Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysInitial access achieved via spear phishing with malicious document attachments.The implant utilized sophisticated evasion techniques to blend in with normal process activity.Extensive lateral movement tactics and…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysRansomware deployed via phishing email led to significant network compromise.Utilization of T1059.001 - PowerShell for initial execution and payload delivery.Command and Control (C2) infrastructure employed a…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysThis campaign utilized social engineering to gain initial access through phishing emails.We observed the use of a sophisticated PowerShell script for lateral movement within the network.Indicators…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysRansomware attacks are evolving with increasingly sophisticated tactics for lateral movement and persistence.Indicators of compromise (IOCs) highlight the hiding strategies used by the malware within legitimate…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysThe attack exploited a carefully crafted phishing email to deliver a ransomware payload.Indicators of Compromise (IOCs) include specific file hashes and C2 IP addresses associated with…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysDetailed examination of the ransomware's initial access vector and propagation techniques.Identification of C2 communication patterns and network behaviors indicative of compromise.Insights into the persistence mechanisms employed…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysUnderstanding advanced attacker TTPs is crucial for robust defense strategies.Initial access vectors often exploit human error, necessitating comprehensive training for users.Continuous monitoring of C2 communications can…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysEmotet has evolved to facilitate diverse payload deployments alongside its traditional operations.Initial access is achieved via phishing emails containing malicious attachments, often scripted macros.Indicators of compromise…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysA sophisticated multi-stage malware campaign utilizes a custom dropper to establish foothold.The actor employs T1059.001 – PowerShell for execution and persistence mechanisms.Advanced command and control techniques…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysTargeted phishing emails facilitated initial access, leading to the deployment of a sophisticated loader.The loader utilized obfuscated PowerShell scripts for execution, demonstrating advanced evasion tactics.Post-infection, the…