Alex Morgan — Threat Intelligence Analyst Key TakeawaysThis incident highlights the importance of monitoring user behavior for anomalous activities.Defensive measures must include advanced endpoint detection and response capabilities to catch sophisticated malware.Understanding the actor's TTPs…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysAttacks leveraged T1193 – Spear Phishing for initial access to organizations.Persistence achieved through the use of scheduled tasks and Windows services.Command and Control infrastructure utilized dynamic DNS to…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe actor utilized a phishing email with a malicious attachment to deliver AsyncRAT.Post initial compromise, lateral movement was executed using legitimate credentials.Detection of AsyncRAT behavior can be enhanced…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysExploit of Office macros as an initial delivery vector for the XXMalware campaign.Utilization of remote PowerShell scripts for post-exploitation tasks.Effective C2 server evasion through domain generation algorithms.Executive SummaryIn…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe attack leveraged multiple Tactics, Techniques, and Procedures (TTPs) across the kill chain, indicating a mature threat actor.Initial access was obtained through a phishing campaign, delivering a custom…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysMalicious PowerShell scripts were used to exploit DCOM vulnerabilities for lateral movement.Persistence was achieved through registry modifications and scheduled tasks.Indicators of compromise including specific command-line parameters were identified…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysEmotet is leveraging advanced evasion techniques and polymorphic payloads to ensure successful delivery and execution.The campaign demonstrates sophisticated lateral movement tactics using Windows Management Instrumentation (WMI) for reconnaissance…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysAPT29 utilized a sophisticated supply chain attack to gain initial access to victim networks.We observed the deployment of the Cozy Bear malware family for post-exploitation activities.Detection of anomalous…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThe LNX_DROPPER campaign leverages malicious ISO files to initiate infections.Our analysis identified the use of T1559 – Use of Native Tools to execute PowerShell commands for persistence.Indicators of…
Alex Morgan — Threat Intelligence Analyst Key TakeawaysThis analysis details a multi-step attack leveraging phishing emails to gain initial access.The malware employed in this attack showcased advanced persistence mechanisms through registry modifications.Command and control communication…