Research reports

ANSSI (CERT-FR) · PDF · Added 23 May

Untitled

ESET · PDF · Added 18 May

ebury-is-alive-but-unseen.pdf

(eset):research WHITEPAPER Marc-Etienne M.Léveillé May 2024 Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain ESET | EBURY IS ALIVE BUT UNSEEN WHITEPAPER | 2 Contents Propagation� 7 Credential stuffing� 8…

threatmon.io · PDF · Added 16 May

APT44 Report

What is Kapeka Backdoor? Countries Targeted by APT44 (Sandworm) Infection Chain Backdoor Analysis Backdoor Dropper Analysis IOCs Mitre Attack Detection Mitigation Dropper Yara Rule Technical Analysis Backdoor Yara Rule 5 6 7 8 8 12 17 18 19 19 20 21 22Uncover…

1665891.fs1.hubspotusercontent-na1.net · PDF · Added 14 May

AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf

Kinsing first surfaced as a cybersecurity threat in 2019 and quickly became a widespread concern, attacking various applications globally. Despite extensive analysis by security professionals, little has changed, and as of 2024, new insights continue to…

nsfocusglobal.com · PDF · Added 3 May

Analysis-Report-on-Lorec53-Group.pdf

sophos.files.wordpress.com · PDF · Added 27 Apr

Microsoft Word - 20191216_MyKings_report_final.docx

FBI IC3 · PDF · Added 24 Apr

SVR cyber actors adapt tactics for initial cloud access

This advisory details recent tactics, techniques and procedures (TTPs) of the group commonly known as APT29, also known as Midnight Blizzard, the Dukes or Cozy Bear. The UK National Cyber Security Centre (NCSC) and international partners assess that APT29 is…

CISA · PDF · Added 24 Apr

PRC State-Sponsored Cyber Activity: Actions for Critical Infrastructure Leaders

SUMMARY This fact sheet provides an overview for executive leaders on the urgent risk posed by People’s Republic of China (PRC) state-sponsored cyber actors known as “Volt Typhoon.” CISA—along with the National Security Agency (NSA), the Federal Bureau of…

Recorded Future · PDF · Added 24 Apr

Attributing i-SOON: Private Contractor Linked to Multiple Chinese State-sponsored Groups

On February 18, 2024, an anonymous GitHub user posted a trove of leaked documents and material from Anxun Information Technology Co., Ltd. (安洵信息技术有限公司; also known as i-SOON), a China-based cybersecurity and information technology company that almost certainly…

Mandiant (Google) · PDF · Added 24 Apr

APT1: Exposing One of China’s Cyber Espionage Units

APT1: Exposing One of China’s Cyber Espionage Units | Mandiant | FireEye APT1 Exposing One of China’s Cyber Espionage Units Mandiant APT1 www.mandiant.com Contents Executive…

deepsec.net · PDF · Added 24 Apr

Who_Hid_My_Desktop_Or_Safran_Pavel_Asinovsky.pdf

CAT hCAT 4 IBM Security Who are we • IBM Security (Trusteer) Financial Malware Research Team • Or Safran • Pavel Asinovsky 5 IBM Security Remote Desktop Software • Allows remote control of a computer across the network. • Originally was used for remote…

Black Hat · PDF · Added 24 Apr

PowerPoint Presentation

– http://, ftp://, telnet://, etc. • What else is registered? – aim://, firefoxurl://, picasa://, itms://, etc. URIs – Interaction With Browsers • Developers create URI hooks in the registry for their applications • Once registered they can be accessed and…

Microsoft · PDF · Added 24 Apr

Microsoft Security Compliance and Identity

first.org · PDF · Added 24 Apr

PowerPoint Presentation

Outline • Introduction • Overview of Electron framework • Methods of abusing Electron-based applications • Selected APT cases abusing Electron-based applications − Iron Tiger (MiMi secure chat) − Unclassified (Comm100 & LiveHelp100 customer engagement…

Mandiant (Google) · PDF · Added 19 Apr

apt44-unearthing-sandworm.pdf

Gabby Roncone, Dan Black, John Wolfram, Tyler McLellan, Nick Simonian, Ryan Hall, Anton Prokopenkov, Dan Perez, Lexie Aytes, Alden Wahlstrom Acknowledgements Collaboration with companies and governments to track and mitigate threats is critical to our…

WithSecure · PDF · Added 18 Apr

WithSecure-Research-Kapeka.pdf

Kaspersky · PDF · Added 17 Apr

Common TTPs of attacks against industrial organizations. Implants for remote access

NCSC (UK) · PDF · Added 17 Apr

NCSC-MAR-Jolly-Jellyfish.pdf

• Jolly Jellyfish downloads and executes shellcode, which is hidden in legitimate bitmap image (BMP) files. • HTTP is used to download image files. • Debug information left in the samples suggest the author refers to this malware as fishmaster. Introduction…

verfassungsschutz.de · PDF · Added 17 Apr

2023-02-bfv-cyber-brief.pdf?__blob=publicationFile&v=6

Gruppierungen APT 15 und APT 31 nutzen Heimnetzwerkgeräte für staatlich gesteuerte Cyberangriffskampagnen Aktuelle Hinweise deuten auf die Bedrohung deutscher kleiner und mittelständi-scher Unternehmen (KMU) und Privathaushalte durch Cyberangriffe gegen…

CISA · PDF · Added 17 Apr

Review of the Summer 2023 Microsoft Exchange Online Intrusion