Research reports

Bablosoft; Lowering the Barrier of Entry for Malicious Actors

Free-to-use browser automation framework creates thriving criminal community Summary Evidence suggests an increasing number of threat actor groups are making use of a free-to-use browser automation framework. The framework contains numerous features which we…

Taking Down Emotet

How Team Cymru Leveraged Visibility and Relationships to Coordinate Community Efforts On Tuesday, January 26, 2021, the number of available controllers talking like Emotet Tier 1 controllers dropped to zero. Team Cymru’s monitoring confirmed that they dropped…

Takedowns and arrests

Webinject Panel Administration: A Vantage Point into Multiple Threat Actor Campaigns

The contents of this blog were shared with Team Cymru’s community partners in the first half of 2021 and were subsequently presented by our analysts at RISE Las Vegas (September 2021). Much has been written about the role of webinjects in the evolution of…

Tracking BokBot (IcedID) Infrastructure

BokBot (also known as IcedID) started life as a banking trojan using man-in-the-browser attacks to steal credentials from online banking sessions and initiate fraudulent transactions. Over time, the operator(s) of BokBot have also developed its use as a…

Malware

MoqHao Part 1: Identifying Phishing Infrastructure

In mid-January, Twitter users @NaomiSuzuki_ and @KesaGataMe0 identified nearly 20 malicious phishing domains spoofing AEON Bank in Japan. The domains were tied to MoqHao, a malware family targeting Android OS devices, primarily in Japan, South Korea, and…

Phishing

FIN8: BADHATCH Threat Indicator Enrichment

FIN8 research identifies ongoing campaigns against entities in Germany, Sweden and the US. Last week (10 March 2021), Bitdefender released a whitepaper on the recent activities of the FIN8 threat actor group, focusing particularly on their BADHATCH…