Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysIdentify APT patterns through C2 traffic analysis to thwart further exfiltration.Monitor registry modifications closely as they can signal persistence methods utilized by advanced actors.Implement robust lateral…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysThe attack leverages sophisticated phishing emails to deliver payloads exploiting common user behaviors.The primary tool utilized by the threat actor is Cobalt Strike, a legitimate penetration…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysExploited phony document macros for initial access, utilizing social engineering techniques.We identified multiple persistence mechanisms deployed via Windows Task Scheduler and registry modifications.Command and Control infrastructure…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysXYZ malware leverages a multi-stage payload delivery mechanism.Command and Control communications reveal the usage of encrypted channels to evade detection.Initial access was confirmed through phishing emails…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysEmotet employs advanced social engineering tactics for initial access via malicious email attachments.The malware demonstrates robust persistence mechanisms incorporating registry modifications and task scheduler entries.Effective C2…
Nina Kovacs — Exploit Research Analyst Key TakeawaysRansomware operators utilized a combination of web application vulnerabilities and phishing techniques for initial access.Persistence was achieved through a scheduled task that executed the ransomware payload upon startup.Command…
Nina Kovacs — Exploit Research Analyst Key TakeawaysSunshine Ransomware employs sophisticated obfuscation techniques to evade detection.Initial access was achieved via targeted phishing emails with malicious attachments.The malware uses advanced lateral movement strategies to propagate across…
Nina Kovacs — Exploit Research Analyst Key TakeawaysHavoc employs spear-phishing emails with malicious attachments for initial access.The malware utilizes T1059.001 – PowerShell for execution, enabling script-based payload delivery.Our investigation highlighted the use of T1071.001 –…
Nina Kovacs — Exploit Research Analyst Key TakeawaysUnderstanding the multi-stage attack reveals critical defense gaps.The use of legitimate tools for lateral movement complicates detection efforts.Identifying specific indicators of compromise can significantly aid in early detection…
Nina Kovacs — Exploit Research Analyst Key TakeawaysIdentified custom malware with sophisticated evasion techniquesAttack utilized multiple vectors for initial access and lateral movementIndicators of Compromise (IOCs) linked to a known APT actorExecutive SummaryDuring our investigation…