Priya Nair — Digital Forensics Analyst Key TakeawaysAdvanced persistent threat actors leveraged a sophisticated spear-phishing campaign to deliver the malware.The implant employed a multi-stage execution technique to gain persistence and evade detection.Command and control communications…
Priya Nair — Digital Forensics Analyst Key TakeawaysAPT32 employs a combination of social engineering and bespoke malware to achieve initial access.The actor uses T1071.001 – Application Layer Protocol: Web Protocols for its Command and Control,…
Priya Nair — Digital Forensics Analyst Key TakeawaysThe ransomware utilized social engineering to achieve initial access.Our investigation revealed multiple persistence mechanisms employed by the malware.Command and control communication utilized HTTP over TLS to obfuscate traffic.Executive…
Priya Nair — Digital Forensics Analyst Key TakeawaysMalware executed using PowerShell, leveraging T1064 - Scripting for persistence.Command-and-control (C2) infrastructure utilized DNS tunneling techniques for stealthy communication.Detected indicators of compromise (IOCs) include unique file hashes and…
Priya Nair — Digital Forensics Analyst Key TakeawaysBlistering Worm utilizes sophisticated evasion techniques to bypass traditional security measures.Early detection relies heavily on monitoring unusual outbound network connections and registry modifications.Understanding the actor's lateral movement tactics…
Priya Nair — Digital Forensics Analyst Key TakeawaysThis ransomware employs a multi-stage infection process, utilizing a dropper to execute the second-stage payload.We uncovered several TTPs consistent with the MITRE ATT&CK framework, specifically focused on persistence…
Priya Nair — Digital Forensics Analyst Key TakeawaysThe malware exploits a vulnerability in the application stack for initial access.Persistence is achieved through registry modifications and scheduled tasks.Command and Control is conducted via encrypted web traffic…
Priya Nair — Digital Forensics Analyst Key TakeawaysThe threat actor employed a multi-stage phishing campaign, utilizing Emotet to establish initial access.The analysis revealed that the primary implant utilized PowerShell scripts for persistence and lateral movement.Command…
Priya Nair — Digital Forensics Analyst Key TakeawaysThe initial access vector employed by APT42 involved a sophisticated phishing email containing a malicious document.The payload executed upon opening the document utilized T1059.001 – Command and Scripting…
Priya Nair — Digital Forensics Analyst Key TakeawaysREvil employs spear-phishing emails as a vector for initial payload delivery, often utilizing malicious document files.The malware exhibits sophisticated evasion capabilities, including the use of legitimate Windows utilities…