Research reports

DAMASCENED PEACOCK

Windows, delivered via spear-phishing. DAMASCENED PEACOCK A lightweight, staged downloader targeting Windows, delivered via spear-phishing. Executive summary • DAMASCENED PEACOCK is a lightweight downloader targeting Windows. • The analysed sample was for…

MalwarePhishing

BADBAZAAR and MOONSHINE: Technical analysis and mitigations

With support from the UK Cyber League, this advisory has been jointly produced by the National Cyber Security Centre (NCSC UK) and international partners: > The Australian Cyber Security Centre, part of the Australian Signals Directorate > The Canadian Centre…

BADBAZAAR and MOONSHINE: Spyware targeting Uyghur, Taiwanese and Tibetan groups and civil society actors

Summary With support from the UK Cyber League, this advisory has been jointly produced by the National Cyber Security Centre (NCSC UK) and international partners: > The Australian Cyber Security Centre, part of the Australian Signals Directorate > The

Advisory: Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns

Updated and new research, updated vulnerabilities, security updates and revised actors. 1 Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns The Russia-based actor is targeting organisations and individuals in the UK and other…

State-sponsoredPhishing

ncsc-mar-pygmy-goat.pdf

Pygmy Goat Network Device Backdoor. Executive summary • Uses LD_PRELOAD to get loaded into /bin/sshd and hook its accept function. • Listens on a raw socket for incoming ICMP packets to trigger a connect back, or uses the hooked accept function to search for…

Malware

NCSC-MAR-Jolly-Jellyfish.pdf

• Jolly Jellyfish downloads and executes shellcode, which is hidden in legitimate bitmap image (BMP) files. • HTTP is used to download image files. • Debug information left in the samples suggest the author refers to this malware as fishmaster. Introduction…

Malware