Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysExploited phony document macros for initial access, utilizing social engineering techniques.We identified multiple persistence mechanisms deployed via Windows Task Scheduler and registry modifications.Command and Control infrastructure…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysXYZ malware leverages a multi-stage payload delivery mechanism.Command and Control communications reveal the usage of encrypted channels to evade detection.Initial access was confirmed through phishing emails…
Daniel Osei — SOC Lead & Malware Analyst Key TakeawaysEmotet employs advanced social engineering tactics for initial access via malicious email attachments.The malware demonstrates robust persistence mechanisms incorporating registry modifications and task scheduler entries.Effective C2…
Nina Kovacs — Exploit Research Analyst Key TakeawaysRansomware operators utilized a combination of web application vulnerabilities and phishing techniques for initial access.Persistence was achieved through a scheduled task that executed the ransomware payload upon startup.Command…
Nina Kovacs — Exploit Research Analyst Key TakeawaysSunshine Ransomware employs sophisticated obfuscation techniques to evade detection.Initial access was achieved via targeted phishing emails with malicious attachments.The malware uses advanced lateral movement strategies to propagate across…
Nina Kovacs — Exploit Research Analyst Key TakeawaysHavoc employs spear-phishing emails with malicious attachments for initial access.The malware utilizes T1059.001 – PowerShell for execution, enabling script-based payload delivery.Our investigation highlighted the use of T1071.001 –…
Nina Kovacs — Exploit Research Analyst Key TakeawaysUnderstanding the multi-stage attack reveals critical defense gaps.The use of legitimate tools for lateral movement complicates detection efforts.Identifying specific indicators of compromise can significantly aid in early detection…
Nina Kovacs — Exploit Research Analyst Key TakeawaysIdentified custom malware with sophisticated evasion techniquesAttack utilized multiple vectors for initial access and lateral movementIndicators of Compromise (IOCs) linked to a known APT actorExecutive SummaryDuring our investigation…
Nina Kovacs — Exploit Research Analyst Key TakeawaysAdvanced phishing emails serve as the initial access vector.The implementation of a custom backdoor enables sustained persistence on infected hosts.Subtle C2 communications suggest a well-structured operation with multi-stage…
Nina Kovacs — Exploit Research Analyst Key TakeawaysEmotet employs innovative evasion techniques and utilizes multiple payloads throughout its infection lifecycle.Initial access often leverages phishing emails, suggesting the need for enhanced email filtering solutions.Indicators of compromise…