Found 5 bookmarks
Custom sorting
FIN7: The Truth Doesn't Need to be so STARK
FIN7: The Truth Doesn't Need to be so STARK
First and foremost, our thanks go to the threat research team at Silent Push and the security team at Stark Industries Solutions (referred to as “Stark” from this point forwards) for their enthusiastic cooperation in the ‘behind the scenes’ efforts of this blog post.IntroductionIn our opening statement, we also introduce the subject of this post: the cross-team and cross-organization collaborative efforts of Silent Push, Stark, and Team Cymru in taking action against a common and well-known adve
#team-cymru#EN#2024#FIN7#Stark-Industries-Solutions#STARK#PostLtd#SmartApe#investigation
·team-cymru.com·
FIN7: The Truth Doesn't Need to be so STARK
Visualizing QakBot Infrastructure
Visualizing QakBot Infrastructure
This blog post seeks to draw out some high-level trends and anomalies based on our ongoing tracking of QakBot command and control (C2) infrastructure. By looking at the data with a broader scope, we hope to supplement other research into this particular threat family, which in general focuses on specific infrastructure elements; e.g., daily alerting on active C2 servers.
#team-cymru#EN#2023#QakBot#Infrastructure#research#C2
·team-cymru.com·
Visualizing QakBot Infrastructure
Darth Vidar: The Dark Side of Evolving Threat Infrastructure
Darth Vidar: The Dark Side of Evolving Threat Infrastructure
Summary Three key takeaways from our analysis of Vidar infrastructure: Russian VPN gateways are potentially providing anonymity for Vidar operators / customers, making it more challenging for analysts to have a complete overview of this threat. These gateways now appear to be migrating to Tor. Vidar operators appear to be expanding their infrastructure, so analysts need to keep them in their sights. We expect a new wave of customers and as a result, an increase of campaigns in the upcoming weeks
#team-cymru#EN#2023#Vidar#infostealer#analysis#threat#infrastructure#VPN
·team-cymru.com·
Darth Vidar: The Dark Side of Evolving Threat Infrastructure
Darth Vidar: The Dark Side of Evolving Threat Infrastructure
Darth Vidar: The Dark Side of Evolving Threat Infrastructure
Summary Three key takeaways from our analysis of Vidar infrastructure: Russian VPN gateways are potentially providing anonymity for Vidar operators / customers, making it more challenging for analysts to have a complete overview of this threat. These gateways now appear to be migrating to Tor. Vidar operators appear to be expanding their infrastructure, so analysts need to keep them in their sights. We expect a new wave of customers and as a result, an increase of campaigns in the upcoming weeks
#team-cymru#EN#2023#Vidar#infostealer#analysis#threat#infrastructure#VPN
·team-cymru.com·
Darth Vidar: The Dark Side of Evolving Threat Infrastructure