Tracking Seized Domains: Checking Your Environment for Harmful Domain IOCs

- Posted in Threat Analyze by
Background: It’s no secret that international law enforcement agencies periodically seize domains linked to cyber threats, criminal activities, and other harmful purposes. Every cybersecurity [...] Read more

Weaponizing Trust: The Fight Against Signed Malicious Code

- Posted in Other by
Background: During the MITRE ATT&CK Initial Access stage (T1199), attackers often impersonate trusted sources to gain a foothold in the target environment. By originating their activities from [...] Read more

Scalable Snapshot Management in the Cloud for Windows and Linux Systems: Best Practices for Data Security and Forensics

- Posted in Incident Response by
Background: During a cybersecurity incident in the cloud, one of the mandatory steps is to take a snapshot of the machine that contains the threat, isolate it, and preserve the snapshot or filesystem [...] Read more

Technical Detection of Typo-Squatted Campaigns: A Case Study on Roblox Game Account Hijacking

- Posted in Threat Analyze by
Background: A few days ago, UNIT42 reported tracking an active phishing campaign targeting Roblox game players, which is hugely popular worldwide. In a previous article, I covered the broader threats [...] Read more

From Interviews to Infections: The Dangerous Trend of Cybercriminals in Job Recruitment

- Posted in Threat Analyze by
Background: Over the years, the tactics, techniques, and procedures (TTPs) of attackers have evolved significantly. Recently, APT groups have used new methods that have also been adopted by average [...] Read more