Research reports

CISA · PDF · Added 1 Nov

Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure

Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure Summary The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and National Security Agency (

Black Hat · PDF · Added 1 Nov

bh-win-04-polak2.pdf

– Installing your provider DLL Demonstration Conclusion – Q&A IntroductionIntroduction Password capturing in general – Capture Methods Keystroke logging software Keystroke logging hardware Social Engineering Camera – Are there legitimate reasons f

Mandiant (Google) · PDF · Added 1 Nov

rpt-apt38-2018-web_v5-1.pdf

APT38 is a financially motivated North Korean regime-backed group responsible for conducting destructive attacks against financial institutions, as well as some of the world's largest cyber heists. Based on widely publicized operations alone, the group has…

st.drweb.com · PDF · Added 26 Oct

Study of a targeted attack on a Russian rail freight operator

This document is the property of Doctor Web, Ltd. (hereinafter - Doctor Web). No part of this document may be reproduced, published or transmitted in any form or by any means for any purpose other than the purchaser's personal use without proper attribution.…

FBI IC3 · PDF · Added 25 Oct

241010.pdf

To report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office. When available, please include the following information regarding the incident: date, time, and location of the…

Recorded Future · PDF · Added 25 Oct

GreenCharlie Infrastructure Linked to US Political Campaign Targeting

GreenCharlie’s victimology includes research and policy analysts, government officials, diplomats, and high-value strategic targets. GreenCharlie highly likely operates at the behest of the Islamic Revolutionary Guard Corps’ Intelligence Organization…

ESET · PDF · Added 25 Oct

cyberespionage-gamaredon-way.pdf

ESET · PDF · Added 25 Oct

ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilities

IRAN-ALIGNED CYBERATTACKS: RISE IN DISRUPTIVE OPERATIONS October 2023 – March 2024 Report ESET APT ACTIVITY REPORT OCTOBER 2023 - MARCH 2024 | 2 Contents Executive summary� 3 Attackers and targets� 4 China-aligned groups � 5 Mustang Panda targets the cargo…

FBI IC3 · PDF · Added 25 Oct

240918.pdf

To report suspicious or criminal activity related to information found in this joint Cybersecurity Advisory, contact your local FBI field office. When available, please include the following information regarding the incident: date, time, and location of the…

dd80b675424c132b90b3-e48385e382d2e5d17821a5e1d8e4c86b.ssl.cf1.rackcdn.com · PDF · Added 25 Oct

2024-10-01-security-advisory.pdf

North Korean intelligence services carry out offensive cyber operations worldwide to obtain foreign currency. In this context, undercover IT specialists (IT workers) are offering their services to companies around the globe via remote work. The proceeds…

knowbe4.com · PDF · Added 25 Oct

North Korean Fake Employees Are Everywhere: How to Protect Your Organization

Signs of a North Korean Fake Employee 15 How To Protect Your Organization 17 Summary 19 It is likely that thou

hitcon.org · PDF · Added 24 Oct

Pirates_of_The_Nang_Hai_Follow_the_Artifacts_of_Tropic_Trooper,_No_One_Knows.pdf

ITOCHU Cyber & Intelligence inc. Who are we? Company: ITOCHU Cyber & Intelligence Inc. Suguru Ishimaru Sr. Cybersecurity Researcher HITCON 2021, 2019, 2017 and 2016 Yusuke Niwa Lead Cybersecurity Researcher VB2023, Botconf, JSAC etc. 2 Motohiko Sato X:…

hitcon.org · PDF · Added 12 Oct

Sailing_the_Seven_SEAs_Deep_Dive_into_Polaris_Arsenal_and_Intelligence_Insights.pdf

◆ Interested in... ◆ Windows internals ◆ .NET ◆ Anything and everything! AGENDA whoami01 Arsenal Overview03 Malware Overview04 Introduction02 Changes05 Summary / Findings06 Introduction ◆Chinese-based APT group active since 2011 ◆Aliases ◆ Mustang Panda ◆…

Recorded Future · PDF · Added 28 Sep

Rhadamanthys Stealer Adds

Detections and preventative measures unveiled for Rhadamanthys Stealer v0.7.0 provide an effective defense against this evolving threat, offering organizations strategies to prevent data theft and strengthen security. Rhadamanthys Stealer v0.7.0 is a global…

US Department of Defense · PDF · Added 24 Sep

CSA-PRC-LINKED-ACTORS-BOTNET.PDF

To report suspicious or criminal activity related to information found in this joint Cybersecurity Advisory, contact your local FBI field office. When available, please include the following information regarding the incident: date, time, and location of the…

US Department of Justice · PDF · Added 24 Sep

redacted_24-mj-1484_signed_search_and_seizure_warrant_for_disclosure.pdf

An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Western District of Pennsylvania (identify the person or describe the property to be searched and give…

ria.ee · PDF · Added 17 Sep

Microsoft Word - tale_of_gamaredon_infection.docx

Gamaredon (Russian state sponsored) APT group has been active from 2013 and mostly known to target Ukrainian government and military officials with intention to gain access to information. Since the beginning of 2020 there are reports that APT group has taken…

Microsoft · PDF · Added 28 Aug

5bc57431-a7a9-49ad-944d-b93b7d35d0fc.pdf

Iran steps into US election 2024 with cyber-enabled influence operations A MICROSOFT THREAT INTELLIGENCE REPORT Date: August 9, 2024 Foreign malign influence concerning the 2024 US election started off slowly but has steadily picked up pace over the last six…

Dragos · PDF · Added 28 Aug

Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_.pdf

What Is the Modbus Protocol? FrostyGoop ICS Malware Capabilities Optional Command Line Execution Arguments Configuration File Modbus Network Traffic Logging Capabilities 2024 OT Cyber Attack Impacting Communities in Lviv, Ukraine Assessing the Broader Impact…

Recorded Future · PDF · Added 28 Aug

Chinese State-Sponsored RedJuliett Intensifies Taiwanese Government, Academic, and Technology Sector Cyber Espionage via Network Perimeter Exploitation

States, Rwanda, Kenya, and Djibouti. Internet-facing devices such as firewalls, load balancers, and enterprise VPNs were targeted for initial access. SQL injection and directory traversal was attempted against web and SQL applications. RedJuliett likely…