If you’ve been following the news, specifically security news, I’m sure you’re aware of the recent influx of phishing scams. They’re…

An Anomaly-based Botnet Detection Approach for Identifying Stealthy Botnets - sajjadium/BotGrabber

NTLM relay is a technique of standing between a client and a server to perform actions on the server while impersonating the client. Protections such as SMB signing or MIC allow to limit the actions of an attacker. This article goes into detail about this…

Uncovering a Malware Campaign Targeting the Logistics Industry | SCHUTZWERK Blog

Get the intelligence you need to detect, prevent & respond to cyber threats. Read the Intel 471 cyber threat intelligence blog.

The Chinese government and the Chinese telecommunications companies such as Huawei under its control are proposing a “New IP” addressing system for the

While checking out the Triage Sandbox[1] I stumbled across upon QBot which I’ve seen already plenty of times at work at GData Cyberdefense AG[2]. This time I wanted to take a closer look at t…

Hash – 077f75ef7fdb1663e70c33e20d8d7c4383fa13fd95517fab8023fce526bf3a25 Family : Agent Tesla Downloaded Sample Link: Click here Signature: Microsoft Visual C# v7.0/ Basic.NET Filename: UIhLdV…

We found a coinminer bundled with the legitimate installer of video conferencing app Zoom. Users who attempt to download the installer get more than what they bargain for as they instead download the AutoIt compiled malware Trojan.Win32.MOOZ.THCCABO.

Ever seen an application display a message like "changes will be rolled back ", particularly after a SQL operation? This may be a clue that ...

A group of security researchers has found thousands of Android mobile applications containing hidden backdoors and blacklists.

Original Windows File Manager (winfile) with enhancements - microsoft/winfile

An ambitious attack campaign directed by resourceful actors targeting misconfigured container environments.

Solving a CTF Challenge from Practical Binary Analysis book, a step by step guide

Solution to exercises at chapter 11 and 13 of the book Practical Binary Analysis by Dennis Andriesse - guestx86/Practical-Binary-Analysis

Introduction As we know one of the main issues facing defenders, especially in large environments, is protecting against threat actors after they gain a foothold in the environment. If an attacker lands on a domain-joined PC, the attack surface is massive…

This post covers initial compromise via the RDS service, bypassing AppLocker and AMSI protections, and domain/trust compromise.

分享奇虎360公司的技术，与安全的互联网共同成长。