Microsoft’s latest threat intelligence report highlights an ongoing trend where threat actors exploit legitimate file-hosting services, such as OneDrive, SharePoint, and Dropbox, to deliver identity-focused phishing attacks. These services’ familiarity…
Introduction In September 2024, JPCERT/CC released a detailed blog post uncovering how Windows Event Logs can be a powerful tool for identifying human-operated ransomware campaigns. The research focuses on notable…
A recent analysis of the LummaC2 (LUMMAC.V2) malware reveals its use of advanced obfuscation techniques, specifically leveraging indirect control flow manipulation to make reverse engineering significantly more challenging. This type…
CVE-2022-38028 is a critical vulnerability in the Windows Print Spooler service that allows for arbitrary code execution with elevated privileges. The exploit was addressed by Microsoft in a security update…
A new phishing campaign leveraging Autodesk Drive has come to light, targeting corporate users through seemingly legitimate PDF files. Cybersecurity experts at Netcraft have uncovered that attackers are exploiting compromised…
Overview A critical vulnerability, designated as CVE-2024-3400, has been identified within the GlobalProtect component of Palo Alto Networks’ PAN-OS. This zero-day flaw is classified under CWE-77 (Command Injection) due to…
The recent paper, “You Cannot Escape Me: Detecting Evasions of SIEM Rules in Enterprise Networks” highlights the ongoing battle in cybersecurity between attackers’ evasion tactics and the defenders’ efforts to…
LummaC2, a notorious malware-as-a-service (MaaS), has developed sophisticated evasion techniques to circumvent security measures and exfiltrate sensitive data from compromised systems. The malware, written in C, has been operational since…
The NetSupport RAT has emerged as a significant cyber threat, exploiting legitimate remote administration tools for malicious purposes. This report provides an in-depth analysis of recent incidents, targets, and the…
APT29, a Russian hacker group, has strategically employed the CVE-2023-38831 vulnerability in WinRAR in a series of cyberattacks targeting embassies. Known for its various aliases, including Cozy Bear and SolarStorm,…