Empresa > Blog

Noticias y puntos de vista de la voz líder en transformación digital segura

Blogs escritos por este autor

Foto de perfil del usuario Brett Stone-Gross

Brett Stone-Gross

Director of Threat Intelligence
Pikabot reverse engineering
Investigación de Threatlabz
9 Min de lectura

Technical Analysis of Pikabot

Key Points Pikabot is a new malware trojan that emerged in early 2023 that consists of two components: a loader and a core module. The core module implements the malicious functionality that includes the ability ...
Ransomware
Ransomware
10 Min de lectura

Technical Analysis of CryptNet Ransomware

Key Points CryptNet is a new ransomware-as-a-service that has been advertised in underground forums since at least April 2023 The CryptNet threat group claims to perform double extortion attacks by combining...
Smash PostScript Interpreters Using a Syntax-Aware Fuzzer
Investigación de Threatlabz
9 Min de lectura

Smash PostScript Interpreters Using A Syntax-Aware Fuzzer

In 2022, Zscaler’s ThreatLabz performed vulnerability hunting for some of the most popular PostScript interpreters using a custom-built syntax-aware fuzzer. The PostScript interpreters that were evaluated include Adobe A...
Trigona ransomware
Ransomware
14 Min de lectura

Technical Analysis of Trigona Ransomware

Key Points Trigona is a ransomware family written in the Delphi programming language that has been active since at least June 2022 The Trigona threat group claims to perform double extortion attacks by combining ...
Nevada ransomware
Ransomware
6 Min de lectura

Nevada Ransomware: Yet Another Nokoyawa Variant

Key Points Nevada ransomware was advertised in criminal forums in December 2022 as part of a new ransomware-as-a-service affiliate program Nevada is written in the Rust programming language with support for Linu...
Ransomware hacker
Ransomware
5 Min de lectura

Nokoyawa Ransomware: Rust or Bust

Key Points Nokoyawa is a 64-bit Windows-based ransomware family that emerged in February 2022 The threat group behind Nokoyawa performs double extortion ransomware attacks: exfiltrating sensitive information from...
BlackBasta Hacker
Ransomware
7 Min de lectura

Back in Black... Basta

Key Points BlackBasta emerged in February 2022 with double extortion ransomware attacks against organizations The threat group exfiltrates sensitive information from organizations before performing file encryptio...
Technical Analysis of Windows CLFS Zero-Day Vulnerability CVE-2022-37969 - Part 2: Exploit Analysis
Información de seguridad
19 Min de lectura

Technical Analysis of Windows CLFS Zero-Day Vulnerability CVE-2022-37969 - Part 2: Exploit Analysis

In Part 1 of this blog series, we analyzed the root cause for CVE-2022-37969. In this blog, we will present an in-the-wild exploit that was discovered by Zscaler ThreatLabz that successfully leveraged CVE-2022-37969 for ...
Windows Common Log File System Driver Privilege Escalation Zero-Day Vulnerability CVE-2022-37969
Información de seguridad
19 Min de lectura

Technical Analysis of Windows CLFS Zero-Day Vulnerability CVE-2022-37969 - Part 1: Root Cause Analysis

On September 2, 2022, Zscaler Threatlabz captured an in-the-wild 0-day exploit in the Windows Common Log File System Driver (CLFS.sys) and reported this discovery to Microsoft. In the September Tuesday patch, Microsoft f...
Malware
Información de seguridad
9 Min de lectura

The Ares Banking Trojan Learns Old Tricks: Adds the Defunct Qakbot DGA

Summary: ThreatLabz observed an update to the Ares banking trojan that introduces a domain generation algorithm (DGA), which mirrors the Qakbot DGA. Based on analyzing the malware code, there does not appear to be a dire...
Analysis of Adobe Acrobat Reader Javascript Doc.print() Use-After-Free Vulnerability (CVE-2022-34233)
Información de seguridad
3 Min de lectura

Analysis of Adobe Acrobat Reader Javascript Doc.print() Use-After-Free Vulnerability (CVE-2022-34233)

In July 2022, Adobe released a security update for vulnerabilities in Adobe Acrobat and Reader. The update fixed a vulnerability that is identified as CVE-2022-34233 discovered by the Zscaler ThreatLabz research team. In...
Informe sobre el estado del ransomware de ThreatLabz 2022
Ransomware
6 Min de lectura

Informe sobre el estado del ransomware de ThreatLabz 2022

Los ataques de ransomware aumentaron otro 80 % entre febrero de 2021 y marzo de 2022, según un análisis de las cargas útiles de ransomware vistas en la nube de Zscaler. Los ataques de doble extorsión, que incluyen la exf...
cover image
Información de seguridad
11 Min de lectura

Vidar distributed through backdoored Windows 11 downloads and abusing Telegram

Summary In April 2022, ThreatLabz discovered several newly registered domains, which were created by a threat actor to spoof the official Microsoft Windows 11 OS download portal. We discovered these domains by monitor...
Cyber honeycomb containing locks.
Información de seguridad
7 Min de lectura

Peeking into PrivateLoader

Key Points PrivateLoader is a downloader malware family that was first identified in early 2021 The loader’s primary purpose is to download and execute additional malware as part of a pay-per-install (PPI) malwar...
Zscaler ThreatLabz Discovers Multiple Product Bugs in Adobe Acrobat
Información de seguridad
3 Min de lectura

Zscaler ThreatLabz Discovers Multiple Product Bugs in Adobe Acrobat

In April 2022, Adobe released security update APSB22-16. This update fixed five product bugs that Zscaler’s ThreatLabz reported in Adobe Acrobat that are related to EMF (Enhanced Metafile Format) parsing. Adobe determine...
Ransomware
Información de seguridad
8 Min de lectura

Conti Ransomware Attacks Persist With an Updated Version Despite Leaks

In late January 2022, ThreatLabz identified an updated version of Conti ransomware as part of the global ransomware tracking efforts. This update was released prior to the massive leak of Conti source code and chat logs ...
CVE-2021-44708
Información de seguridad
10 Min de lectura

Analysis of Adobe Acrobat Pro DC Solid Framework Heap-based Buffer Overflow Vulnerability (CVE-2021-44708)

In January 2022, Adobe released a security update for vulnerabilities in Adobe Acrobat and Reader. The update fixed five vulnerabilities (CVE-2021-44703, CVE-2021-44708, CVE-2021-44709, CVE-2021-44740, and CVE-2021-44741...
Cyber honeycomb containing locks.
Información de seguridad
4 Min de lectura

DanaBot Launches DDoS Attack Against the Ukrainian Ministry of Defense

March 7, 2022 Update DanaBot affiliate ID 5 has stopped DDoSing the Ukrainian Ministry of Defense’s webmail server and started DDoSing a hardcoded IP address, 138.68.177[.]158. According to Passive DNS data, this...
Ransomware hacker
Ransomware
4 Min de lectura

Technical Analysis of PartyTicket Ransomware

Key Points PartyTicket is an unsophisticated and poorly designed ransomware family that is likely intended to be a diversion from the Hermetic wiper attack The ransomware generates a single AES key that is used t...
Ukraine targeted attacks
Información de seguridad
11 Min de lectura

HermeticWiper & resurgence of targeted attacks on Ukraine

Summary Since Jan 2022, ThreatLabz has observed a resurgence in targeted attack activity against Ukraine. We identified two attack-chains in the timeframe - Jan to Feb 2022, which we attribute to the same threat actor...
Analysis of Adobe Acrobat Pro DC Solid Framework Out-of-Bounds Read Vulnerability (CVE-2021-40729)
Información de seguridad
11 Min de lectura

Analysis of Adobe Acrobat Pro DC Solid Framework Out-of-Bounds Read Vulnerability (CVE-2021-40729)

Summary In October 2021, Adobe released a security update for vulnerabilities in Adobe Acrobat and Reader. Among these vulnerabilities is an out-of-bounds read (CVE-2021-40729) that was discovered by Zscaler’s ThreatL...
Cyber security
Información de seguridad
11 Min de lectura

Squirrelwaffle: New Loader Delivering Cobalt Strike

Zscaler ThreatLabz has been following an emerging new malware loader known as Squirrelwaffle that is being used to deliver Cobalt Strike. In this blog, we will be analyzing the complete attack chain for this new malware ...
Ransomware hacker
Ransomware
3 Min de lectura

DoppelPaymer Continues to Cause Grief Through Rebranding

In early May 2021, DoppelPaymer ransomware activity dropped significantly. Although the DoppelPaymer leak site still remains online, there has not been a new victim post since May 6, 2021. In addition, no victim posts ha...
Kaseya Supply Chain Ransomware Attack - Technical Analysis of the REvil Payload
Información de seguridad
8 Min de lectura

Kaseya Supply Chain Ransomware Attack - Technical Analysis of the REvil Payload

On July 2, 2021, Kaseya, an IT Management software firm, disclosed a security incident impacting their on-premises version of Kaseya's Virtual System Administrator (VSA) software. Kaseya VSA is a cloud-based Managed Serv...
Ares malware
Información de seguridad
17 Min de lectura

Ares Malware: The Grandson of the Kronos Banking Trojan

Kronos is a banking trojan that first emerged in 2014 and marketed in underground forums as a crimeware kit to conduct credit card, identity theft, and wire fraud. In September 2018, a new Kronos variant named Osiris int...
Botnets
Información de seguridad
32 Min de lectura

DreamBus Botnet – Technical Analysis

Zscaler’s ThreatLabZ research team recently analyzed a Linux-based malware family that we have dubbed the DreamBus Botnet. The malware is a variant of SystemdMiner, which consists of a series of Executable and Linkable F...

Otros artículos

Explore más temas