Search Results for “@RoxpinTeddy”

We’ve previously reported on a Nokoyawa ransomware case in which the initial access was via an Excel macro and IcedID malware. This case, which also ended in Nokoyawa Ransomware, involved … Read More

adfind bumblebee cobaltstrike Meterpreter

BumbleBee Zeros in on Meterpreter

editor November 14, 2022

In this intrusion from May 2022, the threat actors used BumbleBee as the initial access vector from a Contact Forms campaign. We have previously reported on two BumbleBee intrusions (1, … Read More

exploit Fast Reverse Proxy PHOSPHORUS ProxyShell

PHOSPHORUS Automates Initial Access Using ProxyShell

editor March 21, 2022

In December 2021, we observed an adversary exploiting the Microsoft Exchange ProxyShell vulnerabilities to gain initial access and execute code via multiple web shells. The overlap of activities and tasks … Read More

adfind cobaltstrike icedid mountlocker xinglocker

IcedID to XingLocker Ransomware in 24 hours

editor October 18, 2021

Intro Towards the end of July, we observed an intrusion that began with IcedID malware and ended in XingLocker ransomware, a Mountlocker variant. XingLocker made its first appearance in early … Read More

adfind BazarCall cobaltstrike conti ransomware trickbot

BazarCall to Conti Ransomware via Trickbot and Cobalt Strike

editor August 1, 2021

Intro This report will go through an intrusion that went from an Excel file to domain wide ransomware. The threat actors used BazarCall to install Trickbot in the environment which … Read More

Analysts

Current Analysts: @kostastsale – Reports @RoxpinTeddy – Reports @iiamaleks – Reports @pigerlin – Reports @tas_kmanager – Reports @samaritan_o – Reports @MetallicHack – Reports @yatinwad – Reports @_pete_0 – Reports @v3t0_ – … Read More

cobaltstrike conti icedid ransomware

Conti Ransomware

editor May 12, 2021

Introduction First seen in May 2020, Conti ransomware has quickly become one of the most common ransomware variants, according to Coveware. As per Coveware’s Quarterly Ransomware Report (Q1 2021), Conti … Read More

trickbot

Trickbot Brief: Creds and Beacons

editor May 2, 2021

Intro “TrickBot malware—first identified in 2016—is a Trojan developed and operated by a sophisticated group of cybercrime actors. The cybercrime group initially designed TrickBot as a banking trojan to steal … Read More

Search Results for: @RoxpinTeddy

HTML Smuggling Leads to Domain Wide Ransomware