Alex Morgan — Threat Intelligence Analyst Key TakeawaysA sophisticated phishing campaign used a custom-built Android malware for credential theft.The malware showcases multiple persistence mechanisms, exploiting both user permissions and system vulnerabilities.Anomalous network traffic to a…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysAPT29 leverages spear-phishing as an initial access vector, indicative of a highly targeted approach.The malware utilized in this campaign exhibits sophisticated evasion techniques, including process injection to bypass…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe incident involved a sophisticated ransomware deployment leveraging multiple TTPs.Initial access was achieved through phishing campaigns targeting employees in the finance sector.The malware exhibited strong evasion techniques, including…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysRansomware actors exploited a vulnerable web application to gain initial access to the network.The payload utilized advanced evasion techniques, including process hollowing and fileless execution methods.Our investigation revealed…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe ANOMALY malware campaign leverages phishing emails as its initial attack vector.Utilizes a multi-stage payload with Dropper and Payload components for execution.Exploits lateral movement via SMB and leverages…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysRecent malware analysis reveals sophisticated deployment techniques involving steganography and social engineering.Uncovered indicators of compromise (IOCs) point to a targeted actor leveraging custom payloads for persistence and lateral…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThis attack utilized a combination of spear-phishing and malicious document exploits to achieve initial access.The implant showcased multiple persistence mechanisms, including scheduled tasks and registry modifications.Command and Control…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe attack utilized a sophisticated email phishing campaign to initiate credential harvesting.Once inside the network, the threat actor leveraged T1569.002 – Container Deployment to deploy malicious containers for…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysA custom-built dropper is utilized to deliver the payload after initial access via phishing.The malware establishes a persistent C2 communication channel, enabling remote command execution.Lateral movement tactics employed…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysCustom phishing emails were the primary attack vector.Malicious payloads demonstrated advanced evasion techniques.Successful exploitation resulted in lateral movement across the network.Executive SummaryDuring our investigation into a recent phishing…