Crimeware

Anchor Project for Trickbot Adds ICMP

Jason Reaves / October 29, 2020

The team behind Trickbot has been aggressively updating and deploying various modules including Anchor and Bazar Loader targeting high-value targets, including healthcare entities

Crimeware

An Inside Look at How Ryuk Evolved Its Encryption and Evasion Techniques

Marco Figueroa / October 22, 2020

Ryuk’s success is based partly on leveraging other toolkits and vulns, partly on its encryption speed and evasion tricks. We tear it down for a closer look.

Crimeware

Purple Fox EK | New CVEs, Steganography, and Virtualization Added to Attack Flow

Gal Kristal / October 19, 2020

New research shows that the Purple Fox exploit kit has added new tricks to its attack flow and continues to target vulnerable versions of Internet Explorer.

Crimeware

The FONIX RaaS | New Low-Key Threat with Unnecessary Complexities

Jim Walter / October 6, 2020

FONIX RaaS uses four methods of encryption per file and leads victims (and affiliates) on a merry dance through multiple emails to obtain decryption.

Crimeware

Multi-Platform SMAUG RaaS Aims To See Off Competitors

Jim Walter / September 3, 2020

Raas (Ransomware-as-a-Service) continues to fuel the cybercrime economy. SMAUG offers Windows, Linux and macOS support among other unique features.

Crimeware

Agent Tesla | Old RAT Uses New Tricks to Stay on Top

Jim Walter / August 10, 2020

Aside from Dridex, Agent Tesla is the most widely used malware currently targeting businesses. We review its core functionality and latest adaptations.

Crimeware

WastedLocker Ransomware: Abusing ADS and NTFS File Attributes

Jim Walter / July 23, 2020

WastedLocker is a relatively new ransomware that has been attacking high-value targets across numerous industries, including several Fortune 500 companies.

Crimeware

Enter the Maze: Demystifying an Affiliate Involved in Maze (SNOW)

Jason Reaves / July 22, 2020

SentinelLabs profiles an affiliate involved with Maze ransomware and details the actor’s involvement with other crimeware families, including TrickBot.

Crimeware

Thanos Ransomware | RIPlace, Bootlocker and More Added to Feature Set

Jim Walter / July 1, 2020

Thanos Ransomware has developed rapidly over the last 6 months, offering a customized RaaS tool with an expanding feature set to build unique payloads.