Nina Kovacs — Exploit Research Analyst Key TakeawaysAdvanced phishing emails serve as the initial access vector.The implementation of a custom backdoor enables sustained persistence on infected hosts.Subtle C2 communications suggest a well-structured operation with multi-stage…
Nina Kovacs — Exploit Research Analyst Key TakeawaysEmotet employs innovative evasion techniques and utilizes multiple payloads throughout its infection lifecycle.Initial access often leverages phishing emails, suggesting the need for enhanced email filtering solutions.Indicators of compromise…
Nina Kovacs — Exploit Research Analyst Key TakeawaysREvil employs advanced evasion techniques during execution, utilizing T1059.001 – PowerShell for command execution.The group demonstrates persistence through registry modifications at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.Command and Control infrastructure shows dynamic DNS…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe malware leveraged phishing emails as the initial attack vector, embedding macros within Office documents.Persistence mechanisms included registry modifications and scheduled tasks to ensure longevity.The use of dynamic…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe vishing campaign utilizes social engineering tactics to obtain sensitive information.Malware used in the later stages leverages persistence mechanisms through legitimate software.Communication with C2 servers is implemented via…
Nina Kovacs — Exploit Research Analyst Key TakeawaysQakBot has evolved with enhanced evasion techniques and sophisticated C2 communication protocols.The malware demonstrates lateral movement capabilities, exploiting Windows APIs and scheduled tasks for persistence.Identification of unique IOCs…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe campaign utilized a multi-stage payload delivery, embedding the initial dropper within a legitimate software installer.Our analysis identified command and control communication patterns indicating a possible infrastructure reuse…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe attack leveraged compromised RDP credentials for initial access.The custom malware employed multiple persistence mechanisms to ensure longevity.Command and control communication featured both direct and proxied traffic patterns.Executive…
Nina Kovacs — Exploit Research Analyst Key TakeawaysAPT groups are increasingly leveraging sophisticated phishing techniques to initiate attacks on financial institutions.We identified the use of the PowerShell scripting language to establish persistence and evade detection.The…
Nina Kovacs — Exploit Research Analyst Key TakeawaysIdentified the initial access vector as a phishing email containing a malicious attachment.The ransomware employs strong encryption methods targeting a wide range of file types.Command and Control (C2)…