Hotcobalt – New Cobalt Strike DoS Vulnerability That Lets You Halt Operations
CVE-2021-36798 is a vulnerability in Cobalt Strike server that could allow victims to register a fake Beacon and DoS attackers.
Read More
MeteorExpress | Mysterious Wiper Paralyzes Iranian Trains with Epic Troll
In the midst of an epic troll on a country-wide railway system, we discovered a new threat actor and their reusable wiper called Meteor.
Read More
CVE-2021-3438: 16 Years In Hiding – Millions of Printers Worldwide Vulnerable
A high severity flaw in HP, Samsung and Xerox printer drivers has existed since 2005 and could lead to an escalation of privilege.
Read More
Conti Unpacked | Understanding Ransomware Development As a Response to Detection
Conti’s rapid encryption speed is matched only by its rapid evolution. SentinelLabs’ deep dive explores its development in unprecedented detail.
Read More
Bypassing macOS TCC User Privacy Protections By Accident and Design
TCC is meant to protect user data from unauthorized access, but design flaws mean users and malware can bypass TCC, even by accident.
Read More
Evasive Maneuvers | Massive IcedID Campaign Aims For Stealth with Benign Macros
A widespread phishing campaign in operation since May is using a mix of old and new evasion tricks to drop IcedID malware.
Read More
Gootloader: ‘Initial Access as a Service’ Platform Expands Its Search for High Value Targets
Gootloader expands its scope to target military, pharmaceutical and energy sectors, operating on an Initial Access As a Service model.
Read More
ThunderCats Hack the FSB | Your Taxes Didn’t Pay For This Op
Early fingerpointing at Western governments for a hack against the Russian government was misplaced. Our taxes didn’t pay for this one.
Read More
NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks
Nobelium – the new face of APT29 – deploys poisoned installers against Ukrainian government targets in a possible supply chain attack.
Read More
From Wiper to Ransomware | The Evolution of Agrius
New threat actor Agrius engages in espionage and destructive attacks, masquerades as ransomware with custom backdoor, wiper and malware.
Read More