Advanced Persistent Threat

NobleBaron New Poisoned Installers Could Be Used In Supply Chain Attacks 2

NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks

Nobelium – the new face of APT29 – deploys poisoned installers against Ukrainian government targets in a possible supply chain attack.

Read More
SolarWinds   Understanding Detecting The SUPERNOVA Webshell Trojan 3

SolarWinds | Understanding & Detecting the SUPERNOVA Webshell Trojan

Our analysis of the SUPERNOVA trojan reveals the differences between the legitimate DLL and the attacker’s implant, along with some new IoCs for detection.

Read More
SolarWinds SunBurst Backdoor  Inside The Stealthy APT Campaign 1

SolarWinds SUNBURST Backdoor: Inside the APT Campaign

A technical analysis of the SUNBURST stealthy APT including processes, services, and drivers. SentinelOne customers protected with no updates or configuration changes.

Read More
The Anatomy Of An APT Attack And CobaltStrike Beacon’s Encoded Configuration 3

The Anatomy of an APT Attack and CobaltStrike Beacon’s Encoded Configuration

Cybercrime and nation state attacks haven’t come to a stop due to COVID-19. Here we describe a recent APT attack on a global brand prevented by SentinelOne.

Read More
Breaking TA505s Crypter With An SMT Solver 1

Breaking TA505’s Crypter with an SMT Solver

TA505 threat group use a crypter common to Clop/CryptoMix ransomware and others. We tear it down with a new unpacker utilizing SMT.

Read More
DPRK HiddenCobra Update  North Korean Malicious Cyber Activity 1

DPRK Hidden Cobra Update: North Korean Malicious Cyber Activity

New threat intelligence on the ever-expanding toolset of North Korean APT Hidden Cobra (Lazarus) including IoCs for RATs, beacons, persistence and more.

Read More
From Office Macro Malware To Lightweight JS Loader 10 1

Deep Insight into “FIN7” Malware Chain: From Office Macro Malware to Lightweight JS Loader

Vitali Kremez dissecting the ‘Fin7’ malware chain that leverages malicious MS Office Macros and a JS loader.

Read More
FIN6 “FrameworkPOS”  Point Of Sale Malware Analysis Internals 1

FIN6 “FrameworkPOS”: Point-of-Sale Malware Analysis & Internals

Vitali Kremez diving into the FIN6 “FrameworkPOS”, targeting payment card data from Point-of-Sale (POS) or eCommerce systems.

Read More