TeamTNT evades detection with new malware using ld_preload technique
A new piece of malware from the TeamTNT threat group is using a different Unix technique to evade detection and to install a bot in the compromised machines...
Malware analysis
Blackrota abused Docker remote API to deliver CobalStrike beacon
The Blackrota backdoor is a piece of malware analyzed by NetLab and is the most obfuscated Go-developed executable and linkable format (ELF) malware found to date.
APT Sandworm (NotPetya) technical overview
Sandworm, also known as Telebots, is one of the most dangerous Russian threat actors impacting industrial control systems.
MRBMiner malware: What it is, how it works and how to prevent it | Malware spotlight
MrbMiner is a recent malware discovered and documented by the Tencent Team last September. It targets MSSQL databases and implants cryptomining modules on target...
Fileless Windows Error Reporting (WER) malware attack: Technical overview and walkthrough
In October 2020, a newly uncovered malware named Kraken was observed in the wild. This malicious piece of malware is abusing the Windows Error Reporting service...
Bandook malware: What it is, how it works and how to prevent it
Bandook malware is a remote access trojan (RAT) first seen in 2007 and active for several years.
Bandook RAT, written in both Delphi and C++, was first seen...
Ghimob Trojan Banker: What it is, how it works and how to prevent it | Malware spotlight
Introduction
Malware is a popular term used to classify software with bad proposes that is part of our lives these days. Ghimob Trojan Banker is one of the...
Stantinko Trojan: What it is, how it works and how to prevent it | Malware spotlight
The number of threats attacking Linux systems have exploded in recent days. Within this context, a botnet that impacted several countries in the past, including...
Vizom malware: What it is, how it works and how to prevent it | Malware spotlight
The Vizom Trojan is an active piece of malware targeting online banking users in Brazil that takes advantage of the window overlay technique to steal user’s...
CISA report: Iranian web shells (and other MARs)
The Cybersecurity & Infrastructure Security Agency (CISA) published a Malware Analysis Report (AR20-259A) regarding MAR-10297887-1.v1 – Iranian Web...