Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysThis incident exposed an advanced adversary leveraging a modular malware framework to achieve persistence and lateral movement.Initial access was facilitated through spear-phishing techniques, demonstrating the efficacy…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysThe malware employs social engineering techniques for initial access through phishing emails.Our analysis revealed the use of a sophisticated Remote Access Trojan (RAT) that communicates over…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysSquirrelWaffle leverages social engineering techniques to deliver malware payloads via malicious email attachments.The malware employs multiple techniques for persistence, including creating startup keys and scheduled tasks.Command…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysQBot infostealer leverages phishing emails to facilitate initial access.The malware employs sophisticated C2 communications and incorporates anti-analysis techniques.Detection of QBot requires monitoring for specific registry modifications…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysABC Malware leverages phishing emails with malicious attachments for initial access.The malware employs T1059.001 – Command and Scripting Interpreter: PowerShell for execution and lateral movement.Indicators of…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysCustom malware was delivered through a phishing email disguised as a document.The implant exhibited multiple persistence mechanisms, including registry modifications and scheduled tasks.Infrastructure associated with the…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysVortex utilizes spear-phishing emails with Excel attachments to achieve initial access.The malware employs T1059.001 – Command-Line Interface for execution and persistence.Indicators of compromise (IOCs) include specific…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysIdentify APT patterns through C2 traffic analysis to thwart further exfiltration.Monitor registry modifications closely as they can signal persistence methods utilized by advanced actors.Implement robust lateral…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysThe attack leverages sophisticated phishing emails to deliver payloads exploiting common user behaviors.The primary tool utilized by the threat actor is Cobalt Strike, a legitimate penetration…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysExploited phony document macros for initial access, utilizing social engineering techniques.We identified multiple persistence mechanisms deployed via Windows Task Scheduler and registry modifications.Command and Control infrastructure…