Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe Cozy Bear APT group employs sophisticated spear-phishing techniques to gain initial access.Malicious payloads often utilize office document exploits to deliver secondary payloads stealthily.Detection relies heavily on monitoring…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysIdentified usage of T1071.001 - Application Layer Protocol: Web Protocols for C2 communications.Discovered persistence mechanisms leveraging HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key.Observed credential dumping via T1003.001 - Credential Dumping: LSASS memory…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysOperation Zeus showcases sophisticated techniques for initial access using phishing.Persistence is achieved through the implantation of the Zeus malware, leveraging Registry Run Keys.Comprehensive use of PowerShell for lateral…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysMalicious emails leveraging social engineering were used to gain initial access to the victim’s environment.The Quasar RAT was identified as the primary malicious payload acting as a remote…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe attack demonstrates sophisticated social engineering techniques for initial access.Persistent mechanisms were implemented through scheduled tasks and registry modifications.Data exfiltration and lateral movement strategies were identified, indicative of…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe threat actor employed a sophisticated multi-stage attack strategy to gain initial access.Malicious PowerShell scripts were a key component of the execution and persistence phases.Beaconing with C2 servers…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysA sophisticated ransomware strain used living-off-the-land techniques to evade detection.The attacker leveraged scheduled tasks for persistence, complicating remediation efforts.Initial access was achieved via phishing, demonstrating the risk associated…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThis ransomware campaign employs phishing emails to gain initial access to corporate networks.The malicious payload utilizes the Windows Management Instrumentation (WMI) for persistence and lateral movement after an…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysRansomware actors increasingly leverage supply chain vulnerabilities for initial access, impacting critical infrastructure.Persistence mechanisms include sophisticated registry manipulations and scheduled tasks that ensure re-execution after system reboots.Visualization of…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysRansomware deployed through phishing emails with malicious document payloadsUse of T1193 (Spear Phishing Link) for initial accessBeaconing patterns observed indicating interaction with multiple C2 serversExecutive SummaryDuring our investigation…