Labs

Copy Of Relaying Potatoes  DCE RPC NTLM Relay EOP 7

Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol

A newly-discovered NTLM relay attack makes every Windows system vulnerable to an escalation of privileges attack, and there’s no patch in sight.

Read More
A Deep Dive Into Zebrocys Dropper Docs 4

A Deep Dive into Zebrocy’s Dropper Docs

A new APT28 campaign targets Kazakhstan with Delphocy malware. We show how to reverse engineer the dropper and bypass the VBA macro’s password protection.

Read More
Adventures From UEFI Land  The Hunt For The S3 Boot Script 1

Adventures From UEFI Land: the Hunt For the S3 Boot Script

In Part 4 of our UEFI Internals and Exploitation series, we abandon VMs and dive into UEFI on a physical machine. The quest: recovery of the S3 Boot Script.

Read More
Avaddon RaaS   Breaks Public Decryptor Continues On Rampage 7

Avaddon RaaS | Breaks Public Decryptor, Continues On Rampage

Unbreakable encryption, a data leak site and threats of DDoS attacks, Avaddon has all the tricks of a modern RaaS. And now version 2 is on the way.

Read More
Keep Malware Off Your Disk With SentinelOnes IDA Pro Memory Loader Plugin 2

Keep Malware Off Your Disk With SentinelOne’s IDA Pro Memory Loader Plugin

Security researchers – don’t infect your own device! Now you can analyze malware samples in memory using SentinelOne’s Memory Loader plugin for IDA Pro.

Read More
New MacOS Malware XcodeSpy Targets Xcode Developers With EggShell Backdoor 6

New macOS Malware XcodeSpy Targets Xcode Developers with EggShell Backdoor

Targeting software developers is one route to a successful supply chain attack. Now threat actors are going after Apple developers through the Xcode IDE.

Read More
Top 15 Essential Malware Analysis Tools 4

Top 15 Essential Malware Analysis Tools

Get your malware analysis toolkit up-to-speed! From disassemblers and debuggers to hex editors and SSL interception tools, you’ll find them all here.

Read More
HelloKitty Ransomware Lacks Stealth But Still Strikes Home 3

HelloKitty Ransomware Lacks Stealth, But Still Strikes Home

HelloKitty lacks the stealth of Ryuk, REvil and Conti, but has still struck some notable targets, including CEMIGO. Ransomware overview and IoCs here.

Read More
A Guide To Ghidra Scripting Development For Malware Researchers 3

A Guide to Ghidra Scripting Development for Malware Researchers

Automation is the key to becoming a more effective malware analyst, and Ghidra scripting is an essential tool in your arsenal. Get started here!

Read More
20 Common Tools Techniques Used By MacOS Threat Actors Malware 6

20 Common Tools & Techniques Used by macOS Threat Actors & Malware

Threat hunting on macOS? These are the tools malware most often leverages, with ITW examples, MITRE behavioral indicators and links to further research.

Read More