Sharing is caring, and sharing data with the cybersec community is one of our contributions to the global fight against cybercrime. The Group-IB Threat Intelligence team now has its own Twitter account: make sure to follow for the latest research, analytics, IOCs and threat alerts 👉 https://twitter.com/GroupIB_TI

#ThreatIntelligence

📦 What happens when you combine ransomware with information stealers, remote access Trojans, and other malware in one easy-to-download package?

Dubai-based researchers from Group-IB’s Digital Forensics and Incident Response (DFIR) team found that malicious actors, instead of simply infecting a computer with ransomware, have taken to packaging a whole host of malicious files into what we call malware bundles.

Malware bundles have been around for a while, but their recent usage by cybercriminals reveals some interesting trends. First, it highlights how threat actors, with their ever-growing appetite for cash, create new approaches for monetization. Secondly, their usage can reveal insights into the interactions between low-skilled threat actors and their more sophisticated counterparts. An entry-level cybercriminal can leverage a malware bundle to gain access to a single computer, but they are also able to sell this access to a more-skilled threat actor who is able to move laterally from a single device to an entire corporate network.

Check out our latest blog post to get the insights from our investigations into affected companies in Egypt, South Africa, Saudi Arabia, Turkey, Morocco, UAE, Kenya, Israel, Pakistan, India, and Germany. We discuss channels of delivery, malware attribution, tactics, techniques and procedures (TTPs), and bundled parts and roles, all in reference to the MITRE ATT&CK® (Adversarial Tactics, Techniques & Common Knowledge) framework, in order to detail how the cybercriminals gained initial access and secured persistence. Read now👈

#ransomware

Want to learn how to monitor for IS incidents, detect threats, eliminate false positives, and perform initial incident response? Register for the "Blue Team Analyst" training course by Group-IB!

In three days, you’ll know how to:

▪️Monitor all solutions to ensure that the organization is secure;
▪️Quickly assess security incidents and determine the main features of a cyberattack;
▪️Support threat intelligence and threat hunting processes.

It's time to enhance your skills! Register now👈

#education