Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysMulti-stage infection process leveraging phishing and malicious macro execution.Extensive use of Lateral Movement techniques to propagate within the network.Identified Command and Control infrastructure with multiple fallback…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysPhishing remains a prevalent initial access vector with the LodaRAT deployment.Lateral movement is achieved via Windows Management Instrumentation (WMI) and leveraging Mimikatz for credential theft.Maintaining persistence…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysThe attack leveraged credential stuffing as the initial access vector.Our analysis identified the use of a custom C2 architecture to exfiltrate sensitive data.The threat actor employed…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysThis incident exposed an advanced adversary leveraging a modular malware framework to achieve persistence and lateral movement.Initial access was facilitated through spear-phishing techniques, demonstrating the efficacy…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysThe malware employs social engineering techniques for initial access through phishing emails.Our analysis revealed the use of a sophisticated Remote Access Trojan (RAT) that communicates over…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysSquirrelWaffle leverages social engineering techniques to deliver malware payloads via malicious email attachments.The malware employs multiple techniques for persistence, including creating startup keys and scheduled tasks.Command…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysQBot infostealer leverages phishing emails to facilitate initial access.The malware employs sophisticated C2 communications and incorporates anti-analysis techniques.Detection of QBot requires monitoring for specific registry modifications…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysABC Malware leverages phishing emails with malicious attachments for initial access.The malware employs T1059.001 – Command and Scripting Interpreter: PowerShell for execution and lateral movement.Indicators of…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysCustom malware was delivered through a phishing email disguised as a document.The implant exhibited multiple persistence mechanisms, including registry modifications and scheduled tasks.Infrastructure associated with the…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysVortex utilizes spear-phishing emails with Excel attachments to achieve initial access.The malware employs T1059.001 – Command-Line Interface for execution and persistence.Indicators of compromise (IOCs) include specific…