Google’s Threat Analysis Group (TAG) tracks actors involved in information operations (IO), government backed attacks and financially motivated abuse. For years, TAG has…

A computer processor uses a so-called Instruction Set Architecture to talk with the world outside of its own circuitry. This ISA consists of a number of instructions, which essentially define the f…

Intro Magniber is a ransomware that was initially targeting South Korea. My first report on this malware was written for Malwarebytes in 2017 (here). Since then, the ransomware was completely rewri…

Intro

TL;DR: This blog post describes the details and methodology of our research targeting the Windows Installer (MSI) installation technology. If you’re only interested in the vulnerability itself, then jump right there

APT-C-23  双尾蝎APT-C-23（双尾蝎）组织，是一个针对巴以地区的教育机构、军事机构等重要领域进行网络间谍活动，以窃取敏感信息为主的网络攻击组织。攻击平台主要包括 Windows 与 Android。该组织的攻击行...

Recently, we came across a detection in our telemetry report named “com.goatmw” which gained our attention. We decided to investigate […]

Group tracked since 2021 exploits unpatched Zimbra servers to hack email accounts.

The content of this post is solely the responsibility of the author.  AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article.  Introduction: Dridex, also known as Cridex or Bugat, is a banking Trojan…

The Windows forensics methodology comprises of 8 phases, and we have previously covered the initial five. If you wish to explore them…

Quick study of this wonderful technique

The malware variant uses Telegram's communications protocol to hide its command and control (C2) processes while it exfiltrates sensitive data.

A Pentagrid security advisory about multiple vulnerabilities in the Aten PE8108 PDU remote power outlet control.

If you’ve ever “understood” DLL hijacking, only to return to your lab and fail to get it working properly, this post is for you.

This is a detective story about how a car was stolen - and how it uncovered an epidemic of high-tech car theft. It begins with a tweet. In April 2022, my friend Ian Tabor tweeted that vandals had been at his car, pulling apart the headlight and unplugging…

Research by: Jiri  Vinopal, Dennis Yarizadeh and Gil Gekker Key Findings: Introduction While responding to a ransomware case against a US-based company, the CPIRT recently came across a unique ransomware strain deployed using a signed component of a commercial…

IcedID continues to deliver malspam emails to facilitate a compromise. This case covers the activity from a campaign in late September of 2022. Post exploitation activities detail some familiar and some new techniques and tooling, which led to  domain wide…

I’m excited to announce that I will be returning this year to the Black Hat USA 2023 conference in Las Vegas. As with previous years’…

Analyzing UpdateAgent, the 2nd-stage macOS payload of the 3CX supply chain attack

Threat actors exploit WinRAR self-extracting (SFX) archives containing decoy files by adding malicious functionality to install backdoors in target

2easy is a Russian-and English-language illicit shop that sells logs as well as user information collected from browsers via stealer malware.