Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysIdentified exploitation of CVE-2023-XXXXX for initial access, indicating the need for immediate patching.Persistent threat actor leveraging PowerShell scripts for lateral movement and persistence.Malware C2 infrastructure demonstrated…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysAstraLocker leverages phishing emails and RDP brute-forcing for initial access.Persistence mechanisms exploited include scheduled tasks and registry modifications.The malware employs a sophisticated C2 infrastructure for data…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysThe attack chain leveraged phishing emails to gain initial access to target networks.Malicious use of Cobalt Strike facilitated post-exploitation activities, allowing for extensive lateral movement.The threat…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysThis analysis provides insight into the tactics employed by the ransomware actor, particularly their use of social engineering and lateral movement techniques.We identified multiple MITRE ATT&CK…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysEmotet continues to evolve, leveraging complex delivery mechanisms and modular payload architecture.The malware exhibits sophisticated Command and Control (C2) capabilities to maintain persistence and evade detection.Timely…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysThe campaign employed spear-phishing emails as its primary vector for initial compromise.Persistence mechanisms included registry modifications and scheduled tasks to ensure the implant remained active.Command and…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysThe observed ransomware attack utilized a phishing email as the initial access vector.Execution mechanisms involved PowerShell scripts alongside a sophisticated loader to deploy the malicious payload.Command…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysMulti-stage infection process leveraging phishing and malicious macro execution.Extensive use of Lateral Movement techniques to propagate within the network.Identified Command and Control infrastructure with multiple fallback…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysPhishing remains a prevalent initial access vector with the LodaRAT deployment.Lateral movement is achieved via Windows Management Instrumentation (WMI) and leveraging Mimikatz for credential theft.Maintaining persistence…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysThe attack leveraged credential stuffing as the initial access vector.Our analysis identified the use of a custom C2 architecture to exfiltrate sensitive data.The threat actor employed…