Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysEmotet employs advanced social engineering tactics for initial access via malicious email attachments.The malware demonstrates robust persistence mechanisms incorporating registry modifications and task scheduler entries.Effective C2…
Nina Kovacs — Exploit Research Analyst Key TakeawaysRansomware operators utilized a combination of web application vulnerabilities and phishing techniques for initial access.Persistence was achieved through a scheduled task that executed the ransomware payload upon startup.Command…
Nina Kovacs — Exploit Research Analyst Key TakeawaysSunshine Ransomware employs sophisticated obfuscation techniques to evade detection.Initial access was achieved via targeted phishing emails with malicious attachments.The malware uses advanced lateral movement strategies to propagate across…
Nina Kovacs — Exploit Research Analyst Key TakeawaysHavoc employs spear-phishing emails with malicious attachments for initial access.The malware utilizes T1059.001 – PowerShell for execution, enabling script-based payload delivery.Our investigation highlighted the use of T1071.001 –…
Nina Kovacs — Exploit Research Analyst Key TakeawaysUnderstanding the multi-stage attack reveals critical defense gaps.The use of legitimate tools for lateral movement complicates detection efforts.Identifying specific indicators of compromise can significantly aid in early detection…
Nina Kovacs — Exploit Research Analyst Key TakeawaysIdentified custom malware with sophisticated evasion techniquesAttack utilized multiple vectors for initial access and lateral movementIndicators of Compromise (IOCs) linked to a known APT actorExecutive SummaryDuring our investigation…
Nina Kovacs — Exploit Research Analyst Key TakeawaysAdvanced phishing emails serve as the initial access vector.The implementation of a custom backdoor enables sustained persistence on infected hosts.Subtle C2 communications suggest a well-structured operation with multi-stage…
Nina Kovacs — Exploit Research Analyst Key TakeawaysEmotet employs innovative evasion techniques and utilizes multiple payloads throughout its infection lifecycle.Initial access often leverages phishing emails, suggesting the need for enhanced email filtering solutions.Indicators of compromise…
Nina Kovacs — Exploit Research Analyst Key TakeawaysREvil employs advanced evasion techniques during execution, utilizing T1059.001 – PowerShell for command execution.The group demonstrates persistence through registry modifications at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.Command and Control infrastructure shows dynamic DNS…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe malware leveraged phishing emails as the initial attack vector, embedding macros within Office documents.Persistence mechanisms included registry modifications and scheduled tasks to ensure longevity.The use of dynamic…