Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe 'Shadewalker' malware utilizes social engineering techniques for initial access and masquerades as legitimate software.Our investigation revealed extensive use of PowerShell for execution, leveraging T1064 - Scripting to…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysXYZ malware employs advanced obfuscation techniques to evade detection, complicating the initial analysis process.The actor utilizes PowerShell for lateral movement, indicative of the use of T1035 – Service…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysInvestigation revealed a multi-stage attack leveraging Cobalt Strike for lateral movement.Initial access was obtained through phishing emails targeting company employees.Command and Control communications were observed using encrypted traffic…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe XYZ malware utilizes social engineering tactics to achieve initial access via phishing emails.We observed that the malware employs a combination of PowerShell scripts and scheduled tasks for…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe XYZ ransomware leverages spear-phishing emails for initial access.Post-exploitation involved sophisticated lateral movement using compromised credentials.The attack chain signifies a reliance on encrypted C2 communication for data exfiltration.Executive…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThis campaign utilizes a multi-stage delivery method, leveraging spear-phishing to gain initial access.The malware exhibits sophisticated evasion techniques, including anti-sandbox and anti-VM measures.Lateral movement within the network is…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe attack utilized an advanced phishing campaign as initial access through malicious document attachments.Post-exploitation, the threat actor established robust persistence through scheduled tasks and registry modifications.Command and Control…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe initial access vector was a phishing email containing a malicious attachment that executed the payload upon opening.Our analysis revealed that the malware used stealthy persistence mechanisms, creating…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysAgentTesla has emerged as a significant threat to organizations, leveraging sophisticated phishing tactics.Lateral movement techniques observed include using legitimate credentials obtained through keystroke logging.Command and Control (C2) infrastructure…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe Kobalt Stealer leverages sophisticated phishing techniques for initial access.Persistence mechanisms utilized include registry modifications and scheduled tasks.Indicators of compromise (IOCs) show extensive use of encrypted communication for…