Nina Kovacs — Exploit Research Analyst Key TakeawaysREvil employs advanced evasion techniques during execution, utilizing T1059.001 – PowerShell for command execution.The group demonstrates persistence through registry modifications at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.Command and Control infrastructure shows dynamic DNS…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe malware leveraged phishing emails as the initial attack vector, embedding macros within Office documents.Persistence mechanisms included registry modifications and scheduled tasks to ensure longevity.The use of dynamic…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe vishing campaign utilizes social engineering tactics to obtain sensitive information.Malware used in the later stages leverages persistence mechanisms through legitimate software.Communication with C2 servers is implemented via…
Nina Kovacs — Exploit Research Analyst Key TakeawaysQakBot has evolved with enhanced evasion techniques and sophisticated C2 communication protocols.The malware demonstrates lateral movement capabilities, exploiting Windows APIs and scheduled tasks for persistence.Identification of unique IOCs…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe campaign utilized a multi-stage payload delivery, embedding the initial dropper within a legitimate software installer.Our analysis identified command and control communication patterns indicating a possible infrastructure reuse…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe attack leveraged compromised RDP credentials for initial access.The custom malware employed multiple persistence mechanisms to ensure longevity.Command and control communication featured both direct and proxied traffic patterns.Executive…
Nina Kovacs — Exploit Research Analyst Key TakeawaysAPT groups are increasingly leveraging sophisticated phishing techniques to initiate attacks on financial institutions.We identified the use of the PowerShell scripting language to establish persistence and evade detection.The…
Nina Kovacs — Exploit Research Analyst Key TakeawaysIdentified the initial access vector as a phishing email containing a malicious attachment.The ransomware employs strong encryption methods targeting a wide range of file types.Command and Control (C2)…
Nina Kovacs — Exploit Research Analyst Key TakeawaysIdentified a multi-stage phishing campaign utilizing a custom Remote Access Trojan (RAT).The implant facilitated persistent access while exfiltrating sensitive data over a series of carefully crafted HTTP/S beacons.Defensive…
Nina Kovacs — Exploit Research Analyst Key TakeawaysThe threat actor leveraged phishing emails to gain initial access.Persistence was achieved through the use of scheduled tasks and registry modifications.Lateral movement techniques included the exploitation of Windows…