Kaspersky experts discuss optimizing penetration testing with an agent for the Mythic framework and object files for Cobalt Strike. This article has been indexed from Securelist Read the original article: Using a Mythic agent to optimize penetration testing
Tag: Securelist
State of ransomware in 2025
Kaspersky researchers review ransomware trends for 2024, analyze the most active groups and forecast how this threat will evolve in 2025. This article has been indexed from Securelist Read the original article: State of ransomware in 2025
State of ransomware in 2025
Kaspersky researchers review ransomware trends for 2024, analyze the most active groups and forecast how this threat will evolve in 2025. This article has been indexed from Securelist Read the original article: State of ransomware in 2025
Outlaw cybergang attacking targets worldwide
The Kaspersky Global Emergency Response Team (GERT) detected an Outlaw mining botnet in a customer incident. In this article, we share insights into this botnet’s SSH-based infection chain. This article has been indexed from Securelist Read the original article: Outlaw…
Outlaw cybergang attacking targets worldwide
The Kaspersky Global Emergency Response Team (GERT) detected an Outlaw mining botnet in a customer incident. In this article, we share insights into this botnet’s SSH-based infection chain. This article has been indexed from Securelist Read the original article: Outlaw…
Triada strikes back
Kaspersky expert has discovered a new version of the Triada Trojan, with custom modules for Telegram, WhatsApp, TikTok, and other apps. This article has been indexed from Securelist Read the original article: Triada strikes back
Operation SyncHole: Lazarus APT goes back to the well
Kaspersky GReAT experts uncovered a new campaign by Lazarus APT that exploits vulnerabilities in South Korean software products and uses a watering hole approach. This article has been indexed from Securelist Read the original article: Operation SyncHole: Lazarus APT goes…
Russian organizations targeted by backdoor masquerading as secure networking software updates
While investigating an incident, we discovered a sophisticated new backdoor targeting Russian organizations by impersonating secure networking software updates. This article has been indexed from Securelist Read the original article: Russian organizations targeted by backdoor masquerading as secure networking software…
Lumma Stealer – Tracking distribution channels
During incident response activities, our GERT team discovered Lumma Stealer in a customer’s infrastructure. Our experts conducted an investigation and analyzed its distribution scheme in detail. This article has been indexed from Securelist Read the original article: Lumma Stealer –…
Phishing attacks leveraging HTML code inside SVG files
Attackers are increasingly sending phishing emails with SVG attachments that contain embedded HTML pages or JavaScript code. This article has been indexed from Securelist Read the original article: Phishing attacks leveraging HTML code inside SVG files
IronHusky updates the forgotten MysterySnail RAT to target Russia and Mongolia
MysterySnail RAT attributed to IronHusky APT group hasn’t been reported since 2021. Recently, Kaspersky GReAT detected new versions of this implant in government organizations in Mongolia and Russia. This article has been indexed from Securelist Read the original article: IronHusky…
Streamlining detection engineering in security operation centers
A proper detection engineering program can help improve SOC operations. In this article we’ll discuss potential SOC issues, the necessary components of a detection engineering program and some useful metrics for evaluating its efficiency. This article has been indexed from…
GOFFEE continues to attack organizations in Russia
Kaspersky researchers analyze GOFFEE’s campaign in H2 2024: the updated infection scheme, new PowerModul implant, switch to a binary Mythic agent. This article has been indexed from Securelist Read the original article: GOFFEE continues to attack organizations in Russia
Attackers distributing a miner and the ClipBanker Trojan via SourceForge
Malicious actors are using SourceForge to distribute a miner and the ClipBanker Trojan while utilizing unconventional persistence techniques. This article has been indexed from Securelist Read the original article: Attackers distributing a miner and the ClipBanker Trojan via SourceForge
How ToddyCat tried to hide behind AV software
While analyzing a malicious DLL library used in attacks by APT group ToddyCat, Kaspersky expert discovered the CVE 2024-11859 vulnerability in a component of ESET’s EPP solution. This article has been indexed from Securelist Read the original article: How ToddyCat…
A journey into forgotten Null Session and MS-RPC interfaces, part 2
Kaspersky expert dissects the MS-RPC security mechanism and provides a step-by-step analysis of calling a function from the Netlogon interface. This article has been indexed from Securelist Read the original article: A journey into forgotten Null Session and MS-RPC interfaces,…
TookPS: DeepSeek isn’t the only game in town
The TookPS malicious downloader is distributed under the guise of DeepSeek, and further mimics UltraViewer, AutoCAD, SketchUp, Ableton, and other popular tools. This article has been indexed from Securelist Read the original article: TookPS: DeepSeek isn’t the only game in…
Operation ForumTroll: APT attack with Google Chrome zero-day exploit chain
Kaspersky GReAT experts discovered a complex APT attack on Russian organizations dubbed Operation ForumTroll, which exploits zero-day vulnerabilities in Google Chrome. This article has been indexed from Securelist Read the original article: Operation ForumTroll: APT attack with Google Chrome zero-day…
Financial cyberthreats in 2024
The Kaspersky financial threat report for 2024 contains the main trends and statistics on financial phishing and scams, mobile and PC banking malware, as well as recommendations on how to protect yourself and your business. This article has been indexed…
Threat landscape for industrial automation systems in Q4 2024
The report contains statistics on malware, initial infection vectors and other threats to industrial automation systems in Q4 2024. This article has been indexed from Securelist Read the original article: Threat landscape for industrial automation systems in Q4 2024