The 3CX VoIP Desktop Application has been compromised to deliver malware via legitimate 3CX updates. Huntress has been investigating this incident and working to validate and assess the current supply chain threat to the security community.
Mobile banking users are being manipulated by attackers to authorize fraudulent transactions. Learn what financial service providers can do to render these organized crimes powerless.
What happens when you combine ransomware with information stealers, remote access Trojans, and other malware in one easy-to-download package?
Group-IB discovers banking Trojan targeting users of more than 400 apps in 16 countries
Analysis of months-long MajikPOS and Treasure Hunter campaign that infected dozens of terminals
Detecting MaliBot, a fresh Android banking trojan, with a Fraud Protection solution
Sometimes hackers can be overly confident in their malware. Take a journey with us through a malware sample that contains no obfuscation whatsoever.
A technical analysis of a new variant of the SparrowDoor malware.
Unit 42 researchers disclosed several vulnerabilities and attack techniques in GKE Autopilot to Google, the root cause being insufficient verification of allowlisted workload image names. An attacker with permissions to create a pod could have abused these vulnerabilities to (1) escape their pod and compromise the underlying node, (2) escalate privileges and become full cluster administrators, and (3) covertly persist administrative access through backdoors that are completely invisible to clus…
We discovered malicious, targeted advanced persistent threat (APT) activity on a partner's system. Here, we dive into the BABYSHARK malware strain.
Allows an attacker with privileges in the account to share resources outside of the account even when an org policy restricts this, thus enabling them to backdoor their access.
In this blog, read along as we investigate a malicious foothold and decode the payload step by step.
Join us on a threat analysis journey as we discover a very shady Python—and a very friendly RAT.
Dive into a threat analysis with us as we dissect a PowerShell command with an environmentally keyed malware payload.
Join us for a threat hunting adventure as we analyze a suspicious run key that leads us to Cobalt Strike malware hidden across nearly 700 registry values.
In this blog, we look at some malicious PowerShell code breadcrumbs that one hacker left behind to unravel how they maintained access during a cyberattack.
A recap of hack_it 2021, a virtual security training event packed with interactive exercises, malware analysis, hacking workshops and more.
Hackers always try to cover up their tracks. In this blog, we step through layers of obfuscation to uncover the real intent of a .NET malware sample.
To avoid detection, hackers often turn a system’s own tools against itself. Here, we examine a malicious payload that was executed using PowerShell.
Learn manual malware analysis techniques used by threat researchers. Explore static & dynamic analysis, reverse engineering tools, and real-world investigation methods.
Huntress covers the breaking news about Solarwinds’ Orion platform being exploited as part of a coordinated attack to distribute malware.
A story about operators of JS-sniffer FakeSecurity distributing Raccoon stealer
In this blog, we dissect a sample of malware that makes clever use of batch scripting obfuscation—turns out it was a launcher for TrickBot!
A recap of hack_it 2020, a virtual security training event packed with interactive exercises, malware research and analysis, and more.
As a follow-up to our previous post, we recently uncovered a really peculiar piece of malware that works through a lot of different layers of abstraction.
Top 11 books on digital forensics, incident response, and malware analysis
For 6 years, it was not possible to see what hosted zones an attacker may have created in an account. This issue could be viewed as a business decision that adding the ability to viewing this data was not worthwhile, but the delay is significant and would allow someone that had compromised an environment to maintain a backdoor.
