How attackers are changing their approach to writing phishing emails
📬 How attackers are changing their approach to writing phishing emails Recently, we came across an email with a malicious attachment sent by the group Hive0117…
[ FEED // CHRONO // 267 ITEMS ]
ALL MATERIALS
SMS stealers of Asia: 1000 bots and one study
✈️ In our last post, we explained that Telegram is becoming more popular among hackers in the C2 as a service paradigm Exfiltration of victim data to attackers'…
A cart full of hackers
Hackers' Telegram Cart According to the latest trends (e.g., Lazy Koala), attackers are increasingly resorting to data exfiltration or C2 channels via the Teleg…
Missed the moment a phishing attachment was launched again?
Missed the moment a phishing attachment was launched again? 📩 So what? The accountant is sure it was an "invoice" from a trusted bank. It's time to teach SIEM s…
Do you see the authorization form? No. Neither do I. But it's there 🤔
Do you see the authorization form? No. Neither do I. But it's there 🤔 During a recent investigation of one of the incidents, we encountered exploitation by atta…
One-two — and done. Generating FLIRT signatures
👏 One-two — and done. Generating FLIRT signatures And we do this to avoid wasting time on recognizing the library code of PureBasic, in which the COM-DLL-Droppe…
Cobalt Strike Beacon and MSBuild
🥷 Cobalt Strike Beacon and MSBuild The practice of our incident investigations shows that threat actors are still using the Microsoft Build Engine to compile .N…
Proactive hunting for C2 servers
Proactive Hunting for C2 Servers 👨💻 In the process of hunting for C2 servers, an important question arises — which artifacts to use for better effectiveness an…
While investigating the incident, we discovered a useful artifact smb_context
💻 While investigating an incident, we discovered a useful artifact, smb_context C:\Windows\SysWOW64\smb_context.log — the SMB event log from a well-known antivi…
Rapid decryption of data from an NSIS script
Rapid decryption of data from an NSIS script 🗄 When there's no time to identify the encryption algorithm and implement a decryption algorithm, a debugger comes…
Exchange_SSRF
📬 Exchange_SSRF Our practice shows that a fairly large number of organizations still have not installed updates on their public Microsoft Exchange mail servers…
Metamorphosis of Lazy Koala
Lazy Koala's Metamorphosis. It was Koala 🐨 — now it's Capybara 😎 In May of this year, new attacks by the Lazy Koala group against Azerbaijan, Belarus, and Uzbek…