TA551

Unit42-timely-threat-intel/2024-06-25-IOCs-from-Latrodectus-activity.txt at main · PaloAltoNetworks/Unit42-timely-threat-intel

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Unit42-timely-threat-intel/2024-06-25-IOCs-from-Latrodectus-activity.txt at main · PaloAltoNetworks/Unit42-timely-threat-intel

IcedID (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor IcedID (Malware Family)

TrickBot teams up with Shatak phishers for Conti ransomware attacks

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor TrickBot teams up with Shatak phishers for Conti ransomware attacks

QBOT Malware Analysis

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor QBOT Malware Analysis

New Ursnif Malware Variant – a Stunning Matryoshka (Матрёшка)

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor New Ursnif Malware Variant – a Stunning Matryoshka (Матрёшка)

Bumblebee Malware Loader Threat Analysis

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware Loader Threat Analysis

BumbleBee (Malware Family)

date ORKL added it fromORKL

The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor BumbleBee (Malware Family)

Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

Gozi Gozi Gozi - String Decryption

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gozi Gozi Gozi - String Decryption

Latrodectus BackConnect

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Latrodectus BackConnect

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

Operation Endgame: Do Takedowns and Arrests Matter?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Operation Endgame: Do Takedowns and Arrests Matter?

A Sting on Bing: Bumblebee delivered through Bing SEO poisoning campaign - CYJAX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Sting on Bing: Bumblebee delivered through Bing SEO poisoning campaign - CYJAX

Unit42-timely-threat-intel/2025-01-17-IOCs-for-infrastructure-used-by-affiliate-of-Dark-Scorpius.txt at main · PaloAltoNetworks/Unit42-timely-threat-intel

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Unit42-timely-threat-intel/2025-01-17-IOCs-for-infrastructure-used-by-affiliate-of-Dark-Scorpius.txt at main · PaloAltoNetworks/Unit42-timely-threat-intel

PROSPERO & Proton66: Uncovering the links between bulletproof networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PROSPERO & Proton66: Uncovering the links between bulletproof networks

CARBANAK (aka ANUNAK) Distributed via IDATLOADER (aka HIJACKLOADER)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CARBANAK (aka ANUNAK) Distributed via IDATLOADER (aka HIJACKLOADER)

Emotet Malware Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Malware Analysis

New Bumblebee Loader Infection Chain Signals Possible Resurgence

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Bumblebee Loader Infection Chain Signals Possible Resurgence

UNC4393 Goes Gently into the SILENTNIGHT

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UNC4393 Goes Gently into the SILENTNIGHT

Jan-Jun%202024%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Jan-Jun%202024%20Botnet%20Threat%20Update.pdf

Exposing FakeBat loader: distribution methods and adversary infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exposing FakeBat loader: distribution methods and adversary infrastructure

IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID Brings ScreenConnect and CSharp Streamer to ALPHV Ransomware Deployment

Largest ever operation against botnets hits dropper malware ecosystem

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Largest ever operation against botnets hits dropper malware ecosystem

QakBOT v5 Deep Malware Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QakBOT v5 Deep Malware Analysis

Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID

Threat actors misusing Quick Assist in social engineering attacks leading to ransomware | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat actors misusing Quick Assist in social engineering attacks leading to ransomware | Microsoft Security Blog

QakBot attacks with Windows zero-day (CVE-2024-30051)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QakBot attacks with Windows zero-day (CVE-2024-30051)

From IcedID to Dagon Locker Ransomware in 29 Days

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From IcedID to Dagon Locker Ransomware in 29 Days

[QuickNote] Qakbot 5.0 – Decrypt strings and configuration

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] Qakbot 5.0 – Decrypt strings and configuration

Unit42-timely-threat-intel/2024-04-15-IOC-for-Contact-Forms-campaign-SSLoad-activity.txt at main · PaloAltoNetworks/Unit42-timely-threat-intel

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unit42-timely-threat-intel/2024-04-15-IOC-for-Contact-Forms-campaign-SSLoad-activity.txt at main · PaloAltoNetworks/Unit42-timely-threat-intel

IcedID – Technical Analysis of an IcedID Lightweight x64 DLL - 0x0d4y Malware Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID – Technical Analysis of an IcedID Lightweight x64 DLL - 0x0d4y Malware Research

Latrodectus Malware Analysis: IcedID 2.0 | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Latrodectus Malware Analysis: IcedID 2.0 | Proofpoint US

From OneNote to RansomNote: An Ice Cold Intrusion

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From OneNote to RansomNote: An Ice Cold Intrusion

Comprehensive Analysis of EMOTET Malware: Part 1 by Zyad Elzyat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Comprehensive Analysis of EMOTET Malware: Part 1 by Zyad Elzyat

Carving the IcedId - Part 3

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Carving the IcedId - Part 3

Spam trends campaigns senior superlatives 2023

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Spam trends campaigns senior superlatives 2023

Automating Qakbot Malware Analysis with Binary Ninja

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Automating Qakbot Malware Analysis with Binary Ninja

Writing a Qakbot 5.0 config extractor with Malcat

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Writing a Qakbot 5.0 config extractor with Malcat

Zeus, IcedID malware gangs leader pleads guilty, faces 40 years in prison

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Zeus, IcedID malware gangs leader pleads guilty, faces 40 years in prison

Foreign National Pleads Guilty to Role in Cybercrime Schemes Involving Tens of Millions of Dollars in Losses

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Foreign National Pleads Guilty to Role in Cybercrime Schemes Involving Tens of Millions of Dollars in Losses

Bumblebee Malware Attack Analysis: Why It’s Back | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware Attack Analysis: Why It’s Back | Proofpoint US

Unpacking an Emotet trojan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unpacking an Emotet trojan

A Beginner's Guide to Tracking Malware Infrastructure - Censys

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Beginner's Guide to Tracking Malware Infrastructure - Censys

Tracking 15 Years of Qakbot Development | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking 15 Years of Qakbot Development | ThreatLabz

Keyhole Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Keyhole Analysis

Q4%202023%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Q4%202023%20Botnet%20Threat%20Update.pdf

IcedID – Technical Malware Analysis [Second Stage] - 0x0d4y Malware Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID – Technical Malware Analysis [Second Stage] - 0x0d4y Malware Research

2023 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023 Adversary Infrastructure Report

Qakbot Returns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot Returns

Malware development: persistence - part 23. LNK files. Simple Powershell example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 23. LNK files. Simple Powershell example.

Identifying Qakbot Servers with Regex and TLS Certificates

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Identifying Qakbot Servers with Regex and TLS Certificates

Practical Queries for Malware Infrastructure - Part 3 (Advanced Examples)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Practical Queries for Malware Infrastructure - Part 3 (Advanced Examples)

Are DarkGate and PikaBot the new QakBot?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Are DarkGate and PikaBot the new QakBot?

Forensic Timeline of an IcedID Infection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Forensic Timeline of an IcedID Infection

2023%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q3%20Botnet%20Threat%20Update.pdf

Qakbot-affiliated actors distribute Ransom Knight malware despite infrastructure takedown

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot-affiliated actors distribute Ransom Knight malware despite infrastructure takedown

deep analysis of Xiangoop Loader and EntryShell payload

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor deep analysis of Xiangoop Loader and EntryShell payload

The DGA of BumbleBee

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The DGA of BumbleBee

Understanding BumbleBee: BumbleBee’s malware configuration and clusters

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Understanding BumbleBee: BumbleBee’s malware configuration and clusters

U.S. Hacks QakBot, Quietly Removes Botnet Infections

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor U.S. Hacks QakBot, Quietly Removes Botnet Infections

Malware | Qakbot - the takedown and the remediation | Spamhaus

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware | Qakbot - the takedown and the remediation | Spamhaus

Qakbot Botnet Disruption | The Shadowserver Foundation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot Botnet Disruption | The Shadowserver Foundation

RESOURCES FOR VICTIMS OF THE QAKBOT MALWARE

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RESOURCES FOR VICTIMS OF THE QAKBOT MALWARE

Qakbot Malware Disrupted in International Cyber Takedown

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot Malware Disrupted in International Cyber Takedown

FBI, Partners Dismantle Qakbot Infrastructure in Multinational Cyber Takedown | Federal Bureau of Investigation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FBI, Partners Dismantle Qakbot Infrastructure in Multinational Cyber Takedown | Federal Bureau of Investigation

HTML Smuggling Leads to Domain Wide Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor HTML Smuggling Leads to Domain Wide Ransomware

23mj4251_application_redacted.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 23mj4251_application_redacted.pdf

23mj4244_application_redacted.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 23mj4244_application_redacted.pdf

Understanding BumbleBee: The malicious behavior of BumbleBee - VMRay

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Understanding BumbleBee: The malicious behavior of BumbleBee - VMRay

Visualizing Qakbot Infrastructure Part II: Uncharted Territory

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Visualizing Qakbot Infrastructure Part II: Uncharted Territory

What’s happening in the world of crimeware: Emotet, DarkGate and LokiBot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What’s happening in the world of crimeware: Emotet, DarkGate and LokiBot

Pikabot deep analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Pikabot deep analysis

Out of the Sandbox: WikiLoader Digs Sophisticated Evasion | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Out of the Sandbox: WikiLoader Digs Sophisticated Evasion | Proofpoint US

Inside the IcedID BackConnect Protocol (Part 2)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside the IcedID BackConnect Protocol (Part 2)

Hibernating Qakbot | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hibernating Qakbot | ThreatLabz

Unpacking Emotet Trojan

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unpacking Emotet Trojan

Ursnif VS Italy: Il PDF del Destino

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ursnif VS Italy: Il PDF del Destino

2023%20Q2%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q2%20Botnet%20Threat%20Update.pdf

What’s up with Emotet?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What’s up with Emotet?

Reversing a recent IcedID Crypter

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Reversing a recent IcedID Crypter

PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID | Deep Instinct

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID | Deep Instinct

Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Intelligence Query Examples - Real World Queries for Identifying Malware Infrastructure

Cold as Ice: Answers to Unit 42 Wireshark Quiz for IcedID

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cold as Ice: Answers to Unit 42 Wireshark Quiz for IcedID

IcedID Macro Ends in Nokoyawa Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID Macro Ends in Nokoyawa Ransomware

How Hackers Use Binary Padding to Outsmart Sandboxes and Infiltrate Your Systems

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Hackers Use Binary Padding to Outsmart Sandboxes and Infiltrate Your Systems

Visualizing QakBot Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Visualizing QakBot Infrastructure

Hunting for Ursnif

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting for Ursnif

Unpacking ICEDID

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Unpacking ICEDID

Teasing the Secrets From Threat Actors: Malware Configuration Parsing at Scale

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Teasing the Secrets From Threat Actors: Malware Configuration Parsing at Scale

UnpacMe Weekly: New Version of IcedId Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor UnpacMe Weekly: New Version of IcedId Loader

Research As A Service | Loginsoft

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Research As A Service | Loginsoft

IcedID - FIRST AMS 2023

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID - FIRST AMS 2023

Automating Qakbot Detection at Scale With Velociraptor | Rapid7 Blog

Malpedia library date Rapid7 fromORKLCCS '25 data

Archived copy on ORKL Detailsfor Automating Qakbot Detection at Scale With Velociraptor | Rapid7 Blog

Tracking Bumblebee's Development

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Tracking Bumblebee's Development

Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting QakBot: WSF attachments, OneNote files, and generic attack surface reduction

Research As A Service | Loginsoft

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Research As A Service | Loginsoft

2023%20Q1%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2023%20Q1%20Botnet%20Threat%20Update.pdf

Recent IcedID (Bokbot) activity - SANS Internet Storm Center

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Recent IcedID (Bokbot) activity - SANS Internet Storm Center

Recent IcedID (Bokbot) activity - SANS Internet Storm Center

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Recent IcedID (Bokbot) activity - SANS Internet Storm Center

BumbleBee hunting with a Velociraptor

Malpedia library date SEC Consult fromORKLCCS '25 data

Archived copy on ORKL Detailsfor BumbleBee hunting with a Velociraptor

March 2023’s Most Wanted Malware: New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor March 2023’s Most Wanted Malware: New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files

Automating Qakbot decode at scale :: Velociraptor

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Automating Qakbot decode at scale :: Velociraptor

Malicious ISO File Leads to Domain Wide Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Malicious ISO File Leads to Domain Wide Ransomware

Research As A Service | Loginsoft

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Research As A Service | Loginsoft

1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf

eSentire Threat Intelligence Malware Analysis: BatLoader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor eSentire Threat Intelligence Malware Analysis: BatLoader

BumbleBee notes ??????

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BumbleBee notes ??????

Reversing Complex PowerShell Malware – Cerbero Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Reversing Complex PowerShell Malware – Cerbero Blog

Fork in the Ice: IcedID Malware Analysis | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Fork in the Ice: IcedID Malware Analysis | Proofpoint US

Fork in the Ice- The New Era of IcedID

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Fork in the Ice- The New Era of IcedID

Bypassing Qakbot Anti-Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bypassing Qakbot Anti-Analysis

Emotet resumes spam operations, switches to OneNote

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet resumes spam operations, switches to OneNote

IcedID & Qakbot's VNC Backdoors: Dark Cat, Anubis & Keyhole

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID & Qakbot's VNC Backdoors: Dark Cat, Anubis & Keyhole

Gozi - Italian ShellCode Dance

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gozi - Italian ShellCode Dance

QBot: Laying the Foundations for Black Basta Ransomware Activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QBot: Laying the Foundations for Black Basta Ransomware Activity

Emotet Returns, Now Adopts Binary Padding for Evasion

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Returns, Now Adopts Binary Padding for Evasion

BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif

Emotet Sending Malicious Emails After Three-Month Hiatus

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Sending Malicious Emails After Three-Month Hiatus

Emotet malware attacks return after three-month break

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet malware attacks return after three-month break

BumbleBee DocuSign Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BumbleBee DocuSign Campaign

OneNote | ThreatLabz

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor OneNote | ThreatLabz

Malvertising Surges to Distribute Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malvertising Surges to Distribute Malware

RIG___TLP_CLEAR-1.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RIG___TLP_CLEAR-1.pdf

Emotet Campaign:

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Campaign:

Desde Chile con Malware (From Chile with Malware)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Desde Chile con Malware (From Chile with Malware)

Qbot testing malvertising campaigns?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qbot testing malvertising campaigns?

Qakbot Malware: Exploring Its Diverse Distribution Methods

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot Malware: Exploring Its Diverse Distribution Methods

How to Identify IcedID Network Traffic

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to Identify IcedID Network Traffic

Comment Qbot revient en force avec OneNote ?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Comment Qbot revient en force avec OneNote ?

SteelCloverによるGoogle広告経由でマルウェアを配布する攻撃の活発化について

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SteelCloverによるGoogle広告経由でマルウェアを配布する攻撃の活発化について

Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Following the Scent of TrickGate: 6-Year-Old Packer Used to Deploy the Most Wanted Malware - Check Point Research

Emotet Unpacking:

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Unpacking:

Black Basta - Technical Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta - Technical Analysis

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

Following the LNK metadata trail

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Following the LNK metadata trail

QakBot Malware Bypass Windows Security Using Unpatched Vulnerability

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QakBot Malware Bypass Windows Security Using Unpatched Vulnerability

Emotet returns and deploys loaders

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet returns and deploys loaders

Unwrapping Ursnifs Gifts

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Unwrapping Ursnifs Gifts

HTML Smuggling Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HTML Smuggling Detection

IcedID Botnet Distributors Abuse Google PPC to Distribute Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID Botnet Distributors Abuse Google PPC to Distribute Malware

Qakbot Being Distributed via Virtual Disk Files (*.vhd) - ASEC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot Being Distributed via Virtual Disk Files (*.vhd) - ASEC

Inside the IcedID BackConnect Protocol

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Inside the IcedID BackConnect Protocol

[Z2A]Bimonthly malware challege – Emotet (Back From the Dead)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [Z2A]Bimonthly malware challege – Emotet (Back From the Dead)

Google ads lead to fake software pages pushing IcedID (Bokbot)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Google ads lead to fake software pages pushing IcedID (Bokbot)

Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf

Threat Analysis: MSI - Masquerading as a Software Installer

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Analysis: MSI - Masquerading as a Software Installer

From Macros to No Macros: Continuous Malware Improvements by QakBot | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor From Macros to No Macros: Continuous Malware Improvements by QakBot | Splunk

Identifying and Defending Against QakBot's Evolving TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Identifying and Defending Against QakBot's Evolving TTPs

Emotet Strikes Again - LNK File Leads to Domain Wide Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Emotet Strikes Again - LNK File Leads to Domain Wide Ransomware

THREAT ALERT: Aggressive Qakbot Campaign and the Black Basta Ransomware Group Targeting U.S. Companies

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ALERT: Aggressive Qakbot Campaign and the Black Basta Ransomware Group Targeting U.S. Companies

Emotet Malware Is Back - Virus Analysis | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Malware Is Back - Virus Analysis | Proofpoint US

How LNK Files Are Abused by Threat Actors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How LNK Files Are Abused by Threat Actors

QakBot CCs prioritization and new record types

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QakBot CCs prioritization and new record types

ICEDIDs network infrastructure is alive and well

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ICEDIDs network infrastructure is alive and well

Orion Threat Alert: Qakbot TTPs Arsenal and the Black Basta Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Orion Threat Alert: Qakbot TTPs Arsenal and the Black Basta Ransomware

EMOTET Dynamic Configuration Extraction

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor EMOTET Dynamic Configuration Extraction

Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Raspberry Robin worm part of larger ecosystem facilitating pre-ransomware activity | Microsoft Security Blog

Chapter 1 — From Gozi to ISFB: The history of a mythical malware family.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Chapter 1 — From Gozi to ISFB: The history of a mythical malware family.

2022%20Q3%20Botnet%20Threat%20Update.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022%20Q3%20Botnet%20Threat%20Update.pdf

QAKBOT BB Configuration and C2 IPs List

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QAKBOT BB Configuration and C2 IPs List

Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike

IcedID BackConnect Protocol

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID BackConnect Protocol

A Visualizza into Recent IcedID Campaigns:

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Visualizza into Recent IcedID Campaigns:

Bumblebee: increasing its capacity and evolving its TTPs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee: increasing its capacity and evolving its TTPs

VMware Brochure Template US Letter

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor VMware Brochure Template US Letter

BumbleBee: Round Two

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BumbleBee: Round Two

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense

Dead or Alive? An Emotet Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Dead or Alive? An Emotet Story

Cyble - Bumblebee Returns With New Infection Technique

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Bumblebee Returns With New Infection Technique

Initial access broker repurposing techniques in targeted attacks against Ukraine

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Initial access broker repurposing techniques in targeted attacks against Ukraine

Ares Banking Trojan adds the old Qakbot DGA | Zscaler

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ares Banking Trojan adds the old Qakbot DGA | Zscaler

Ransomware Spotlight: Black Basta

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: Black Basta

Threat Assessment: Black Basta Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Assessment: Black Basta Ransomware

Bumblebee Malware: Deep Instinct Prevents Attack Pre-Execution | Deep Instinct

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware: Deep Instinct Prevents Attack Pre-Execution | Deep Instinct

QBOT Malware Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QBOT Malware Analysis

Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Looking for the ‘Sliver’ lining: Hunting for emerging command-and-control frameworks | Microsoft Security Blog

Emotet Revival: Tactics and Mitigations

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Revival: Tactics and Mitigations

How to Replicate Emotet Lateral Movement

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How to Replicate Emotet Lateral Movement

THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: Bumblebee Loader – The High Road to Enterprise Domain Control

Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Monster Libra (TA551/Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike

Monster Libra (TA551-Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Monster Libra (TA551-Shathak) pushes IcedID (Bokbot) with Dark VNC and Cobalt Strike

Emotet SMB Spreader is Back

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet SMB Spreader is Back

An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure

BumbleBee Roasts Its Way to Domain Admin

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor BumbleBee Roasts Its Way to Domain Admin

IcedID leverages PrivateLoader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID leverages PrivateLoader

Technical Analysis of Bumblebee Malware Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Technical Analysis of Bumblebee Malware Loader

Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Flight of the Bumblebee: Email Lures and File Sharing Services Lead to Malware

Flight of the Bumblebee- Email Lures and File Sharing Services Lead to Malware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Flight of the Bumblebee- Email Lures and File Sharing Services Lead to Malware

IcedID (Bokbot) with Dark VNC and Cobalt Strike - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID (Bokbot) with Dark VNC and Cobalt Strike - SANS ISC

Exploring the QBOT Attack Pattern

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exploring the QBOT Attack Pattern

Cyble - Targeted Attacks Being Carried Out Via DLL SideLoading

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Targeted Attacks Being Carried Out Via DLL SideLoading

IcedID (Bokbot) with Dark VNC and Cobalt Strike

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor IcedID (Bokbot) with Dark VNC and Cobalt Strike

QBot phishing uses Windows Calculator DLL hijacking to infect devices

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QBot phishing uses Windows Calculator DLL hijacking to infect devices

New Variant of QakBot Being Spread by HTML File Attached to Phishing Emails

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Variant of QakBot Being Spread by HTML File Attached to Phishing Emails

Resecurity | Shortcut-based (LNK) attacks delivering malicious code on the rise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Resecurity | Shortcut-based (LNK) attacks delivering malicious code on the rise

Example Analysis of Multi-Component Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Example Analysis of Multi-Component Malware

Qakbot Attacks Increasing due to Evolving Threats | Zscaler

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot Attacks Increasing due to Evolving Threats | Zscaler

Emotet infection with Cobalt Strike - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet infection with Cobalt Strike - SANS ISC

Notable Droppers Emerge in Recent Threat Campaigns | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Notable Droppers Emerge in Recent Threat Campaigns | FortiGuard Labs

QBot Spreads via LNK Files – Detection & Response - Security Investigation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QBot Spreads via LNK Files – Detection & Response - Security Investigation

Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Black Basta Ransomware Operators Expand Their Attack Arsenal With QakBot Trojan and PrintNightmare Exploit

Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem

Emotet: Still Abusing Microsoft Office Macros

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet: Still Abusing Microsoft Office Macros

We see you, Gozi

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor We see you, Gozi

IcedID Banking Trojan returns with new TTPS – Detection & Response - Security Investigation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID Banking Trojan returns with new TTPS – Detection & Response - Security Investigation

Qakbot report

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Qakbot report

How Emotet is changing tactics in response to Microsoft’s tightening of Office macro security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Emotet is changing tactics in response to Microsoft’s tightening of Office macro security

BumbleBee: a new trendy loader for Initial Access Brokers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BumbleBee: a new trendy loader for Initial Access Brokers

TA570 Qakbot (Qbot) tries CVE-2022-30190 (Follina) exploit (ms-msdt)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA570 Qakbot (Qbot) tries CVE-2022-30190 (Follina) exploit (ms-msdt)

Cyble - Bumblebee Loader On The Rise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyble - Bumblebee Loader On The Rise

SVCReady- A New Loader Gets Ready

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor SVCReady- A New Loader Gets Ready

SVCReady: A New Loader Gets Ready | HP Wolf Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SVCReady: A New Loader Gets Ready | HP Wolf Security

THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor THALES%20THREAT%20HANDBOOK%202022%20Light%20Version_1.pdf

Automatically Unpacking IcedID Stage 1 with angr

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Automatically Unpacking IcedID Stage 1 with angr

Emotet Analysis: New LNKs in the Infection Chain- The Monitor, Issue 20

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Analysis: New LNKs in the Infection Chain- The Monitor, Issue 20

Buzz of the bumblebee - A new malicious loader - Emerging Threats Protection Report

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Buzz of the bumblebee - A new malicious loader - Emerging Threats Protection Report

Emotet Config Redux

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Config Redux

4 Types of Dropper Malware in Microsoft Office & How to Detect Them | Deep Instinct

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 4 Types of Dropper Malware in Microsoft Office & How to Detect Them | Deep Instinct

Emotet Botnet Rises Again | Bitsight

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Botnet Rises Again | Bitsight

Malware Analysis- Trickbot

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Malware Analysis- Trickbot

Malware Analysis: Trickbot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis: Trickbot

Bruised but Not Broken: The Resurgence of the Emotet Botnet Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bruised but Not Broken: The Resurgence of the Emotet Botnet Malware

ITG23 Crypters Highlight Cooperation Between Cybercriminal Groups

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor ITG23 Crypters Highlight Cooperation Between Cybercriminal Groups

Bumblebee Malware from TransferXL URLs - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware from TransferXL URLs - SANS ISC

ITG23 crypters cooperation between cybercriminal groups

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor ITG23 crypters cooperation between cybercriminal groups

Bumblebee Malware from TransferXL URLs - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Malware from TransferXL URLs - SANS ISC

Ransomware Spotlight: RansomEXX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Spotlight: RansomEXX

Emotet Summary: November 2021 Through January 2022

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Summary: November 2021 Through January 2022

Emotet Moves to 64 bit and Updates its Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Moves to 64 bit and Updates its Loader

Bumblebee Loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bumblebee Loader

What malware to look for if you want to prevent a ransomware attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What malware to look for if you want to prevent a ransomware attack

TA578 using thread-hijacked emails to push ISO files for Bumblebee malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA578 using thread-hijacked emails to push ISO files for Bumblebee malware

HP-Wolf-Security-Threat-Insights-Report-Q1-2022.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor HP-Wolf-Security-Threat-Insights-Report-Q1-2022.pdf

Detecting a MUMMY SPIDER campaign and Emotet infection

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Detecting a MUMMY SPIDER campaign and Emotet infection

TA578 using thread-hijacked emails to push ISO files for Bumblebee malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA578 using thread-hijacked emails to push ISO files for Bumblebee malware

Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself | Microsoft Security Blog

Emotet C2 and Spam Traffic Video

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet C2 and Spam Traffic Video

Cybereason vs. Quantum Locker Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybereason vs. Quantum Locker Ransomware

Ursnif Malware Banks on News Events for Phishing Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ursnif Malware Banks on News Events for Phishing Attacks

Bzz.. Bzz.. Bumblebee loader

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Bzz.. Bzz.. Bumblebee loader

Emotet: New Delivery Mechanism to Bypass VBA Protection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet: New Delivery Mechanism to Bypass VBA Protection

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

Ransomware: How Attackers are Breaching Corporate Networks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware: How Attackers are Breaching Corporate Networks

New Bumblebee malware replaces Conti's BazarLoader in cyberattacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Bumblebee malware replaces Conti's BazarLoader in cyberattacks

This isn't Optimus Prime's Bumblebee but it's Still Transforming | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor This isn't Optimus Prime's Bumblebee but it's Still Transforming | Proofpoint US

The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection

Emotet Returns: New TTPs and .lnk File Attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Returns: New TTPs and .lnk File Attacks

Conti and Emotet: A constantly destructive duo

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti and Emotet: A constantly destructive duo

Emotet Malware Tests New Delivery Techniques | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Malware Tests New Delivery Techniques | Proofpoint US

Emotet malware now installs via PowerShell in Windows shortcut files

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet malware now installs via PowerShell in Windows shortcut files

Quantum Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Quantum Ransomware

Shortcut to Emotet, an odd TTP change

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Shortcut to Emotet, an odd TTP change

"aa" distribution Qakbot (Qbot) infection with DarkVNC traffic

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor "aa" distribution Qakbot (Qbot) infection with DarkVNC traffic

AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf

Malware development: persistence - part 1. Registry run keys. C++ example.

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware development: persistence - part 1. Registry run keys. C++ example.

Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

Emotet botnet switches to 64-bit modules, increases activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet botnet switches to 64-bit modules, increases activity

Trends in the Recent Emotet Maldoc Outbreak | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Trends in the Recent Emotet Maldoc Outbreak | FortiGuard Labs

Lessons from the Conti Leaks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Lessons from the Conti Leaks

Qakbot Series: API Hashing

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot Series: API Hashing

Qakbot Series: Process Injection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot Series: Process Injection

Orion Threat Alert: Flight of the BumbleBee

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Orion Threat Alert: Flight of the BumbleBee

CERT-UA

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CERT-UA

Hackers target Ukrainian govt with IcedID malware, Zimbra exploits

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hackers target Ukrainian govt with IcedID malware, Zimbra exploits

Zloader 2: The Silent Night

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Zloader 2: The Silent Night

Qakbot Series: Configuration Extraction

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot Series: Configuration Extraction

Emotet modules and recent attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet modules and recent attacks

SystemBC Being Used by Various Attackers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SystemBC Being Used by Various Attackers

Qbot Botnet Deploys Malware Payloads Through Malicious Windows Installers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qbot Botnet Deploys Malware Payloads Through Malicious Windows Installers

Qbot malware switches to new Windows Installer infection vector

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qbot malware switches to new Windows Installer infection vector

Qakbot Series: String Obfuscation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot Series: String Obfuscation

RL Blog | ReversingLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RL Blog | ReversingLabs

Stolen Images Campaign Ends in Conti Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Stolen Images Campaign Ends in Conti Ransomware

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

Exchange Servers Speared in IcedID Phishing Campaign

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exchange Servers Speared in IcedID Phishing Campaign

Emotet C2 Configuration Extraction and Analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet C2 Configuration Extraction and Analysis

Emotet is Back

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet is Back

Spoofed Invoice Used to Drop IcedID | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Spoofed Invoice Used to Drop IcedID | FortiGuard Labs

New Conversation Hijacking Campaign Delivering IcedID

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Conversation Hijacking Campaign Delivering IcedID

Microsoft Exchange targeted for IcedID reply-chain hijacking attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Exchange targeted for IcedID reply-chain hijacking attacks

New Conversation Hijacking Campaign Delivering IcedID

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Conversation Hijacking Campaign Delivering IcedID

XLSB Files: Because Binary is Stealthier Than XML - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor XLSB Files: Because Binary is Stealthier Than XML - SANS ISC

MS Office Files Involved Again in Recent Emotet Trojan Campaign – Part II | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MS Office Files Involved Again in Recent Emotet Trojan Campaign – Part II | FortiGuard Labs

Hunting Emotet campaigns with Kusto

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting Emotet campaigns with Kusto

Beware of Email Scams Related to Current Events | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Beware of Email Scams Related to Current Events | FortiGuard Labs

2022_ThreatDetectionReport_RedCanary.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2022_ThreatDetectionReport_RedCanary.pdf

Conti Affiliate Exposed- New Domain Names, IP Addresses and Email Addresses Uncovered

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Conti Affiliate Exposed- New Domain Names, IP Addresses and Email Addresses Uncovered

Emotet Is Back and Is Deadlier Than Ever! A Rundown of the Emotet Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Is Back and Is Deadlier Than Ever! A Rundown of the Emotet Malware

Conti Affiliate Exposed: New Domain Names, IP Addresses and Email Addresses Uncovered by eSentire

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Affiliate Exposed: New Domain Names, IP Addresses and Email Addresses Uncovered by eSentire

Navigating New Frontiers: Trend Micro 2021 Annual Cybersecurity Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Navigating New Frontiers: Trend Micro 2021 Annual Cybersecurity Report

Exposing initial access broker with ties to Conti

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Exposing initial access broker with ties to Conti

IcedID gziploader analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID gziploader analysis

The Ransomware Threat Landscape: What to Expect in 2022

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor The Ransomware Threat Landscape: What to Expect in 2022

Suspected Conti Ransomware Activity in the Auto Manufacturing Sector

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Suspected Conti Ransomware Activity in the Auto Manufacturing Sector

Qakbot infection with Cobalt Strike and VNC activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot infection with Cobalt Strike and VNC activity

Qakbot infection with Cobalt Strike and VNC activity

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qakbot infection with Cobalt Strike and VNC activity

BokBot Technical Analysis | xors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BokBot Technical Analysis | xors

MS Office Files Involved Again in Recent Emotet Trojan Campaign – Part I | FortiGuard Labs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor MS Office Files Involved Again in Recent Emotet Trojan Campaign – Part I | FortiGuard Labs

Cyberattacks are Prominent in the Russia-Ukraine Conflict

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyberattacks are Prominent in the Russia-Ukraine Conflict

Conti Ransomware Group Diaries, Part II: The Office

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Conti Ransomware Group Diaries, Part II: The Office

TrickBot malware suddenly got quiet, researchers say, but it’s hardly the end for its operators

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot malware suddenly got quiet, researchers say, but it’s hardly the end for its operators

TrickBot Gang Likely Shifting Operations to Switch to New Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot Gang Likely Shifting Operations to Switch to New Malware

Notorious TrickBot Malware Gang Shuts Down its Botnet Infrastructure

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Notorious TrickBot Malware Gang Shuts Down its Botnet Infrastructure

New Wave of Emotet - When Project X Turns Into Y

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Wave of Emotet - When Project X Turns Into Y

What the Pack(er)? | cyber.wtf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor What the Pack(er)? | cyber.wtf

IcedID to Cobalt Strike In Under 20 Minutes

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID to Cobalt Strike In Under 20 Minutes

Qbot and Zerologon Lead To Full Domain Compromise

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Qbot and Zerologon Lead To Full Domain Compromise

Quick Malware Analysis: Emotet Epoch 5 and Cobalt Strike pcap from 2022-02-08

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quick Malware Analysis: Emotet Epoch 5 and Cobalt Strike pcap from 2022-02-08

Emotet Now Spreading Through Malicious Excel Files

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Now Spreading Through Malicious Excel Files

QBot Malware Detection: Old Dog New Tricks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QBot Malware Detection: Old Dog New Tricks

New Emotet Infection Method

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Emotet Infection Method

Increase in Emotet Activity and Cobalt Strike Deployment

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Increase in Emotet Activity and Cobalt Strike Deployment

Technical Malware Analysis: The return of Emotet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Technical Malware Analysis: The return of Emotet

THREAT ANALYSIS: Cobalt Strike - IcedID, Emotet and QBot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS: Cobalt Strike - IcedID, Emotet and QBot

Qbot needs only 30 minutes to steal your credentials, emails

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Qbot needs only 30 minutes to steal your credentials, emails

Emotet Is Not Dead (Yet) – Part 2

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Is Not Dead (Yet) – Part 2

Qbot Likes to Move It, Move It

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Qbot Likes to Move It, Move It

Malware Analysis Spotlight: Emotet’s Use of Cryptography

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware Analysis Spotlight: Emotet’s Use of Cryptography

Emotet Stops Using 0.0.0.0 in Spambot Traffic - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Stops Using 0.0.0.0 in Spambot Traffic - SANS ISC

Intelligence Insights- January 2022

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Intelligence Insights- January 2022

[QuickNote] Emotet epoch4 & epoch5 tactics

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor [QuickNote] Emotet epoch4 & epoch5 tactics

Emotet Is Not Dead (Yet)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Is Not Dead (Yet)

Emotet Spam Abuses Unconventional IP Address Formats to Spread Malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Spam Abuses Unconventional IP Address Formats to Spread Malware

0.0.0.0 in Emotet Spambot Traffic - SANS Internet Storm Center

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 0.0.0.0 in Emotet Spambot Traffic - SANS Internet Storm Center

Malware vaccines can prevent pandemics, yet are rarely used

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malware vaccines can prevent pandemics, yet are rarely used

Secure Communications Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Secure Communications Blog

2021 Adversary Infrastructure Report

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 2021 Adversary Infrastructure Report

Emotet’s Excel 4.0 Macros Dropping DLLs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet’s Excel 4.0 Macros Dropping DLLs

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decrypting-qakbots-encrypted-registry-keys/

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/decrypting-qakbots-encrypted-registry-keys/

Threat Analysis Report: DatopLoader Exploits ProxyShell to Deliver QBOT and Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat Analysis Report: DatopLoader Exploits ProxyShell to Deliver QBOT and Cobalt Strike

Signed DLL campaigns as a service

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Signed DLL campaigns as a service

Analyzing an IcedID Loader Document

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analyzing an IcedID Loader Document

Emotet 2.0: Everything you need to know about the new Variant of the Banking Trojan - CloudSEK

Malpedia library date fromORKL

The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor Emotet 2.0: Everything you need to know about the new Variant of the Banking Trojan - CloudSEK

Staging a Quack: Reverse Analyzing a Fileless QAKBOT Stager

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Staging a Quack: Reverse Analyzing a Fileless QAKBOT Stager

How the

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How the

Intelligence Insights: December 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Intelligence Insights: December 2021

Return of Emotet: Malware Analysis | Zscaler Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Return of Emotet: Malware Analysis | Zscaler Blog

Emotet’s Return: What's Different? | HP Wolf Security

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet’s Return: What's Different? | HP Wolf Security

A closer look at Qakbot’s latest building blocks (and how to knock them down) | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A closer look at Qakbot’s latest building blocks (and how to knock them down) | Microsoft Security Blog

Emotet now drops Cobalt Strike, fast forwards ransomware attacks

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet now drops Cobalt Strike, fast forwards ransomware attacks

TA551 (Shathak) pushes IcedID (Bokbot)

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TA551 (Shathak) pushes IcedID (Bokbot)

TA551 (Shathak) pushes IcedID (Bokbot) - SANS ISC

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA551 (Shathak) pushes IcedID (Bokbot) - SANS ISC

The Re-Emergence of Emotet | Deep Instinct

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Re-Emergence of Emotet | Deep Instinct

CONTInuing the Bazar Ransomware Story

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor CONTInuing the Bazar Ransomware Story

CONTInuing the Bazar Ransomware Story

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor CONTInuing the Bazar Ransomware Story

Emotet de retour, POC Exchange, 0-day Windows : à quelle sauce les attaquants prévoient de nous manger cette semaine ?

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet de retour, POC Exchange, 0-day Windows : à quelle sauce les attaquants prévoient de nous manger cette semaine ?

Mummy Spider's Emotet Malware is Back After a Year Hiatus; Wizard Spider's TrickBot Observed in Its Return

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Mummy Spider's Emotet Malware is Back After a Year Hiatus; Wizard Spider's TrickBot Observed in Its Return

RedSense

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor RedSense

Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Squirrelwaffle Exploits ProxyShell and ProxyLogon to Hijack Email Chains

La Botnet De EMOTET Reinicia Ataques En Chile Y LATAM | CronUp Ciberseguridad

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor La Botnet De EMOTET Reinicia Ataques En Chile Y LATAM | CronUp Ciberseguridad

【注意喚起】マルウェアEmotetが10カ月ぶりに活動再開、日本も攻撃対象に | LAC WATCH

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 【注意喚起】マルウェアEmotetが10カ月ぶりに活動再開、日本も攻撃対象に | LAC WATCH

Netskope Threat Coverage: The Return of Emotet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Netskope Threat Coverage: The Return of Emotet

Emotet Activity Identified

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Activity Identified

Intelligence Insights- November 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Intelligence Insights- November 2021

Intelligence Insights: November 2021

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Intelligence Insights: November 2021

TrickBot helps Emotet come back from the dead

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TrickBot helps Emotet come back from the dead

Return of Emotet malware | Zscaler

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Return of Emotet malware | Zscaler

Emotet Returns - SANS Internet Storm Center

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Returns - SANS Internet Storm Center

Emotet malware is back and rebuilding its botnet via TrickBot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet malware is back and rebuilding its botnet via TrickBot

ProxyShell, QBot, and Conti ransomware combined in a series of cyber attacks - Truesec

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor ProxyShell, QBot, and Conti ransomware combined in a series of cyber attacks - Truesec

Guess who's back | cyber.wtf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Guess who's back | cyber.wtf

QAKBOT Loader Returns With New Techniques and Tools

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QAKBOT Loader Returns With New Techniques and Tools

Technical-Brief---The-Prelude-to-Ransomware-A-Look-into-Current-QAKBOT-Capabilities-and-Activity.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Technical-Brief---The-Prelude-to-Ransomware-A-Look-into-Current-QAKBOT-Capabilities-and-Activity.pdf

The Business of Fraud: Botnet Malware Dissemination

Malpedia library date Insikt Group® fromORKL

Archived copy on ORKL Detailsfor The Business of Fraud: Botnet Malware Dissemination

Quakbot Strikes with QuakNightmare Exploitation

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quakbot Strikes with QuakNightmare Exploitation

Research Recap: How To Automate Malware Campaign Detection With Telemetry Peak Analyzer

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Research Recap: How To Automate Malware Campaign Detection With Telemetry Peak Analyzer

CIRCL » TR-64 - Exploited Exchange Servers

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor CIRCL » TR-64 - Exploited Exchange Servers

THREAT ANALYSIS REPORT- From Shatak Emails to the Conti Ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT- From Shatak Emails to the Conti Ransomware

THREAT ANALYSIS REPORT: From Shathak Emails to the Conti Ransomware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor THREAT ANALYSIS REPORT: From Shathak Emails to the Conti Ransomware

Detecting IcedID... Could It Be A Trickbot Copycat? | Splunk

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting IcedID... Could It Be A Trickbot Copycat? | Splunk

SQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SQUIRRELWAFFLE Leverages malspam to deliver Qakbot, Cobalt Strike

CERTFR-2021-CTI-009

Malpedia library date fromORKL

The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor CERTFR-2021-CTI-009

Digital banking fraud: how the Gozi malware works

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Digital banking fraud: how the Gozi malware works

Digital banking fraud- how the Gozi malware works

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Digital banking fraud- how the Gozi malware works

TA551 Uses ‘SLIVER’ Red Team Tool in New Activity

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor TA551 Uses ‘SLIVER’ Red Team Tool in New Activity

TA551 Uses ‘SLIVER’ Red Team Tool in New Activity | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor TA551 Uses ‘SLIVER’ Red Team Tool in New Activity | Proofpoint US

Case Study- From BazarLoader to Network Reconnaissance

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Case Study- From BazarLoader to Network Reconnaissance

Case Study: From BazarLoader to Network Reconnaissance

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Case Study: From BazarLoader to Network Reconnaissance

IcedID to XingLocker Ransomware in 24 hours

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID to XingLocker Ransomware in 24 hours

Ransomware Operators Found Using New Franchise Business Model

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Ransomware Operators Found Using New Franchise Business Model

Trickbot Rising — Gang Doubles Down on Infection Efforts to Amass Network Footholds

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Trickbot Rising — Gang Doubles Down on Infection Efforts to Amass Network Footholds

TrickBot gang doubles down enterprise infection

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor TrickBot gang doubles down enterprise infection

New Trickbot and BazarLoader delivery vectors

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor New Trickbot and BazarLoader delivery vectors

New Trickbot and BazarLoader campaigns use multiple delivery vectorsi

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor New Trickbot and BazarLoader campaigns use multiple delivery vectorsi

SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor SquirrelWaffle: New Malware Loader Delivering Cobalt Strike and QakBot

Threat hunting in large datasets by clustering security events

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Threat hunting in large datasets by clustering security events

Threat hunting in large datasets by clustering security events

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat hunting in large datasets by clustering security events

Security Brief: TA544 Targets Italian Organizations with Ursnif Malware | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Security Brief: TA544 Targets Italian Organizations with Ursnif Malware | Proofpoint US

Intelligence Insights- September 2021

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Intelligence Insights- September 2021

Rendering Threats: A Network Perspective

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Rendering Threats: A Network Perspective

Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Remote Code Execution Zero-Day (CVE-2021-40444) Hits Windows, Triggered Via Office Docs

The State of SSL/TLS Certificate Usage in Malware C&C Communications

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The State of SSL/TLS Certificate Usage in Malware C&C Communications

QakBot technical analysis

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor QakBot technical analysis

210823.pdf

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 210823.pdf

The Ransomware Threat (White Paper)

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor The Ransomware Threat (White Paper)

Prometheus TDS

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Prometheus TDS

Meet Prometheus, the secret TDS behind some of today's malware campaigns

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Meet Prometheus, the secret TDS behind some of today's malware campaigns

Detecting TA551 domains

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Detecting TA551 domains

Detecting TA551 domains

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Detecting TA551 domains

Hunting IcedID and unpacking automation with Qiling

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Hunting IcedID and unpacking automation with Qiling

Quack Quack: Analysing Qakbot’s Browser Hooking Module – Part 1

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Quack Quack: Analysing Qakbot’s Browser Hooking Module – Part 1

IcedID and Cobalt Strike vs Antivirus

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor IcedID and Cobalt Strike vs Antivirus

Over 780,000 email accounts compromised by Emotet have been secured

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Over 780,000 email accounts compromised by Emotet have been secured

REvil-ution – A Persistent Ransomware Operation

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor REvil-ution – A Persistent Ransomware Operation

REvil-ution - A Persistent Ransomware Operation - CYJAX

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor REvil-ution - A Persistent Ransomware Operation - CYJAX

IcedID: Analysis and Detection

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID: Analysis and Detection

Gozi malware gang member arrested in Colombia

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Gozi malware gang member arrested in Colombia

Shelob Moonlight – Spinning a Larger Web From IcedID to CONTI, a Trojan and Ransomware collaboration

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Shelob Moonlight – Spinning a Larger Web From IcedID to CONTI, a Trojan and Ransomware collaboration

Evasive Maneuvers | Massive IcedID Campaign Aims For Stealth with Benign Macros - SentinelLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Evasive Maneuvers | Massive IcedID Campaign Aims For Stealth with Benign Macros - SentinelLabs

Malicious spam campaigns delivering banking Trojans

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious spam campaigns delivering banking Trojans

From Word to Lateral Movement in 1 Hour

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor From Word to Lateral Movement in 1 Hour

From Word to Lateral Movement in 1 Hour

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor From Word to Lateral Movement in 1 Hour

How Initial Access Brokers Lead to Ransomware | Proofpoint US

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor How Initial Access Brokers Lead to Ransomware | Proofpoint US

Análisis campaña Emotet - Security Art Work

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Análisis campaña Emotet - Security Art Work

The First Step- Initial Access Leads to Ransomware

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The First Step- Initial Access Leads to Ransomware

FortiMail Workspace Security | Fortinet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FortiMail Workspace Security | Fortinet

BKA befragt Schlüsselfigur im Fall Emotet

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor BKA befragt Schlüsselfigur im Fall Emotet

Cybercrime: On the Trail of the Internet Extortionists

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cybercrime: On the Trail of the Internet Extortionists

FUJIFILM shuts down network after suspected ransomware attack

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor FUJIFILM shuts down network after suspected ransomware attack

A Deep Dive into Packing Software CryptOne

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Deep Dive into Packing Software CryptOne

Melting Ice – Tracking IcedID Servers with a few simple steps

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Melting Ice – Tracking IcedID Servers with a few simple steps

Look how many cybercriminals love Cobalt Strike

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Look how many cybercriminals love Cobalt Strike

An Encounter With TA551-Shathak

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor An Encounter With TA551-Shathak

An Encounter With TA551/Shathak

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor An Encounter With TA551/Shathak

Let’s set ice on fire: Hunting and detecting IcedID infections

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Let’s set ice on fire: Hunting and detecting IcedID infections

Conti Ransomware

publisher's date The DFIR Report fromORKLDFIR Report

Archived copy on ORKL Detailsfor Conti Ransomware

Emotet: Wie das riesige Hacker-Netzwerk lahmgelegt wurde

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet: Wie das riesige Hacker-Netzwerk lahmgelegt wurde

日本を狙う新たな攻撃キャンペーン Campo の全体像 - Mal-Eats

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor 日本を狙う新たな攻撃キャンペーン Campo の全体像 - Mal-Eats

RM3 – Curiosities of the wildest banking malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RM3 – Curiosities of the wildest banking malware

Cyber Security Research

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Cyber Security Research

RL Blog | ReversingLabs

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor RL Blog | ReversingLabs

Botnet-update-Q1-2021.pdf

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor Botnet-update-Q1-2021.pdf

GitHub - cecio/EMOTET-2020-Reversing: a State-Machine reversing exercise

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor GitHub - cecio/EMOTET-2020-Reversing: a State-Machine reversing exercise

Analysing a malware PCAP with IcedID and Cobalt Strike traffic

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Analysing a malware PCAP with IcedID and Cobalt Strike traffic

The rise of QakBot

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor The rise of QakBot

Malicious Infrastructure as a Service

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Malicious Infrastructure as a Service

A Spike in BazarCall and IcedID Activity Detected in March

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor A Spike in BazarCall and IcedID Activity Detected in March

A Spike in BazarCall and IcedID Activity Detected in March

date in the title fromORKL

The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor A Spike in BazarCall and IcedID Activity Detected in March

PaaS, or how hackers evade antivirus software

Malpedia library date fromORKL

The original link failed its last check. Original publisher Detailsfor PaaS, or how hackers evade antivirus software

IcedID on my neck I’m the coolest

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor IcedID on my neck I’m the coolest

Emotet Command and Control Case Study

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Emotet Command and Control Case Study

Investigating a unique “form” of email delivery for IcedID malware

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigating a unique “form” of email delivery for IcedID malware