Security Research

Are we done with WannaCry?

Several customers and industry analysts frequently ask us (and other vendors) about independent validation of our capabilities. We wanted to share information about a recent test conducted by MRG-Effitas to validate the effectiveness of various traditional and next-generation endpoint security suites against the EternalBlue and Doublepulsar exploits/backdoor. These threats were unearthed by “The Shadow Brokers” […]

READ MORE

Armory Sandbox – Building a USB analyzer with USB armory

Some time ago a friend received a mysterious USB pen with a note talking about some kind of heavily persistent malware. He had that USB pen stored untouched and of course my curiosity took over. Since one should never plug in unknown USB devices into a computer (well, any USB device we purchase is unknown […]

READ MORE

“Zusy” PowerPoint Malware Spreads Without Needing Macros

By Caleb Fenton and Itai Liba, Senior Security Researchers, SentinelOne Labs A new variant of a malware called “Zusy” has been found in the wild spreading as a PowerPoint file attached to spam emails with titles like “Purchase Order #130527” and “Confirmation”. It’s interesting because it doesn’t require the user to enable macros to execute. […]

READ MORE

New “Widia” Ransomware Asks for Credit Card for Payment

By Caleb Fenton and Itai Liba, Senior Security Researchers, SentinelOne Labs While hunting for new types of undetected ransomware, we came across a sample we’re calling Widia. Below is the ransom note it displays once it’s infected the device: Your documents, photos, databases and other important files have been encrypted with the strongest encryption and unique […]

READ MORE

SentinelOne Detects Shadow Broker Binaries with DFI

Waves of panic were sent through the cybersecurity community as suspected NSA spying tools were released by the Shadow Broker group. What appeared to be potentially one of the most damaging releases of nation-state tool, zero-day exploits was quickly neutralized. Microsoft came forward to announce that although the files contained about 20 different Windows-based exploits, […]

READ MORE

CVE-2017-0199: What REAL 0-Day Vulnerability Protection Looks Like

News of a Microsoft Word 0-day vulnerability spread like wildfire this week. Discovered by FireEye, the attack uses is executed when a user opens a Word attachment that includes a malicious OLE2 (Object Linking and Embedding) embedded in a specially-crafted Word document that can then spread the Dridex banking Trojan. The 0-day vulnerability, CVE-2017-0199, was […]

READ MORE

Malware Analyst’s Guide to Bitcoin

Why Should You Care? Criminals are using Bitcoin and other cryptocurrencies for handling payments for selling stolen data, hacking services such as DDoS, and for ransomware payments. If you want to follow the money and better understand threat actors, you’ll need to understand Bitcoin and how to analyze transactions.bitcoin It’s important to keep up with […]

READ MORE

Windows Shortcut File or .LNK Files Sneaking In Malware

Malicious actors keep us on our toes as they move from executables (.EXE) and scripts files to .LNK file to sneak in their payloads. With email servers routinely configured to reject attachments with file extensions like .exe, .pif, and .com, attackers have gotten more creative with their deception techniques. From Locky to Kovter, the most […]

READ MORE

The Anatomy of a DDoS Attack

Distributed denial of service or DDoS attacks are a big deal in today’s cybersecurity world. Time and time again, you’ll hear about a DDoS attack that took down a website or part of a company or government system. So what do these attacks do? What is a DDoS Attack? Behind the fancy name of “distributed […]

READ MORE