Labs

Conti Unpacked Understanding Ransomware Development As A Response To Detection 2

Conti Unpacked | Understanding Ransomware Development As a Response to Detection

Conti’s rapid encryption speed is matched only by its rapid evolution. SentinelLabs’ deep dive explores its development in unprecedented detail.

Read More
Bypassing MacOS TCC User Privacy Protections By Accident And Design 8

Bypassing macOS TCC User Privacy Protections By Accident and Design

TCC is meant to protect user data from unauthorized access, but design flaws mean users and malware can bypass TCC, even by accident.

Read More
Evasive Maneuvers Massive IcedID Campaign Aims For Stealth With Benign Macros 5

Evasive Maneuvers | Massive IcedID Campaign Aims For Stealth with Benign Macros

A widespread phishing campaign in operation since May is using a mix of old and new evasion tricks to drop IcedID malware.

Read More
Gootloader ‘Initial Access As A Service Platform Expands Its Search For High Value Targets By Antonio Pirozzi. 4

Gootloader: ‘Initial Access as a Service’ Platform Expands Its Search for High Value Targets

Gootloader expands its scope to target military, pharmaceutical and energy sectors, operating on an Initial Access As a Service model.

Read More
ThunderCats Hack The FSB Your Taxes Didnt Pay For This Op 5

ThunderCats Hack the FSB | Your Taxes Didn’t Pay For This Op

Early fingerpointing at Western governments for a hack against the Russian government was misplaced. Our taxes didn’t pay for this one.

Read More
NobleBaron New Poisoned Installers Could Be Used In Supply Chain Attacks 2

NobleBaron | New Poisoned Installers Could Be Used In Supply Chain Attacks

Nobelium – the new face of APT29 – deploys poisoned installers against Ukrainian government targets in a possible supply chain attack.

Read More
From Wiper To Ransomware The Evolution Of Agrius 7

From Wiper to Ransomware | The Evolution of Agrius

New threat actor Agrius engages in espionage and destructive attacks, masquerades as ransomware with custom backdoor, wiper and malware.

Read More
Caught In The Cloud How A Minero Cryptominer Exploits Docker Containers 4

Caught in the Cloud | How a Monero Cryptominer Exploits Docker Containers

This crypto mining campaign doesn’t use notable exploit components but leverages shell scripts to infect cloud containers and bypass AVs.

Read More
Hundreds Of Millions Of Dell Computers At Risk Due To Multiple BIOS Driver Privilege Escalation Flaws 11

CVE-2021-21551- Hundreds Of Millions Of Dell Computers At Risk Due to Multiple BIOS Driver Privilege Escalation Flaws

Update your Dell devices now! SentinelLabs discover five high severity flaws in Dell firmware update driver impacting desktops, laptops, notebooks and more.

Read More
Copy Of Relaying Potatoes  DCE RPC NTLM Relay EOP 7

Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol

A newly-discovered NTLM relay attack makes every Windows system vulnerable to an escalation of privileges attack, and there’s no patch in sight.

Read More