Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe 'EvilGnome' RAT employs advanced tactics to achieve initial access via compromised software.The malware establishes persistent backdoor access while leveraging various techniques for command and control.Lateral movement indicators…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe attack leveraged Qakbot for initial access and lateral movement within the victim’s network.Indicators of compromise (IOCs) included specific file paths, registry keys, and known C2 domains.Persistent footholds…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysRecent phishing campaigns utilize sophisticated malware droppers, highlighting the evolving tactics of the threat actors.Stealthy lateral movement methods reveal the need for enhanced monitoring across network segments.Command and…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysREvil operators leverage phishing emails for initial access.Post-exploitation techniques include abuse of legitimate management tools for lateral movement.Discovery and impact were primarily aimed at data encryption and exfiltration.Executive…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThis analysis uncovers the multi-stage approach utilized by the actor in deploying the implant.Indicators of Compromise (IOCs) such as command and control (C2) IP addresses and hashes are…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysXYZ malware uses advanced evasion techniques to avoid detection by traditional security measures.Initial access appears to be through phishing emails containing malicious attachments that deploy the malware.The actor…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe attack utilized a phishing vector for initial access, leveraging a malicious document to deploy the payload.Persistence mechanisms employed consisted of registry modifications and scheduled tasks to maintain…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysA phishing campaign targeting financial institutions utilized a malware-as-a-service model to deploy advanced payloads.The actor leveraged Phishing tactics to achieve initial access, primarily via email attachments.Command and Control…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysPhishing emails were utilized to achieve initial access, leveraging social engineering principles to deceive targets.The malware deployed included a dropper that installed a ransomware payload, indicating a multi-stage…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysAttackers leveraged phishing emails to distribute Emotet, allowing initial access to target networks.Post-infection, TrickBot was used to establish persistence and lateral movement across the environment.The threat actor's ultimate…