Research reports
1,224 reports from 387 publishers45 added in the past week
5 reports, newest added first
Added Sun 25 Oct
Bablosoft; Lowering the Barrier of Entry for Malicious Actors
Free-to-use browser automation framework creates thriving criminal community Summary Evidence suggests an increasing number of threat actor groups are making use of a free-to-use browser automation framework. The framework contains numerous features which we…
Taking Down Emotet
How Team Cymru Leveraged Visibility and Relationships to Coordinate Community Efforts On Tuesday, January 26, 2021, the number of available controllers talking like Emotet Tier 1 controllers dropped to zero. Team Cymru’s monitoring confirmed that they dropped…
Takedowns and arrests
Webinject Panel Administration: A Vantage Point into Multiple Threat Actor Campaigns
The contents of this blog were shared with Team Cymru’s community partners in the first half of 2021 and were subsequently presented by our analysts at RISE Las Vegas (September 2021). Much has been written about the role of webinjects in the evolution of…
Tracking BokBot (IcedID) Infrastructure
BokBot (also known as IcedID) started life as a banking trojan using man-in-the-browser attacks to steal credentials from online banking sessions and initiate fraudulent transactions. Over time, the operator(s) of BokBot have also developed its use as a…
Malware
MoqHao Part 1: Identifying Phishing Infrastructure
In mid-January, Twitter users @NaomiSuzuki_ and @KesaGataMe0 identified nearly 20 malicious phishing domains spoofing AEON Bank in Japan. The domains were tied to MoqHao, a malware family targeting Android OS devices, primarily in Japan, South Korea, and…
Phishing
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.