Labs Archive

Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector

Aleksandar Milenkoski / August 17, 2023

Threat actors abuse Adobe Creative Cloud, Edge, and other executables vulnerable to DLL hijacking in campaign targeting the Southeast Asian gambling sector.

Adversary

Comrades in Arms? | North Korea Compromises Sanctioned Russian Missile Engineering Company

Tom Hegel / August 7, 2023

North Korean threat actors attempt to further missile program by compromising sanctioned Russian defense company with OpenCarrot backdoor.

Advanced Persistent Threat

JumpCloud Intrusion | Attacker Infrastructure Links Compromise to North Korean APT Activity

Tom Hegel / July 20, 2023

North Korean state sponsored APT is behind a new supply chain attack on zero-trust directory platform JumpCloud.

Crimeware

Cloudy With a Chance of Credentials | AWS-Targeting Cred Stealer Expands to Azure, GCP

Alex Delamotte / July 13, 2023

Cloud credentials stealing campaign expands to target Azure and Google Cloud via unpatched web app vulnerabilities.

Quiver – Using Cutting Edge ML To Detect Interesting Command Lines For Hunters 2

LABScon

LABScon Replay | Quiver – Using Cutting Edge ML to Detect Interesting Command Lines for Hunters

LABScon / June 26, 2023

Gal Braun and Dean Langsam explore how LLMs can be trained to parse command lines and perform tasks like attribution and detection.

Security Research

Automating String Decryption and Other Reverse Engineering Tasks in radare2 With r2pipe

Phil Stokes / June 21, 2023

Learn how to drive radare2 with r2pipe for automated binary analysis, string decryption and other common reversing tasks.

LABScon

LABScon Replay | Star-Gazing: Using a Full Galaxy of YARA Methods to Pursue an Apex Actor

LABScon / June 12, 2023

Greg Lesnewich explores how to to pursue an apex predator using little more than a local instance of YARA and some publicly available open-source tooling.