Behind the scenes: The making of a Global Threat Report
The first Elastic Global Threat Report was published earlier this week. In it, you will learn about trends observed by our threat researchers, our predictions…
Category: ThreatIntelligence-IncidentResponse
Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM
Acknowledgements: Special thanks to Adam Mooney and Jamie Dumas for their contributions to this investigation. Huntress analysts recently observed two incidents where a newer ransomware…
Fighting AI Slop in Production Codebases: How Huntress Improved Fable 5.1’s API Recall
TL;DR: When Huntress tested Anthropic’s Claude Fable 5.1 in evaluations, we started with a ~48% accuracy baseline for API recall: significantly more than previous models…
2022 Elastic Global Threat Report: Helping security leaders navigate today’s threat landscape
As the threat landscape continues to evolve, cybersecurity stakes are growing exponentially higher for today’s organizations. Between Log4j, geopolitical tension, and increasing ransomware threats, security…
2022 Elastic Global Threat Report Announcement
Reports Discover our latest findings & strategic recommendations to better stay informed of potential directions threat actors may focus on. Today Elastic Security Labs celebrates…
The Tale of Two INC Ransom Notes: A Ransomware Timeline
Acknowledgements: A special “thank you” goes to Michael Tigges for his extraordinary contributions in unraveling this incident. Background In August, Huntress onboarded an organization post-incident,…
EMOTET Dynamic Configuration Extraction | Elastic Security Labs
Key takeaways li]:list-disc”> EMOTET encryption mechanisms Reviewing the EMOTET C2 list Interesting EMOTET strings The EMOTET configuration extractor utility Encryption keys EMOTET uses embedded Elliptic…
BPFDoor Configuration Extractor | Elastic Security Labs
Configuration extractor to dump out hardcoded passwords with BPFDoor. Download bpfdoor-config-extractor.tar.gz Overview This tool provides a Python module and command line tool that will extract…
QBOT Configuration Extractor | Elastic Security Labs
Python script to extract the configuration from QBOT samples. Download qbot-config-extractor.tar.gz Getting Started This tool provides a Python module and command line tool that will…
ICEDID Configuration Extractor | Elastic Security Labs
Python script to extract the payload from ICEDID samples. Download icedid-configuration-extractor.tar.gz For information on the ICEDID malware and network infrastructure, check out the following resources:…
PARALLAX Payload Extractor | Elastic Security Labs
Python script to extract the payload from PARALLAX samples. Download parallax-payload-extractor.tar.gz For information on the PARALLAX malware loader and campaign observations, check out our blog…
Operation Bleeding Bear
Key Takeaways li]:list-disc”> Writing and executing a VBS script that uses PowerShell to add a Windows Defender exclusion on the root directory (C:) Writing and…