Crimeware

Egregor RaaS Continues The Chaos With Cobalt Strike Rclone 1

Egregor RaaS Continues the Chaos with Cobalt Strike and Rclone

Egregor ransomware is one of the more aggressive and complex RaaS families to date, with password-protected payloads designed to evade analysis.

Read More
Ranzy Ransomware   Better Encryption Among New Features Of ThunderX Derivative 5

Ranzy Ransomware | Better Encryption Among New Features of ThunderX Derivative

The Ranzy ransomware operators have learned from their mistakes and adapted quickly after ThunderX decryptors became publicly available.

Read More
Anchor Project For Trickbot Adds ICMP

Anchor Project for Trickbot Adds ICMP

The team behind Trickbot has been aggressively updating and deploying various modules including Anchor and Bazar Loader targeting high-value targets, including healthcare entities

Read More
Under The Hood   An Inside Look At How Ryuk Evolved Its Encryption And Evasion Techniques 6

An Inside Look at How Ryuk Evolved Its Encryption and Evasion Techniques

Ryuk’s success is based partly on leveraging other toolkits and vulns, partly on its encryption speed and evasion tricks. We tear it down for a closer look.

Read More
Purple Fox EK   New CVEs Steganography And Virtualization Added To Attack Flow 7

Purple Fox EK | New CVEs, Steganography, and Virtualization Added to Attack Flow

New research shows that the Purple Fox exploit kit has added new tricks to its attack flow and continues to target vulnerable versions of Internet Explorer.

Read More
The FONIX RaaS   New Low Key Threat With Unnecessary Complexities 6

The FONIX RaaS | New Low-Key Threat with Unnecessary Complexities

FONIX RaaS uses four methods of encryption per file and leads victims (and affiliates) on a merry dance through multiple emails to obtain decryption.

Read More
Multi Platform SMAUG RaaS Aims To See Off Competitors 6

Multi-Platform SMAUG RaaS Aims To See Off Competitors

Raas (Ransomware-as-a-Service) continues to fuel the cybercrime economy. SMAUG offers Windows, Linux and macOS support among other unique features.

Read More
Agent Tesla   Old RAT Uses New Tricks To Stay On Top 4

Agent Tesla | Old RAT Uses New Tricks to Stay on Top

Aside from Dridex, Agent Tesla is the most widely used malware currently targeting businesses. We review its core functionality and latest adaptations.

Read More
WastedLocker Ransomware   Abusing ADS And NTFS File Attributes 4

WastedLocker Ransomware: Abusing ADS and NTFS File Attributes

WastedLocker is a relatively new ransomware that has been attacking high-value targets across numerous industries, including several Fortune 500 companies.

Read More
Enter The Maze  Demystifying An Affiliate Involved In Maze Snow 9

Enter the Maze: Demystifying an Affiliate Involved in Maze (SNOW)

SentinelLabs profiles an affiliate involved with Maze ransomware and details the actor’s involvement with other crimeware families, including TrickBot.

Read More