Month: September 2021

While investigating a recent rise of attacks against Exchange servers, we noticed a recurring cluster of activity that appeared in several distinct compromised networks. With a long-standing operation, high profile victims, advanced toolset and no affinity to a known threat actor, we decided to dub the cluster GhostEmperor.

2024
2023
2022
2021
2020
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008
2007
2006
2005
2004
2003
2002
2001

Authors Categories Tags

Reports

Lazarus targets employees of a nuclear-related organization with a bunch of malware, such as MISTPEN, LPEClient, RollMid, CookieTime and a new modular backdoor CookiePlus.

Kaspersky researchers analyze 2019, 2022 and 2024 attacks attributed to Careto APT with medium to high confidence.

The report features the most significant developments relating to APT groups in Q3 2024, including hacktivist activity, new APT tools and campaigns.

Kaspersky analyzes SideWinder APT’s recent activity: new targets in the MiddleEast and Africa, post-exploitation tools and techniques.

September 2021

GhostEmperor: From ProxyLogon to kernel mode

DarkHalo after SolarWinds: the Tomiris connection

FinSpy: unseen findings

BloodyStealer and gaming assets for sale

Wake me up till SAS summit ends

Detection evasion in CLR and tips on how to detect such attacks

Exploitation of the CVE-2021-40444 vulnerability in MSHTML

Summer 2021: Friday Night Funkin’, Måneskin and pop it

Incident response analyst report 2020

Threat landscape for industrial automation systems in H1 2021

Applied YARA training Q&A

QakBot technical analysis

Keyloggers: How they work and how to detect them (Part 1)

Scammers’ delivery service: exclusively dangerous

RansomEXX Trojan attacks Linux systems

Subscribe

Reports

Lazarus group evolves its infection chain with old and new malware

Careto is back: what’s new after 10 years of silence?

APT trends report Q3 2024

Beyond the Surface: the evolution and expansion of the SideWinder APT group

Subscribe to our weekly e-mails