Labs Archive

New Version Of Apostle Ransomware Reemerges In Targeted Attack On Higher Education

Agrius has continued to evolve its toolkit from wiper to ransomware operations, including a recent attack on a higher education facility.

Learn how to beat malware authors' control flow and avoid executing unwanted parts of their code to analyze macOS malware in radare2.

A high severity flaw in HP's OMEN Gaming Hub software allows any user to escalate privileges to kernel-level mode.

A new ZLoader campaign abuses Google Ads to target European banking institutions with signed MSI payloads and more than 300 domains.

EGoManiac is a threat actor willing to spy on friend and foe and entrap journalists without compunction. Read our groundbreaking research.

Phil Stokes / August 30, 2021

Learn more about reversing real-world macOS malware in this new series for intermediate to advanced analysts, starting with these r2 tips!

Jim Walter / August 23, 2021

Hive is a double-extortion ransomware group that’s hit over 30 organizations. Read our deep-dive into the ransomware toolkit.

Supplying a custom backdoor to a cluster of APT groups, the personas behind ShadowPad have maintained a cloak of secrecy, until now.

Phil Stokes / August 11, 2021

Learn how to detect the latest variant of this widespread adware and browser hijacker, its infection pattern and indicators of compromise.

Gal Kristal / August 4, 2021

CVE-2021-36798 is a vulnerability in Cobalt Strike server that could allow victims to register a fake Beacon and DoS attackers.