Search Results for “@tas_kmanager”

Qbot Likes to Move It, Move It

editor February 7, 2022

Qbot (aka QakBot, Quakbot, Pinkslipbot ) has been around for a long time having first been observed back in 2007. More info on Qbot can be found at the following … Read More

adfind bazar cobaltstrike diavol ransomware

Diavol Ransomware

editor December 13, 2021

In the past, threat actors have used BazarLoader to deploy Ryuk and Conti ransomware, as reported on many occasions. In this intrusion, however, a BazarLoader infection resulted in deployment of … Read More

cobaltstrike trickbot

Trickbot Leads Up to Fake 1Password Installation

editor August 16, 2021

Intro Over the past years, Trickbot has established itself as modular and multifunctional malware. Initially focusing on bank credential theft, the Trickbot operators have extended its capabilities. More recently, Trickbot … Read More

Analysts

Current Analysts: @kostastsale – Reports @RoxpinTeddy – Reports @iiamaleks – Reports @pigerlin – Reports @tas_kmanager – Reports @samaritan_o – Reports @MetallicHack – Reports @yatinwad – Reports @_pete_0 – Reports @v3t0_ – … Read More

adfind cobaltstrike icedid

From Word to Lateral Movement in 1 Hour

editor June 20, 2021

Introduction In May 2021, we observed a threat actor conducting an intrusion utilizing the IcedID payloads for initial access. They later performed a number of techniques from host discovery to … Read More

cryptominer CVE-2020-14882

WebLogic RCE Leads to XMRig

editor June 3, 2021

Intro This report will review an intrusion where, the threat actor took advantage of a WebLogic remote code execution vulnerability (CVE-2020–14882) to gain initial access to the system before installing … Read More