Nina Kovacs — Exploit Research Analyst Key TakeawaysThe vishing campaign utilizes social engineering tactics to obtain sensitive information.Malware used in the later stages leverages persistence mechanisms through legitimate software.Communication with C2 servers is implemented via…
Nina Kovacs — Exploit Research Analyst Key TakeawaysQakBot has evolved with enhanced evasion techniques and sophisticated C2 communication protocols.The malware demonstrates lateral movement capabilities, exploiting Windows APIs and scheduled tasks for persistence.Identification of unique IOCs…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe campaign utilized a multi-stage payload delivery, embedding the initial dropper within a legitimate software installer.Our analysis identified command and control communication patterns indicating a possible infrastructure reuse…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe attack leveraged compromised RDP credentials for initial access.The custom malware employed multiple persistence mechanisms to ensure longevity.Command and control communication featured both direct and proxied traffic patterns.Executive…
Nina Kovacs — Exploit Research Analyst Key TakeawaysAPT groups are increasingly leveraging sophisticated phishing techniques to initiate attacks on financial institutions.We identified the use of the PowerShell scripting language to establish persistence and evade detection.The…
Nina Kovacs — Exploit Research Analyst Key TakeawaysIdentified the initial access vector as a phishing email containing a malicious attachment.The ransomware employs strong encryption methods targeting a wide range of file types.Command and Control (C2)…
Nina Kovacs — Exploit Research Analyst Key TakeawaysIdentified a multi-stage phishing campaign utilizing a custom Remote Access Trojan (RAT).The implant facilitated persistent access while exfiltrating sensitive data over a series of carefully crafted HTTP/S beacons.Defensive…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe threat actor leveraged phishing emails to gain initial access.Persistence was achieved through the use of scheduled tasks and registry modifications.Lateral movement techniques included the exploitation of Windows…
Nina Kovacs — Exploit Research Analyst Key TakeawaysDiscovered use of custom fileless malware employing PowerShell for persistence.Indicators of Compromise (IOCs) suggest targeted attacks against government entities.Complex C2 infrastructure utilized for command and control communication.Executive SummaryOur…
Nina Kovacs — Exploit Research Analyst Key TakeawaysCredential dumping via Mimikatz is frequently observed in targeted attacks leveraging T1003 techniques.Our investigation uncovered lateral movement patterns consistent with T1021.001 (Remote Services: RDP), indicating the actor's focus…