Labs

The Art And Science Of MacOS Malware Hunting With Radare2 Leveraging Xrefs YARA Zignatures 11

The Art and Science of macOS Malware Hunting with radare2 | Leveraging Xrefs, YARA and Zignatures

In the next part of our series on reversing macOS malware, we dig into identifying reused code across malware samples for hunting and detection.

Read More
Another Brick In The Wall Uncovering SMM Vulnerabilities In HP Firmware 1

Another Brick in the Wall: Uncovering SMM Vulnerabilities in HP Firmware

How we used Brick to discover six different vulnerabilities affecting HP laptops' firmware

Read More
Zen And The Art Of SMM Bug Hunting 5

Zen and the Art of SMM Bug Hunting | Finding, Mitigating and Detecting UEFI Vulnerabilities

In Part 5 of our ongoing series on UEFI security research, we dive into the fascinating world of hunting and exploiting SMM vulnerabilities.

Read More
Hermetic Wiper Ukraine Is Under Attack 4

HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine

A new malware is attacking Ukrainian organizations and erasing Windows devices. In this early analysis, we provide technical details, IOCS and hunting rules.

Read More
SanctionsBeDamnedFromDridexToMacawTheEvolutionOfEvilCorp 3

Sanctions Be Damned | From Dridex to Macaw, The Evolution of Evil Corp

What really happened to Evil Corp after the OFAC sanctions? Did they cut and run, or are they still operating with impunity?

Read More
Log4j2 In The Wild Iranian Aligned Threat Actor TunnelVision Actively Exploiting VMware Horizon 10

Log4j2 In The Wild | Iranian-Aligned Threat Actor “TunnelVision” Actively Exploiting VMware Horizon

Threat actor exploits Log4j2 vulnerabilities to drop PowerShell backdoors, harvest credentials, and communicate via legitimate services.

Read More
ModifiedElephant APT And The Decade Of Fabricating Terrorism 5

ModifiedElephant APT and a Decade of Fabricating Evidence

A previously unreported threat actor has been targeting civil society for over a decade. Read about how it operates and its relationships to other threats.

Read More
Firefox JIT Use After Frees Exploiting CVE 2020 26950 6

Firefox JIT Use-After-Frees | Exploiting CVE-2020-26950

Learn how to dive into JIT compilers in JavaScript engines and follow along as we find a new set of exploit primitives in this previously patched bug.

Read More
Hacktivism And State Sponsored Knock Offs Attributing Deceptive Hack And Leak Operations 3

Hacktivism and State-Sponsored Knock-Offs | Attributing Deceptive Hack-and-Leak Operations

Are there still real hacktivists out there or are they all a cover for state-sponsored operations?

Read More
BlackCat Ransomware Highly Configurable Rust Driven RaaS On The Prowl For Victims 6

BlackCat Ransomware | Highly-Configurable, Rust-Driven RaaS On The Prowl For Victims

With victims in the US, Australia and India, BlackCat is a new RaaS making a big impact. Learn more about this unique ransomware's behavior and IoCs.

Read More