The Agent Tesla malspam campaign has been observed using messages related to the conflict in Ukraine. Learn the indicators and mitigation techniques now.

Author: Jiho Kim | S2W TALON

Authors: Alberto Segura, Malware analystRolf Govers, Malware analyst & Forensic IT Expert NCC Group, as well as many other researchers noticed a rise in Android malware last year, especillay An…

Telsy Threat Intelligence team observed a Cobalt Strike attack against members of the Indian government or local institutions.

We discovered malicious, targeted advanced persistent threat (APT) activity on a partner's system. Here, we dive into the BABYSHARK malware strain.

A new Formbook campaign is targeting oil and gas companies.

Threat actors are using stolen NVIDIA code signing certificates to sign malware to appear trustworthy and allow malicious drivers to be loaded in Windows.

The hackers have claimed a number of disruptions over the past week, blurring the lines between amateurs and groups linked to governments.

TeaBot resurrected with evolved malware distribution tactics active across Google Play Store, primarily circulating through OR Code Apps…

The ASEC analysis team has discovered Remcos RAT being distributed under the disguise of a tax invoice. The content and the type of phishing email are similar to the type that has been consistently discussed in previous blogs. Within the email, it has a short…

FortiGuard Labs discovered more than 500 Microsoft Excel files involved in a campaign to deliver a fresh Emotet Trojan variant. Read to learn more how to avoid this lure.…

Online security is extremely important for people in Ukraine and the surrounding region right now. Government agencies, independent newspapers and public service provide…

Proofpoint provides insights into TA416's activity targeting European governments as conflict in Ukraine escalates. Learn more about this Chinese state threat group.

Webhards is a platform used to distribute malware, and it is mainly used by attackers that mainly target Korean users. The ASEC analysis team has been monitoring malware types distributed through webhards and has uploaded multiple blog posts about them in…

The ASEC analysis team has discovered distribution of malicious HWP file disguised as “Press Release of 20th Presidential Election Early Voting for Sailors” as the presidential election draws near. The attacker distributed the malicious HWP file on February…

We analyze RURansom, a malware variant discovered to be targeting Russia. Originally suspected to be a ransomware because of its name, analysis reveals RURansom to be a wiper.

We detail APT41's persistent effort that allowed them to successfully compromise at least 6 U.S. state government networks by exploiting vulnerable web apps.

FortiGuard Labs discovered a phishing email addressed to a Ukrainian recipient that masqueraded as purchase order containing a PPT attachment aiming to deploy the Agent Tesla RAT. Learn more.…

In the first of a two-part series of blogs, we will delve deeper into Daxin, examining the driver initialization, networking, key exchange, and backdoor functionality of the malware.