Nina Kovacs — Exploit Research Analyst Key TakeawaysIdentified a multi-stage phishing campaign utilizing a custom Remote Access Trojan (RAT).The implant facilitated persistent access while exfiltrating sensitive data over a series of carefully crafted HTTP/S beacons.Defensive…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe threat actor leveraged phishing emails to gain initial access.Persistence was achieved through the use of scheduled tasks and registry modifications.Lateral movement techniques included the exploitation of Windows…
Nina Kovacs — Exploit Research Analyst Key TakeawaysDiscovered use of custom fileless malware employing PowerShell for persistence.Indicators of Compromise (IOCs) suggest targeted attacks against government entities.Complex C2 infrastructure utilized for command and control communication.Executive SummaryOur…
Nina Kovacs — Exploit Research Analyst Key TakeawaysCredential dumping via Mimikatz is frequently observed in targeted attacks leveraging T1003 techniques.Our investigation uncovered lateral movement patterns consistent with T1021.001 (Remote Services: RDP), indicating the actor's focus…
Nina Kovacs — Exploit Research Analyst Key TakeawaysAnalysis of malicious Office macros reveals a sophisticated phishing campaign targeting enterprises.Malware deployment leveraged T1193 – Spear Phishing Link and T1203 – Exploitation for Client Execution techniques.Indicators of…
Nina Kovacs — Exploit Research Analyst Key TakeawaysAPT28 leveraged spear-phishing campaigns to gain initial access to targeted organizations.The implant utilized various Persistence mechanisms to maintain foothold within compromised environments.Exfiltration was achieved through Command and Control…
Nina Kovacs — Exploit Research Analyst Key TakeawaysXYZ Ransomware utilizes phishing emails as the initial access vector, leveraging social engineering techniques to prey on unsuspecting users.The malware implements various persistence mechanisms, including scheduled tasks and…
Nina Kovacs — Exploit Research Analyst Key TakeawaysAPT39 employs sophisticated phishing tactics to gain initial access.Utilizes custom malware samples designed to evade detection.Persistent Command and Control (C2) infrastructure leveraging domain generation algorithms.Executive SummaryOur investigation into…
Nina Kovacs — Exploit Research Analyst Key TakeawaysHealthcare organizations are increasingly targeted due to their critical data and vulnerability.The attack utilized a sophisticated phishing campaign as an initial access vector.Indicators of compromise (IOCs) included specific…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe XYZ malware employs sophisticated evasion techniques, utilizing T1040 to maintain persistence.Command and Control (C2) communications are established via T1071, leveraging HTTP traffic to blend seamlessly into normal…