Blog

Watch Where You Browse - The Fallout Exploit Kit Stays Active

Attackers are turning even the most common activities into a possible threat. Read about the latest example of this trend here.

Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers

In 2018, the Cybereason Nocturnus team identified an advanced, persistent attack targeting global telecommunications providers.

Adobe Worm Faker Uses LOLbins And Dynamic Techniques To Deliver Customized Payloads

We have found an active malware that uses LOLBins and delivers customized payloads called Adobe Worm Faker.

New Pervasive Worm Exploiting Linux Exim Server Vulnerability

There’s an active, ongoing campaign exploiting a widespread vulnerability in linux email servers. Read about the attack first here.

Excel4.0 Macros - Now with Twice The Bits!

In this research, we outline how to enable the execution of 64-bit shellcode via Excel 4.0 macros and previous research on 32-bit shellcode.

GandCrab's new Evasive Infection Chain

Ransomware is not a new form of attack, but GandCrab has upgraded it to be more dynamic and harder to resolve.

Threat Actor TA505 Targets Financial Enterprises Using LOLBins and a New Backdoor Malware

In this research, we introduce a meticulously planned, malicious operation against a financial institution in April of 2019 by TA505.

How to Generate a Hypothesis for a Threat Hunt

Many find the process of threat hunting to be too demanding. What are you supposed to hunt? Where do you even begin?

A One-two Punch of Emotet, TrickBot, & Ryuk Stealing & Ransoming Data

The Cybereason team has identified a malware campaign that combines Emotet, TrickBot, and Ryuk to steal and ransom data.

Triple Threat: Emotet Deploys TrickBot to Steal Data & Spread Ryuk

The Cybereason team has uncovered a severe threat that adapts Emotet to drop TrickBot, and adapts TrickBot to not only steal data but also download the Ryuk ransomware.