Investigate malicious Windows logon by visualizing and analyzing Windows event log - JPCERTCC/LogonTracer

LNK files (aka Windows shortcuts) may seem simple, but threat actors can use them to execute other binaries and inflict great harm.

What Is a Race Condition Vulnerability?

A race condition attack happens when a computing system that’s designed to
handle tasks in a specific sequence is forced to perform two or more operations
simultaneously. This technique takes advantage of a time gap…

Key Takeaways Background What causes a man to wake up one day and say, “I’m going to build my own malware and go sell it to cybercriminals on the dark web”? After all, the market is saturated with competitors, and the product is judged on the one sole metric…

Introduced in 2012, Secure Boot - the OG trust in boot - has become a foundational rock in modern computing and is used by millions of UEFI-enabled computers around the world due to its integration in their BIOS.

The way Secure Boot works is simple and…

[Update: Following additional analysis of shellcode used in ICONIC, in conjunction with other observations from the wider security community, Volexity now attributes the activity described in this post to the […]

The 3CX supply chain attack, gives us an opportunity to analyze a trojanized macOS application

Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

A sophisticated new toolset is being used to harvest credentials from multiple cloud service providers, including AWS SES and Microsoft Office 365.

In May 2022 Microsoft has fixed a vulnerability related to certificate logon to Active Directory. As a non-privileged user you could escalate privileges by impersonating a Domain Controller, as you…

Zscaler, the zero trust cybersecurity leader, accelerates digital transformation with fast, secure connections between users, devices and apps over any network.

Dive into the investigation of a zero-day attack that took advantage of a vulnerability in Forta’s file-transfer tool, GoAnyWhere. Explore the research from IBM X-Force experts.

🎤⌨️ Acoustic keyboard eavesdropping. Contribute to ggerganov/kbd-audio development by creating an account on GitHub.

Google’s Threat Analysis Group (TAG) tracks actors involved in information operations (IO), government backed attacks and financially motivated abuse. For years, TAG has…

A computer processor uses a so-called Instruction Set Architecture to talk with the world outside of its own circuitry. This ISA consists of a number of instructions, which essentially define the f…

Intro Magniber is a ransomware that was initially targeting South Korea. My first report on this malware was written for Malwarebytes in 2017 (here). Since then, the ransomware was completely rewri…