Labs

Egregor RaaS Continues The Chaos With Cobalt Strike Rclone 1

Egregor RaaS Continues the Chaos with Cobalt Strike and Rclone

Egregor ransomware is one of the more aggressive and complex RaaS families to date, with password-protected payloads designed to evade analysis.

Read More
Ranzy Ransomware   Better Encryption Among New Features Of ThunderX Derivative 5

Ranzy Ransomware | Better Encryption Among New Features of ThunderX Derivative

The Ranzy ransomware operators have learned from their mistakes and adapted quickly after ThunderX decryptors became publicly available.

Read More
Resourceful MacOS Malware Hides In Named Fork 5

Resourceful macOS Malware Hides in Named Fork

Threat actors targeting macOS are deploying a new trick to hide payloads and avoid detection thanks to an old technology: the named resource fork.

Read More
Moving From Dynamic Emulation Of UEFI Modules To Coverage Guided Fuzzing Of UEFI Firmware 1

Moving From Dynamic Emulation of UEFI Modules To Coverage-Guided Fuzzing of UEFI Firmware

In Part 3 of our series on emulating, debugging and fuzzing UEFI modules, we provide a step-by-step guide to making a coverage-guided fuzzer for UEFI code.

Read More
Anchor Project For Trickbot Adds ICMP

Anchor Project for Trickbot Adds ICMP

The team behind Trickbot has been aggressively updating and deploying various modules including Anchor and Bazar Loader targeting high-value targets, including healthcare entities

Read More
Misusing Msvsmon And The Windows Remote Debugger 3

Misusing msvsmon and the Windows Remote Debugger

The ability to remotely debug an application is a useful feature, but msvsmon.exe has security implications that organizations need to be aware of.

Read More
Under The Hood   An Inside Look At How Ryuk Evolved Its Encryption And Evasion Techniques 6

An Inside Look at How Ryuk Evolved Its Encryption and Evasion Techniques

Ryuk’s success is based partly on leveraging other toolkits and vulns, partly on its encryption speed and evasion tricks. We tear it down for a closer look.

Read More
Purple Fox EK   New CVEs Steganography And Virtualization Added To Attack Flow 7

Purple Fox EK | New CVEs, Steganography, and Virtualization Added to Attack Flow

New research shows that the Purple Fox exploit kit has added new tricks to its attack flow and continues to target vulnerable versions of Internet Explorer.

Read More
Leveraging LD AUDIT To Beat The Traditional Linux Library Preloading Technique 4

Leveraging LD_AUDIT to Beat the Traditional Linux Library Preloading Technique

Abusing LD_PRELOAD to intercept library calls on Linux is a known threat actor technique, but it’s possible to load libaries even before that. Meet LD_AUDIT

Read More
Moving From Manual RE Of UEFI Modules To Coverage Guided Fuzzing Of UEFI Firmware 3

Moving From Manual Reverse Engineering of UEFI Modules To Dynamic Emulation of UEFI Firmware

Learn how to emulate, trace, debug, and Reverse Engineer UEFI modules in part 2 of our new blog series on Firmware Security

Read More