THREAT INTEL

RIG exploit kit distributes Princess ransomware

RIG exploit kit distributes Princess ransomware

August 31, 2017

We have identified a new drive-by download campaign that distributes the Princess ransomware (AKA PrincessLocker), leveraging compromised websites and the RIG…

Cerber ransomware delivered in format of a different order of Magnitude

Cerber ransomware delivered in format of a different order of Magnitude

August 9, 2017

As a follow up to our study into the Magnitude exploit kit and its gate (which we profiled in a previous…

Enemy at the gates: Reviewing the Magnitude exploit kit redirection chain

Enemy at the gates: Reviewing the Magnitude exploit kit redirection chain

August 2, 2017

Over the last few months, we have been keeping an eye on the Magnitude exploit kit which is mainly used to…

TrickBot comes up with new tricks: attacking Outlook and browsing data

TrickBot comes up with new tricks: attacking Outlook and browsing data

August 1, 2017

Last year, we reported on a new modular malware called TrickBot that uses a network protocol similar to Dyreza. The malware was…

Terror EK actor experiments with URL shortener fraud

Terror EK actor experiments with URL shortener fraud

July 19, 2017

Terror EK is an exploit kit made from a mishmash of stolen code and with very limited distribution. In the past few months,…

A .NET malware abusing legitimate ffmpeg

A .NET malware abusing legitimate ffmpeg

July 12, 2017

There is a growing trend among malware authors to incorporate legitimate applications in their malicious package. This time, we analyzed a…

All this EternalPetya stuff makes me WannaCry

All this EternalPetya stuff makes me WannaCry

July 6, 2017

Another week goes by and yet again we have another ransomware outbreak initially dropped by a malicious software update and eventually…

AdGholas malvertising thrives in the shadows of ransomware outbreaks

AdGholas malvertising thrives in the shadows of ransomware outbreaks

July 5, 2017

 The latest wave of ransomware following the WannaCry outbreak has kept everyone very busy and been the topic of many conversations. In the meantime, other threat actors…

EternalPetya - yet another stolen piece in the package?

EternalPetya – yet another stolen piece in the package?

June 30, 2017

Since June 27th we have been investigating the outbreak of the new Petya-like malware armed with an infector similar to WannaCry. Since day one,…