research

Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Posted on by Admin
Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool

Investigating the PlugX Trojan Disguised as a Legitimate Windows Debugger Tool Malware Trend Micro’s Managed Extended Detection and Response (MxDR) team discovered that a file called x32dbg.exe was used to sideload a malicious DLL we identified as a variant of PlugX. By: Buddy Tancio, Abraham Camba, Catherine Loveria February 24, 2023 Read time:  ( words) Trend Micro’s Managed Extended Detection and Response (MxDR) team discovered that a file called x32dbg.exe was used (via the DLL…

Read More

A Deep Dive into the Evolution of Ransomware Part 2

Posted on by Admin
A Deep Dive into the Evolution of Ransomware Part 2

Ransomware has become an increasingly damaging presence, wreaking havoc on organizations of all sizes and across industries. Without understanding the traditions that underpin these malicious strategies, combatting them can feel like a daunting task. In part one, we explore ransomware’s evolution to gain perspective on how cybercriminals adapt their tactics in response to changing threats. This entry looks into factors that trigger changes in cyber criminals’ business models. Triggers for a paradigm shift Cybercriminals are…

Read More

A Deep Dive into the Evolution of Ransomware Part 1

Posted on by Admin
A Deep Dive into the Evolution of Ransomware Part 1

A Deep Dive into the Evolution of Ransomware Part 1 Ransomware This 3-part blog series takes an in-depth look at the evolution of ransomware business models, from the early stages to current trends. By: Trend Micro February 21, 2023 Read time:  ( words) Ransomware has become a notorious and damaging form of malware, inflicting financial losses on enterprises, governments, healthcare organizations and core infrastructure. Ransomware has been a very profitable activity for malicious actors. However,…

Read More

Royal ransomware expands attacks by targeting Linux ESXi servers

Posted on by Admin
Royal ransomware expands attacks by targeting Linux ESXi servers

Royal ransomware expands attacks by targeting Linux ESXi servers Ransomware actors have been observed to expand their targets by increasingly developing Linux-based versions. Royal ransomware is following in the same path, a new variant targeting Linux systems emerged and we will provide a technical analysis on this variant in this blog. By: Nathaniel Morales, Ivan Nicole Chavez, Byron Gelera February 20, 2023 Read time:  ( words) Ransomware actors have been observed to expand their targets by…

Read More

Earth Kitsune Delivers New WhiskerSpy Backdoor via Watering Hole Attack

Posted on by Admin
Earth Kitsune Delivers New WhiskerSpy Backdoor via Watering Hole Attack

Earth Kitsune Delivers New WhiskerSpy Backdoor via Watering Hole Attack APT & Targeted Attacks We discovered a new backdoor which we have attributed to the advanced persistent threat actor known as Earth Kitsune, which we have covered before. Since 2019, Earth Kitsune has been distributing variants of self-developed backdoors to targets, primarily individuals who are interested in North Korea. By: Joseph C Chen, Jaromir Horejsi February 17, 2023 Read time:  ( words) We discovered a…

Read More

Enigma Stealer Targets Cryptocurrency Industry with Fake Jobs

Posted on by Admin
Enigma Stealer Targets Cryptocurrency Industry with Fake Jobs

Enigma Stealer Targets Cryptocurrency Industry with Fake Jobs Malware We discovered an active campaign targeting Eastern Europeans in the cryptocurrency industry using fake job lures. By: Aliakbar Zahravi, Peter Girnus February 09, 2023 Read time:  ( words) We recently found an active campaign that uses a fake employment pretext targeting Eastern Europeans in the cryptocurrency industry to install an information stealer. In this campaign, the suspected Russian threat actors, use several highly obfuscated and underdevelopment…

Read More

Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Posted on by Admin
Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Introduction In 2022, we discovered a hacking group that has been targeting telecom, technology, and media sectors in Southeast Asia since 2020. We track this particular group as Earth Zhulong. We believe that Earth Zhulong is likely related to the Chinese-linked hacking group 1937CN based on similar code in the custom shellcode loader and victimology. In this post, we’ll introduce Earth Zhulong’s new tactics, techniques, and procedures (TTPs) in the recent campaign and the evolution…

Read More

Earth Zhulong Familiar Patterns Target Vietnam

Posted on by Admin
Earth Zhulong Familiar Patterns Target Southeast Asian Firms

Introduction In 2022, we discovered a hacking group that has been targeting telecom, technology, and media sectors in Vietnam since 2020. We track this particular group as Earth Zhulong. We believe that Earth Zhulong is likely related to the Chinese-linked hacking group 1937CN based on similar code in the custom shellcode loader and victimology. In this post, we’ll introduce Earth Zhulong’s new tactics, techniques, and procedures (TTPs) in the recent campaign and the evolution of…

Read More

Hijacking Your Bandwidth How Proxyware Apps Open You Up to Risk

Posted on by Admin
Hijacking Your Bandwidth How Proxyware Apps Open You Up to Risk

But is this true? To examine and understand the kind of risks a potential user might be exposed to by joining such programs, we recorded and analyzed network traffic from a large number of exit nodes of several different network bandwidth sharing services (exit nodes are computers who had these network bandwidth sharing services installed).   From January to September 2022, we recorded traffic coming from exit nodes of some of these passive income companies…

Read More

What SOCs Need to Know About Water Dybbuk

Posted on by Admin
What SOCs Need to Know About Water Dybbuk

What SOCs Need to Know About Water Dybbuk Cyber Crime We analyze a BEC campaign targeting large companies around the world that was leveraging open-source tools to stay under the radar. By: Stephen Hilt, Lord Alfred Remorin February 02, 2023 Read time:  ( words) BEC or Business Email Compromise is a significant problem for businesses around the world. According to the Federal Bureau of Investigation (FBI), BEC costs victims more money than ransomware, with an…

Read More
1 2 3 4 5 6 … 18