Malware

209 posts

$Sandbox process tree for the Underground loader, showing an injected dllhost.exe launching chrome.exe and msedge.exe and staging stolen cookies under C:\ProgramData\Underground, before a second dllhost.exe deletes that folder.$

Malware Credential Theft

$100k in Crypto Drained by the Underground Operation

October 1, 20268 min read

Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist

Malware Command and Control

Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist

August 31, 20265 min read

Python NodeStealer: AI-Assisted to Full Spyware

Python NodeStealer: AI-Assisted to Full Spyware

August 26, 20266 min read

Shared beacon code that fingerprints the visitor (browser, OS, device, country), encrypts the record with ECDH P-256 and AES-GCM, and posts it to the collect endpoint

Malware Social Engineering

EtherHiding in the Browser: ClickFix Chain Ends in Amatera

August 25, 202612 min read

Blockchain Dead Drop Resolvers Explained

Malware Command and Control

Blockchain Dead Drop Resolvers Explained

August 18, 20265 min read

AI Sidebar Extension Monetizes Its Own Updates

AI Sidebar Extension Monetizes Its Own Updates

August 11, 20266 min read

Fake CAPTCHA, Real Business: Traffic Distribution for Hire

Social Engineering Malware

Fake CAPTCHA, Real Business: Traffic Distribution for Hire

August 4, 20268 min read

Social Engineering Malware

npm Stealer Reads Its C2 From an Ethereum Contract

August 4, 20265 min read

Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

Malware Credential Theft

Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

August 3, 20268 min read

World Cup Retrospective: Analyzing the Surge in Cyber Threats

Malware Phishing

World Cup Retrospective: Analyzing the Surge in Cyber Threats

July 22, 20262 min read

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

Malware Credential Theft

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

June 17, 202611 min read

Malware Supply Chain

Shai-Hulud-Style npm Worm Hits @tanstack

May 12, 20262 min read

Vulnerability Malware

DirtyFrag: Two Kernel Bugs Give Root on All Major Linux Distros

May 8, 20262 min read

OpenClaw's Hologram: Fake Installer Ships Rust Infostealer

Malware Credential Theft

OpenClaw's Hologram: Fake Installer Ships Rust Infostealer

May 7, 202615 min read

Malware Supply Chain

Shai-Hulud Resurfaces: Intercom-client@7.0.4 Harvesting Github Credentials

April 30, 20261 min read

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

Malware Credential Theft

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

April 20, 20266 min read

From ClickFix to MaaS: Exposing a Modular Windows RAT and Its Admin Panel

From ClickFix to MaaS: Exposing a Modular Windows RAT and Its Admin Panel

April 6, 20268 min read

OpenClaw Trap: AI-Assisted Lure Factory Targets Developers & Gamers

Malware Supply Chain

OpenClaw Trap: AI-Assisted Lure Factory Targets Developers & Gamers

March 23, 202613 min read

Attackers Weaponize Signed RMM Tools via Zoom, Meet, & Teams Lures

Phishing Malware

Attackers Weaponize Signed RMM Tools via Zoom, Meet, & Teams Lures

February 12, 20263 min read

Malware Supply Chain

Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading

November 26, 202526 min read

The Future of Malware is LLM-powered

The Future of Malware is LLM-powered

November 20, 20255 min read

RedTiger: New Red Teaming Tool in the Wild Targeting Gamers and Discord Accounts

Malware Credential Theft

RedTiger: New Red Teaming Tool in the Wild Targeting Gamers and Discord Accounts

October 23, 202510 min read

DNS Tunneling: The Blind Spot in Your Network Security Strategy

DNS Tunneling: The Blind Spot in Your Network Security Strategy

August 26, 20257 min read

Securing LLM Superpowers: Navigating the Wild West of MCP

Securing LLM Superpowers: Navigating the Wild West of MCP

August 13, 202512 min read

XWorm V6: Advanced Evasion and AMSI Bypass Capabilities Revealed

XWorm V6: Advanced Evasion and AMSI Bypass Capabilities Revealed

July 28, 20254 min read

DeepSeek Deception: Sainbox RAT & Hidden Rootkit Delivery

Malware Phishing

DeepSeek Deception: Sainbox RAT & Hidden Rootkit Delivery

June 26, 20255 min read

PureHVNC RAT Using Fake High-level Job Offers from Fashion and Beauty Brands

Malware Phishing

PureHVNC RAT Using Fake High-level Job Offers from Fashion and Beauty Brands

May 28, 20257 min read

New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile

Malware Credential Theft

New Evasive Campaign Delivers LegionLoader via Fake CAPTCHA & CloudFlare Turnstile

April 4, 20258 min read

Analyzing Elysium, a Variant of the Ghost (Cring) Ransomware Family

Ransomware Malware

Analyzing Elysium, a Variant of the Ghost (Cring) Ransomware Family

March 11, 20254 min read

Telegram Abused as C2 Channel for New Golang Backdoor

Telegram Abused as C2 Channel for New Golang Backdoor

February 14, 20253 min read

Lumma Stealer: Fake CAPTCHAs & New Techniques to Evade Detection

Malware Credential Theft

Lumma Stealer: Fake CAPTCHAs & New Techniques to Evade Detection

January 23, 20255 min read

New Yokai Side-loaded Backdoor Targets Thai Officials

New Yokai Side-loaded Backdoor Targets Thai Officials

December 13, 20248 min read

Python NodeStealer Targets Facebook Ads Manager with New Techniques

Malware Credential Theft

Python NodeStealer Targets Facebook Ads Manager with New Techniques

November 20, 20245 min read

Netskope Threat Labs Quarterly Stats for October 2024

October 29, 20243 min read

GitHub Comments from Legitimate Repositories Exploited to Deliver Remcos RAT

October 21, 20242 min read

New Bumblebee Loader Infection Chain Signals Possible Resurgence

New Bumblebee Loader Infection Chain Signals Possible Resurgence

October 18, 20244 min read

Netskope Threat Labs Uncovers New XWorm’s Stealthy Techniques

Netskope Threat Labs Uncovers New XWorm’s Stealthy Techniques

September 30, 20249 min read

DCRat Targets Users with HTML Smuggling

Malware Credential Theft

DCRat Targets Users with HTML Smuggling

September 26, 20245 min read

Cloud Threats Memo: Iranian Threat Actors Continue to Exploit Azure

September 11, 20243 min read

Latrodectus Rapid Evolution Continues With Latest New Payload Features

Latrodectus Rapid Evolution Continues With Latest New Payload Features

August 29, 20246 min read

REPLAY: Revisiting Play Ransomware Anti-Analysis Techniques

Ransomware Malware

REPLAY: Revisiting Play Ransomware Anti-Analysis Techniques

August 8, 20249 min read

Netskope Threat Labs Quarterly Stats for July 2024

August 1, 20243 min read

Cloud Threats Memo: CloudSorcerer, a Recently Discovered APT, is Exploiting Multiple Legitimate Cloud Services

July 12, 20242 min read

Two Recent Campaigns from Brazil and Korea Exploiting Legitimate Cloud Services

June 13, 20243 min read

Netskope Threat Labs Stats for March 2024

April 23, 20244 min read

Netskope Threat Coverage: Evil Ant Ransomware

Ransomware Malware

Netskope Threat Coverage: Evil Ant Ransomware

April 16, 20246 min read

Malware Ransomware

Netskope Threat Labs Stats for February 2024

March 25, 20244 min read

From Delivery To Execution: An Evasive Azorult Campaign Smuggled Through Google Sites

Malware Credential Theft

From Delivery To Execution: An Evasive Azorult Campaign Smuggled Through Google Sites

March 15, 20249 min read

Malware Phishing

Cloud Threats Memo: Google Drive Abused to Target Organizations in Asian Countries

March 6, 20242 min read

Malware Ransomware

Netskope Threat Labs Stats for January 2024

February 19, 20244 min read

Cloud Threats Memo: Back to the Basics: New DarkGate Campaign Exploiting Microsoft Teams

February 9, 20243 min read

Malware Phishing

Threat Actors Distributing Screenshotter Malware from OneDrive

January 26, 20242 min read

Malware Ransomware

Netskope Threat Labs Stats for December 2023

January 22, 20245 min read

A Look at the Nim-based Campaign Using Microsoft Word Docs to Impersonate the Nepali Government

Malware Phishing

A Look at the Nim-based Campaign Using Microsoft Word Docs to Impersonate the Nepali Government

December 20, 20236 min read

Malware Ransomware

Netskope Threat Labs Stats for November 2023

December 19, 20236 min read

Malware Credential Theft

Cloud Threats Memo: A Parasite Exploiting Legitimate Cloud Services

December 1, 20233 min read

Malware Ransomware

Netskope Threat Labs Stats for October 2023

November 16, 20235 min read

New DarkGate Variant Uses a New Loading Approach

New DarkGate Variant Uses a New Loading Approach

November 1, 20236 min read

Cloud Threats Memo: Multiple DarkGate Loader Campaigns Exploiting Legitimate Cloud Services

October 30, 20233 min read

Netskope Threat Coverage: Menorah

Malware Phishing

Netskope Threat Coverage: Menorah

October 25, 20233 min read

Netskope Threat Labs Stats for September 2023

Malware Ransomware

Netskope Threat Labs Stats for September 2023

October 18, 20236 min read

New Python NodeStealer Goes Beyond Facebook Credentials, Now Stealing All Browser Cookies and Login Credentials

Malware Credential Theft

New Python NodeStealer Goes Beyond Facebook Credentials, Now Stealing All Browser Cookies and Login Credentials

September 14, 20236 min read

Malware Ransomware

Netskope Threat Labs Stats for August 2023

September 11, 20236 min read

Malware Ransomware

Netskope Threat Labs Stats for July 2023

August 8, 20236 min read

Cloud Threats Memo: Russian State-sponsored Threat Actors Increasingly Exploiting Legitimate Cloud Services

August 4, 20232 min read

Vulnerability Phishing

Netskope Threat Coverage: Microsoft Office and Windows Zero Day (CVE-2023-36884)

July 20, 20231 min read

Malware Phishing

Cloud Threats Memo: Another State-Sponsored Actor Exploiting Dropbox

July 17, 20232 min read

Netskope Threat Labs Stats for June 2023

Malware Ransomware

Netskope Threat Labs Stats for June 2023

July 13, 20235 min read

Cloud Threats Memo: A Recent Campaign Exploiting Digital Trust Through Github

June 26, 20233 min read

Netskope Threat Labs Stats for May 2023

Malware Ransomware

Netskope Threat Labs Stats for May 2023

June 12, 20235 min read

Malware Ransomware

Threat Labs News Roundup: May 2023

June 9, 20234 min read

Cloud Threats Memo: Threat Actors Continue to Exploit the Flexibility of GitHub for Malicious Purposes

Malware Phishing

Cloud Threats Memo: Threat Actors Continue to Exploit the Flexibility of GitHub for Malicious Purposes

June 5, 20233 min read

Cloud Threats Memo: More Details on Long-Lasting Campaigns Targeting Eastern Europe

May 19, 20232 min read

Netskope Threat Labs Stats for April 2023

Netskope Threat Labs Stats for April 2023

May 18, 20235 min read

Malware Ransomware

Threat Labs News Roundup: April 2023

May 8, 20234 min read

Cloud Threats Memo: North-Korean State-Sponsored Threat Actors Continue to Exploit Legitimate Cloud Services

May 4, 20233 min read

Netskope Threat Coverage: CrossLock Ransomware

Ransomware Malware

Netskope Threat Coverage: CrossLock Ransomware

May 2, 20233 min read

Cloud Threats Memo: Threat Actors Increasingly Exploiting Google Drive

April 21, 20233 min read

Netskope Threat Labs Stats for March 2023

Netskope Threat Labs Stats for March 2023

April 21, 20235 min read

Malware Ransomware

Threat Labs News Roundup: March 2023

April 10, 20234 min read

Cloud Espionage

Netskope Cloud Threats Memo: Cyber Espionage Campaign Abusing OneDrive and Dropbox

March 29, 20232 min read

Emotet Comeback: New Campaign Using Binary Padding to Evade Detection

Emotet Comeback: New Campaign Using Binary Padding to Evade Detection

March 22, 20233 min read

Netskope Threat Labs Stats for February 2023

Netskope Threat Labs Stats for February 2023

March 21, 20236 min read

Netskope Threat Coverage: BlackSnake Ransomware

Ransomware Malware

Netskope Threat Coverage: BlackSnake Ransomware

March 16, 20236 min read

Cloud Threats Memo: Cyber Espionage Campaign Using Remote Access Tools

Malware Espionage

Cloud Threats Memo: Cyber Espionage Campaign Using Remote Access Tools

March 14, 20232 min read

Malware Ransomware

Threat Labs News Roundup: February 2023

March 7, 20234 min read

Malware Espionage

Cloud Threats Memo: Multiple Different Cloud Apps Abused in a Single Cyber Espionage Campaign

March 3, 20233 min read

Netskope Threat Labs Stats for January 2023

Malware Ransomware

Netskope Threat Labs Stats for January 2023

February 21, 20235 min read

Malware Ransomware

Threat Labs News Roundup: January 2023

February 16, 20234 min read

ChatGPT: Dispelling FUD, Driving Awareness About Real Threats

ChatGPT: Dispelling FUD, Driving Awareness About Real Threats

January 20, 20236 min read

Cloud Threats Memo: Threat Actors Continue to Abuse Cloud Services to Deliver Malware in 2023

January 19, 20233 min read

Cloud Threats Memo: Understanding the Dead Drop Resolver Technique

December 13, 20222 min read

Cloud Threats Memo: Cyber Espionage Exploiting Google Drive for C2 Infrastructure

December 6, 20222 min read

Malware Phishing

Cloud Threats Memo: Yet Another Cyber Espionage Campaign Exploiting Cloud Services

November 30, 20222 min read

Netskope Threat Coverage: Prestige Ransomware

Ransomware Malware

Netskope Threat Coverage: Prestige Ransomware

November 18, 20224 min read

BlackCat Ransomware: Tactics and Techniques From a Targeted Attack

Ransomware Malware

BlackCat Ransomware: Tactics and Techniques From a Targeted Attack

November 9, 202213 min read

RedLine Stealer Campaign Abusing Discord via PDF Links

Malware Phishing

RedLine Stealer Campaign Abusing Discord via PDF Links

October 3, 20225 min read

Cloud Threats Memo: Lampion Exploiting WeTransfer to Deliver Malware

September 13, 20222 min read

AsyncRAT: Using Fully Undetected Downloader

AsyncRAT: Using Fully Undetected Downloader

August 29, 20226 min read

Ousaban: LATAM Banking Malware Abusing Cloud Services

Ousaban: LATAM Banking Malware Abusing Cloud Services

August 4, 20227 min read

Cloud Threats Memo: Cloud Storage Services are Increasingly Exploited to Deliver Malware

August 2, 20222 min read

Cloud Threats Memo: Dropbox: Flexible Cloud Storage Increasingly Exploited by Attackers

July 26, 20222 min read

Microsoft’s Macro Reversal Invites a Resurgence of Office Malware

Microsoft’s Macro Reversal Invites a Resurgence of Office Malware

July 8, 20221 min read

Emotet: Still Abusing Microsoft Office Macros

Emotet: Still Abusing Microsoft Office Macros

June 27, 20224 min read

CVE-2022-30190: New Zero-Day Vulnerability (Follina) in Microsoft Support Diagnostic Tool

Vulnerability Malware

CVE-2022-30190: New Zero-Day Vulnerability (Follina) in Microsoft Support Diagnostic Tool

June 1, 20223 min read

RedLine Stealer Campaign Using Binance Mystery Box Videos to Spread GitHub-Hosted Payload

Malware Credential Theft

RedLine Stealer Campaign Using Binance Mystery Box Videos to Spread GitHub-Hosted Payload

May 12, 20226 min read

Emotet: New Delivery Mechanism to Bypass VBA Protection

Emotet: New Delivery Mechanism to Bypass VBA Protection

May 6, 20225 min read

Office Documents and Cloud Apps: Perfect for Malware Delivery

Malware Phishing

Office Documents and Cloud Apps: Perfect for Malware Delivery

March 22, 20225 min read

New Formbook Campaign Delivered Through Phishing Emails

Malware Phishing

New Formbook Campaign Delivered Through Phishing Emails

March 11, 20229 min read

Netskope Threat Coverage: HermeticWiper

Netskope Threat Coverage: HermeticWiper

February 25, 20224 min read

Microsoft Office: VBA Blocked By Default in Files From the Internet

Malware Phishing

Microsoft Office: VBA Blocked By Default in Files From the Internet

February 24, 20227 min read

Cloud Threats Memo: Keeping Collaboration Apps Secure

February 22, 20222 min read

Netskope Threat Coverage: WhisperGate

Netskope Threat Coverage: WhisperGate

January 26, 20227 min read

Infected PowerPoint Files Using Cloud Services to Deliver Multiple Malware

Phishing Malware

Infected PowerPoint Files Using Cloud Services to Deliver Multiple Malware

January 24, 20227 min read

Abusing Microsoft Office Using Malicious Web Archive Files

Malware Phishing

Abusing Microsoft Office Using Malicious Web Archive Files

January 12, 20226 min read

Khonsari: New Ransomware Delivered Through Log4Shell

Ransomware Malware

Khonsari: New Ransomware Delivered Through Log4Shell

December 16, 20214 min read

Over-Privileged Service Accounts Create Escalation of Privileges and Lateral Movement in Google Cloud

Cloud Credential Theft

Over-Privileged Service Accounts Create Escalation of Privileges and Lateral Movement in Google Cloud

December 2, 202113 min read

Black Friday is Coming and LNKR Malware Might Be Watching You

Black Friday is Coming and LNKR Malware Might Be Watching You

November 24, 20214 min read

Malicious Office Documents: Multiple Ways to Deliver Payloads

Malicious Office Documents: Multiple Ways to Deliver Payloads

November 19, 20214 min read

Netskope Threat Coverage: The Return of Emotet

Netskope Threat Coverage: The Return of Emotet

November 18, 20213 min read

Cloud Threats Memo: BazarLoader Exploiting Popular Cloud Services

October 25, 20212 min read

DBatLoader: Abusing Discord to Deliver Warzone RAT

Malware Credential Theft

DBatLoader: Abusing Discord to Deliver Warzone RAT

October 21, 20214 min read

Cloud Threats Memo: Defining the Latest Dropbox Threat

October 12, 20212 min read

SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot

Malware Command and Control

SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot

October 7, 20216 min read

BazarLoader: Using LoLBins through Office Documents to Deliver Payloads

BazarLoader: Using LoLBins through Office Documents to Deliver Payloads

September 22, 20214 min read

Microsoft Office Document Triggering New Zero-Day

Vulnerability Malware

Microsoft Office Document Triggering New Zero-Day

September 13, 20214 min read

Hive Ransomware: Actively Targeting Hospitals

Ransomware Malware

Hive Ransomware: Actively Targeting Hospitals

September 10, 20219 min read

Netskope Threat Coverage: BlackMatter

Ransomware Malware

Netskope Threat Coverage: BlackMatter

August 23, 20218 min read

Netskope Threat Coverage: LockBit

Ransomware Malware

Netskope Threat Coverage: LockBit

August 12, 20214 min read

Netskope Threat Coverage: 2020 Tokyo Olympics Wiper Malware

Netskope Threat Coverage: 2020 Tokyo Olympics Wiper Malware

July 29, 20214 min read

July 2021 Netskope Cloud and Threat Report

July 2021 Netskope Cloud and Threat Report

July 20, 20211 min read

Cloud Threats Memo: Hancitor Continues Exploiting DocuSign and Google Docs Templates

Malware Phishing

Cloud Threats Memo: Hancitor Continues Exploiting DocuSign and Google Docs Templates

July 15, 20211 min read

Cloud Threats Memo: Preventing the Exploitation of Dropbox as a Command and Control

July 8, 20211 min read

Netskope Threat Coverage: REvil

Ransomware Supply Chain

Netskope Threat Coverage: REvil

July 7, 20213 min read

Not Laughing: Malicious Office Documents using LoLBins

Not Laughing: Malicious Office Documents using LoLBins

June 29, 20214 min read

Cloud Threats Memo: Keeping Distributed Workforces Secure

May 25, 20211 min read

Ransomware Malware

Netskope Threat Coverage: DarkSide

May 11, 20211 min read

Cloud and Threat Report: Cloudy with a Chance of Malware

Cloud and Threat Report: Cloudy with a Chance of Malware

April 28, 20213 min read

Malware Phishing

Cloud Threats Memo: Malicious Campaigns Taking Advantage of Well-known Collaboration Apps

April 20, 20211 min read

Netskope Threat Coverage: EtterSilent

Malware Phishing

Netskope Threat Coverage: EtterSilent

April 14, 20212 min read

Phishing Malware

Cloud Threats Memo: LinkedIn Spearphishing and Malware-as-a-Service

April 13, 20211 min read

Phishing Malware

Cloud Threats Memo: Dridex Phishing Posing as COVID-19 Relief

March 19, 20211 min read

Cloud and Threat Report: Was 2020 the Year of the Malicious Office Document?

Malware Phishing

Cloud and Threat Report: Was 2020 the Year of the Malicious Office Document?

March 16, 20213 min read

Ransomware Malware

Netskope Threat Coverage: DearCry Ransomware

March 15, 20211 min read

Malware Phishing

Cloud Threats Memo: Protecting Against Hancitor Distributed Through Malicious Office Documents

March 4, 20211 min read

Cloud Threats Memo: Hard Times for ARM-based Mac M1 Processors

February 23, 20212 min read

Understanding Cloud as an Attack Vector

February 19, 20211 min read

You Can Run, But You Can’t Hide: Advanced Emotet Updates

Malware Phishing

You Can Run, But You Can’t Hide: Advanced Emotet Updates

January 14, 20216 min read

Supply Chain Malware

Netskope Threat Coverage: SUNBURST & FireEye Red Team (Offensive Security) Tools

December 15, 20202 min read

Here Comes TroubleGrabber: Stealing Credentials Through Discord

Credential Theft Malware

Here Comes TroubleGrabber: Stealing Credentials Through Discord

November 13, 20209 min read

Leaky Chats: Accidental Exposure and Malware in Discord Attachments

Leaky Chats: Accidental Exposure and Malware in Discord Attachments

November 4, 20205 min read

OMNI (MIRAI variant) Botnet Infections Detected in Polycom Video Conferencing Devices

October 26, 20206 min read

You Can Run, But You Can’t Hide: Detecting Malicious Office Documents

Malware Phishing

You Can Run, But You Can’t Hide: Detecting Malicious Office Documents

October 8, 20207 min read

Dangerous Docs: Surge in Cloud-delivered Malicious Office Documents

Dangerous Docs: Surge in Cloud-delivered Malicious Office Documents

September 30, 20203 min read

Leaky Images: Accidental Exposure and Malware in Google Photos and Hangouts

September 29, 20205 min read

Netskope Threat Coverage: Emotet

Netskope Threat Coverage: Emotet

September 15, 20202 min read

Netskope Threat Coverage: GuLoader

August 10, 20201 min read

Leaky Helpdesk - Accidental Exposure of Zendesk Attachments

Leaky Helpdesk - Accidental Exposure of Zendesk Attachments

July 22, 20203 min read

Lnkr Makes a Comeback - This Ad’s For Us

Lnkr Makes a Comeback - This Ad’s For Us

July 10, 20205 min read

Netskope @ Nullcon Goa 2020

Netskope @ Nullcon Goa 2020

April 7, 20201 min read

A MITRE-based Analysis of a Cloud Attack

A MITRE-based Analysis of a Cloud Attack

January 23, 20205 min read

Ad Injector Dulls Chrome's Luster

Ad Injector Dulls Chrome's Luster

December 10, 20194 min read

MalCon Recap

MalCon Recap

November 19, 20191 min read

GitHub Pages Spread Ramnit

Malware Supply Chain

GitHub Pages Spread Ramnit

October 4, 20192 min read

New Adwind Campaign targets US Petroleum Industry

New Adwind Campaign targets US Petroleum Industry

October 1, 20194 min read

Why the Future of Command and Control is the Cloud

Why the Future of Command and Control is the Cloud

August 10, 20193 min read

Permission Isolation in GCP

Permission Isolation in GCP

August 9, 20195 min read

Pardot CRM Attack

Pardot CRM Attack

August 8, 20194 min read

LokiBot & NanoCore being distributed via ISO disk image files

LokiBot & NanoCore being distributed via ISO disk image files

June 25, 20194 min read

Ransomware Bulletin: LockerGoga

Ransomware Malware

Ransomware Bulletin: LockerGoga

May 13, 20195 min read

A Malicious Sight in Google Sites

A Malicious Sight in Google Sites

April 23, 20197 min read

CapitalInstall hosted and served via IaaS

CapitalInstall hosted and served via IaaS

December 11, 20186 min read

Cryptojackers on the hunt for your IaaS resources

Cryptojackers on the hunt for your IaaS resources

June 14, 20185 min read

Technical Analysis of Xbooster parasitic Monero Miner

Crypto Ransomware

Technical Analysis of Xbooster parasitic Monero Miner

May 21, 20187 min read

Xbooster Parasitic Monero Mining Campaign

Crypto Ransomware

Xbooster Parasitic Monero Mining Campaign

May 9, 20185 min read

Resurgence of Phishing-as-a-Service (PhaaS) platforms

Resurgence of Phishing-as-a-Service (PhaaS) platforms

April 18, 20187 min read

Netskope Discovers ATMJackpot Siphoning Cash

Netskope Discovers ATMJackpot Siphoning Cash

April 5, 20182 min read

ShortJSRAT leverages cloud with scriptlets

ShortJSRAT leverages cloud with scriptlets

February 7, 20189 min read

Pony Malware - How to Protect User and Wallet Data

Pony Malware - How to Protect User and Wallet Data

January 24, 20186 min read

Git Your RATs Here!

Git Your RATs Here!

January 17, 20188 min read

TelegramRAT evades traditional defenses via the cloud

Malware Vulnerability

TelegramRAT evades traditional defenses via the cloud

December 18, 20177 min read

Targeted Attack BadWolf Exploits Office Vulnerabilities to Exfiltrate Data

Malware Vulnerability

Targeted Attack BadWolf Exploits Office Vulnerabilities to Exfiltrate Data

December 14, 20175 min read

Phishing Attacks on Retail Industry Ramp Up as the Holiday Shopping Season Approaches

Phishing Malware

Phishing Attacks on Retail Industry Ramp Up as the Holiday Shopping Season Approaches

December 13, 20175 min read

Cloud CRM Spreads Locky Ransomware via DDE Exploit

Ransomware Malware

Cloud CRM Spreads Locky Ransomware via DDE Exploit

December 12, 20176 min read

Stepping Stone Attack launches EternalBlue Internally

Malware Vulnerability

Stepping Stone Attack launches EternalBlue Internally

November 2, 20175 min read

Resurgence of Locky Ransomware with LUKITUS extension

Malware Ransomware

Resurgence of Locky Ransomware with LUKITUS extension

August 18, 20174 min read

Adwind RAT employs new obfuscation techniques

Malware Phishing

Adwind RAT employs new obfuscation techniques

August 3, 20174 min read

Netskope Threat Research Labs analysis of ongoing cloud aware data theft attack

Netskope Threat Research Labs analysis of ongoing cloud aware data theft attack

July 25, 20174 min read

Obfuscated Javascript Malware using Cloud Services

Obfuscated Javascript Malware using Cloud Services

May 17, 20175 min read

Google Doc CloudPhishing Worm Attack Technical Analysis

Google Doc CloudPhishing Worm Attack Technical Analysis

May 4, 20176 min read

Latest Microsoft Office Zero-day Served via Godzilla Botnet

Vulnerability Malware

Latest Microsoft Office Zero-day Served via Godzilla Botnet

April 11, 20171 min read

Analysis of the Godzilla Botnet Loader’s Evasive Techniques

Analysis of the Godzilla Botnet Loader’s Evasive Techniques

April 7, 20175 min read

Macro-based Office Malware using Cloud Services

Macro-based Office Malware using Cloud Services

March 22, 20175 min read

Cloud CRM Services as a Malware Attack Vector

Cloud CRM Services as a Malware Attack Vector

February 9, 20176 min read

Decoys, RATs, and the Cloud: The growing trend

Malware Vulnerability

Decoys, RATs, and the Cloud: The growing trend

February 3, 20177 min read

Ransomware + Click Fraud: A New Blended Attack

Ransomware + Click Fraud: A New Blended Attack

January 30, 20178 min read

Virlock’s resurgence poses bigger threat to file syncing over the cloud

Virlock’s resurgence poses bigger threat to file syncing over the cloud

January 30, 20172 min read

Decoys, Phishing, and the Cloud: The Latest Fan-out Effect

Decoys, Phishing, and the Cloud: The Latest Fan-out Effect

January 18, 20176 min read

CloudFanta Malware Campaign Technical Analysis

CloudFanta Malware Campaign Technical Analysis

October 25, 20169 min read

CloudFanta Pops with the Cloud using SugarSync

CloudFanta Pops with the Cloud using SugarSync

October 18, 20163 min read

Nitol Botnet makes a resurgence with evasive sandbox analysis technique

Nitol Botnet makes a resurgence with evasive sandbox analysis technique

October 14, 20164 min read

Cloud Malware Fan-out with Virlock Ransomware

Cloud Malware Fan-out with Virlock Ransomware

September 27, 20166 min read

Zepto Ransomware Variant of Locky Being Delivered Via DLL

Zepto Ransomware Variant of Locky Being Delivered Via DLL

September 9, 20162 min read

URSNIF Data Theft Malware Shared on Microsoft OneDrive

URSNIF Data Theft Malware Shared on Microsoft OneDrive

August 2, 20165 min read

Netskope Threat Research Labs Technical Analysis: CloudSquirrel Malware

Netskope Threat Research Labs Technical Analysis: CloudSquirrel Malware

July 27, 20168 min read

Zepto variant of Locky ransomware delivered via popular Cloud Storage apps

Zepto variant of Locky ransomware delivered via popular Cloud Storage apps

July 19, 20165 min read

CloudSquirrel Malware Squirrels Away Sensitive User Data Using Popular Cloud Apps

CloudSquirrel Malware Squirrels Away Sensitive User Data Using Popular Cloud Apps

July 15, 20162 min read

cuteRansomware Uses Google Docs to Fly Under Radar

cuteRansomware Uses Google Docs to Fly Under Radar

July 12, 20165 min read

Anatomy of a Ransomware Attack: Cerber Uses Steganography to “Hide in Plain Sight”

Anatomy of a Ransomware Attack: Cerber Uses Steganography to “Hide in Plain Sight”

June 30, 20166 min read