Alex Morgan — Threat Intelligence Analyst Key TakeawaysEmotet continues to leverage living-off-the-land tactics, utilizing existing software like PowerShell for execution.The actor demonstrates advanced obfuscation techniques to evade detection, including encrypted payloads and multi-stage delivery mechanisms.Command…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe recent PHISHER malware campaign demonstrates advanced tactics for initial access through social engineering.Our analysis revealed the use of T1059.001 – Command and Scripting Interpreter: PowerShell for execution…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysAdvanced phishing campaigns employed social engineering tactics to lure users into credential harvesting.Malware variants observed include a dropper that executes a secondary payload for establishing persistence.Command and Control…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysRecent phishing campaigns utilize sophisticated social engineering to deliver **Remote Access Trojans (RATs)**.Malware deployment was traced to the use of legitimate-looking documents and **malicious macros**.Command and Control (C2)…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysDridex has evolved to implement advanced evasion techniques, including polymorphism and encrypted payloads.Command and Control activities utilize a newly observed domain generation algorithm (DGA) to evade detection.The malware…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe 'Shadewalker' malware utilizes social engineering techniques for initial access and masquerades as legitimate software.Our investigation revealed extensive use of PowerShell for execution, leveraging T1064 - Scripting to…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysXYZ malware employs advanced obfuscation techniques to evade detection, complicating the initial analysis process.The actor utilizes PowerShell for lateral movement, indicative of the use of T1035 – Service…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysInvestigation revealed a multi-stage attack leveraging Cobalt Strike for lateral movement.Initial access was obtained through phishing emails targeting company employees.Command and Control communications were observed using encrypted traffic…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe XYZ malware utilizes social engineering tactics to achieve initial access via phishing emails.We observed that the malware employs a combination of PowerShell scripts and scheduled tasks for…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe XYZ ransomware leverages spear-phishing emails for initial access.Post-exploitation involved sophisticated lateral movement using compromised credentials.The attack chain signifies a reliance on encrypted C2 communication for data exfiltration.Executive…