised actors. 1 Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns The Russia-based actor is targeting organisations and individuals in the UK and other…

Recorded Future · PDF · Added 18 Nov

China-Nexus TAG-112 Compromises Tibetan Websites to Distribute Cobalt Strike

This campaign’s malicious infrastructure used Cloudflare for name servers, hiding the threat actor’s IP and complicating attribution — a technique increasingly observed among APT groups. TAG-112 overlaps with TAG-102 (Evasive Panda), a Chinese APT group…

Mandiant (Google) · PDF · Added 18 Nov

01-chinese-espionage-article-m-trends-2024.pdf

Endpoint detection and response (EDR) platforms have become commonplace among companies seeking to expand the visibility into endpoint activity necessary to provide a baseline of security monitoring. This increase in visibility has forced attackers to evolve…

Recorded Future · PDF · Added 15 Nov

Outmaneuvering Rhysida: How Advanced Threat Intelligence Shields Critical Infrastructure from Ransomware

Insikt Group identified Rhysida’s multi-tiered infrastructure, including typosquatted domains for SEO poisoning, payload servers, CleanUpLoader C2 servers, and higher-tier admin and Zabbix servers. This research builds on previous findings showing that…

NCSC (UK) · PDF · Added 13 Nov

ncsc-mar-pygmy-goat.pdf

Pygmy Goat Network Device Backdoor. Executive summary • Uses LD_PRELOAD to get loaded into /bin/sshd and hook its accept function. • Listens on a raw socket for incoming ICMP packets to trigger a connect back, or uses the hooked accept function to search for…

ESET · PDF · Added 13 Nov

ESET APT Activity Report Q2 2024-Q3 2024

PLATFORMS IN THE PURSUIT OF NEW PREY April 2024 – September 2024 Report ESET APT ACTIVITY REPORT APRIL 2024 - SEPTEMBER 2024 | 2 Contents Executive summary� 3 Attackers and targets� 5 China-aligned groups � 6 SoftEther VPN: A tool of choice for China-aligned…

NIST · PDF · Added 1 Nov

Security and Privacy Controls for Information Systems and Organizations

NIST Special Publication 800-53 Revision 5 Security and Privacy Controls for Information Systems and Organizations JOINT TASK FORCE This publication is available free of charge from: NIST Special Publication 800-53 Revision 5 Security and Privacy Controls for…

CrowdStrike · PDF · Added 1 Nov

2022OverWatchThreatHuntingReport.pdf

Nowhere to Hide: 2022 Falcon OverWatch Threat Hunting Report CrowdStrike 2 Executive Summary� 3 Interactive Intrusion Trends� 6 Intrusion Campaign Numbers� 6 Intrusions by Threat Type� 7 Intrusions by Industry Vertical� 8 Adversary Activity� 10 Adversary…

Black Hat · PDF · Added 1 Nov

us-19-Burke-ClickOnce-And-Youre-In-When-Appref-Ms-Abuse-Is-Operating-As-Intended-wp.pdf?_gl=1*1jv89bf*_gcl_au*NjAyMzkzMjc3LjE3MjQ4MDk4OTQ.*_ga*MTk5OTA3ODkwMC4xNzI0ODA5ODk0*_ga_K4JK67TFYV*MTcyNDgwOTg5NC4xLjEuMTcyNDgwOTk1Ny4wLjAuMA..&_ga=2.256219723.1512103758.1724809895-1999078900.1724809894

Mandiant (Google) · PDF · Added 1 Nov

Poison Ivy Malware Analysis

reinforce.awsevents.com · PDF · Added 1 Nov

TDR432_New-tactics-and-techniques-for-proactive-threat-detection.pdf

Mandiant (Google) · PDF · Added 1 Nov

apt43-report-en.pdf

2M A N D I A N T APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations APT43 Executive Summary • APT43 is a prolific cyber operator that supports the interests of the North Korean regime. The group combines moderately-sophisticated technical…

CISA · PDF · Added 1 Nov

aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf

SUMMARY The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA),

Cybereason · PDF · Added 1 Nov

THREAT ALERT - INC RANSOMWARE [NEST]

Cybereason issues Threat Alerts to inform customers of emerging impacting threats, including new ransomware actors such as the emergent group INC Ransom. Cybereason Threat Alerts summarize these threats and provide practical recommendations for protecting…

Black Hat · PDF · Added 1 Nov

ClickOnce and Youre In - BH Final

C I S A | C Y B E R S E C U R I T Y A N D I N F R A S T R U C T U R E S E C U R I T Y A G E N C Y William Joseph Burke IV 07 August 2019 CLICKONCE AND YOU’RE IN: When .appref-ms abuse is operating as intended Presenter’s Name Month Day, YearWilliam Joseph…

Mandiant (Google) · PDF · Added 1 Nov

M-Trends Report - 2020

Monetizing Ransomware 35 Crimeware as a Service 36 Threats From Within 40 4 SPECIAL REPORT M-TRE

logpoint.com · PDF · Added 1 Nov

logpoint-etpr-pikabot.pdf

In the ever-changing environment of cybersecurity threats, the introduction of sophisticated malware presents substantial challenges to enterprises globally. Pikabot, a backdoor trojan that first appeared in early 2023, is one of these threats displaying a…