APT reports

Icefog OpenIOC Release

Yesterday we published our research on Icefog, a sophisticated cyber-espionage operation. You can read more about it here. We also have a detailed FAQ and in-depth report.

We’re sharing Indicators of Compromise based on the OpenIOC framework for Icefog. This way organizations have an alternative way of checking their network for presence of (active) Icefog infections.

You can download the ZIPed IOC file here.

Kaspersky products detect all malicious files associated with Icefog.

Icefog OpenIOC Release

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Reports

ToddyCat: your hidden email assistant. Part 2

An in-depth analysis of Umbrij, a new tool used by the ToddyCat APT group to compromise corporate email communications in Gmail. The attack targeted OAuth authorization tokens, allowing threat actors to gain access to Google services.