Labs

High

Bypass

Defense Evasion

EDR, Windows

Inside Ghosting AMSI: A Novel, Patchless Method to Bypass Windows Anti-Malware Defenses

The Antimalware Scan Interface (AMSI) is a security feature developed by Microsoft and integrated into Windows 10 and later versions […]

Learn more

Medium

APT, LOLBin

Defense Evasion, Execution

EDR, Sysmon, Windows

Unveiling Earth Alux’s VARGEIT Backdoor: Leveraging Legitimate Debuggers for Cyber Espionage

Recently, the use of legitimate Windows debugging tool to load malicious code into memory has been observed. The APT Earth […]

Learn more

High

APT, Campaign, LOLBin

Defense Evasion

EDR, Sysmon, Windows

Massive Reach, Agile Tactics: Inside LuminousMoth’s Southeast Asia Cyber Spree

LuminousMoth, an advanced persistent threat (APT) group linked to the HoneyMyte (Mustang Panda) cluster, has distinguished itself through large-scale, targeted […]

Learn more

High

APT, Campaign, Malware

Defense Evasion

EDR, Sysmon, Windows

The Dark Side of Windows Sandbox: A New Frontier for Stealthy Threats

MirrorFace, a Chinese advanced persistent threat (APT) under the APT10 umbrella, was observed to conceal malicious activities by exploiting the […]

Learn more

High

APT, Malware

Defense Evasion, Execution

EDR, Sysmon, Windows

Stately Taurus Abuses KeyScramble to Stealthily Exfiltrate Data from Asian Governments

Stately Taurus, a Chinese advanced persistent threat (APT) group also known as Mustang Panda, has demonstrated sophisticated cyberespionage techniques targeting […]

Learn more

High

APT, LOLBin

Defense Evasion, Execution

EDR, Sysmon, Windows

Tracking DarkPink’s Rapid TTP Changes: Staying Ahead in the Intelligence-Driven Defense

The rapid TTP evolution underscores a cyclical "cat and mouse" dynamic, where defenders must adopt proactive, intelligence-driven strategies to mitigate […]

Learn more

High

CVE

Lateral Movement

Linux

CVE-2024-12084: Critical Rsync Heap Buffer Overflow Opens Door to Remote Code Execution

Buffer overflows, including heap buffer overflows, pose significant security risks by allowing unauthorized code execution. Notably, CVE-2024-12084 in Rsync exploits […]

Learn more

High

APT, LOLBin, Malware

Defense Evasion, Execution

EDR, Sysmon, Windows

Mustang Panda Espionage Campaign Reveals Rare ‘Hex Staging’ Technique to Evade Detection

A recent espionage campaign, classified as CL-STA-0048 and allegedly linked to the Chinese state-sponsored cyber-espionage group Mustang Panda, highlights a […]

Learn more

High

Campaign, CyberCrime, Malware

Persistence

EDR

Inside the Latest Italian xWorm Campaign: Enhanced Persistence to Confuse DFIR Investigations

During a malware campaign that hit the Italian territory last month a new version of the xWorm malware has been […]

Learn more

High

Malware

Discovery

EDR, Sysmon, Windows

Active Directory Enumeration Evolved: Exploring SOAPHound’s Exploitation of ADWS

Domain enumeration represents a critical initial phase of reconnaissance for malicious actors. An innovative approach designed to bypass traditional LDAP […]

Learn more