Finding Truth in the Shadows
Microsoft has begun rolling out user-mode Hardware Stack Protection (HSP) starting in Windows 10 20H1. HSP is an exploit mitigation technology that prevents corruption of…
Category: ThreatIntelligence-IncidentResponse
CUBA Ransomware Malware Analysis
Summary As a part of Elastic Security’s ongoing threat detection and monitoring efforts, we have recently observed a ransomware intrusion by the CUBA ransomware threat…
Sandboxing Antimalware Products for Fun and Profit
This article demonstrates a flaw that allows attackers to bypass a Windows security mechanism which protects anti-malware products from various forms of attack. This is…
PHOREAL Malware Targets the Southeast Asian Financial Sector
Preamble Elastic Security has identified an ongoing campaign targeting a Vietnamese financial services institution with the PHOREAL/RIZZO backdoor. While this malware has been in use…
Thawing the permafrost of ICEDID Summary
ICEDID is a malware family first described in 2017 by IBM X-force researchers and is associated with the theft of login credentials, banking information, and…
Not sleeping anymore: SOMNIRECORD’s wake-up call
Introduction While monitoring the REF2924 activity group, Elastic Security Labs researchers identified a new malware family written in C++ that we refer to as SOMNIRECORD.…
REF2924: how to maintain persistence as an (advanced?) threat
Preamble In recent months, there has been a noticeable shift in the nature of the incidents being tracked under REF2924. Initially, the attacker employed custom,…
Attack chain leads to XWORM and AGENTTESLA
Key Takeaways li]:list-disc”> C:WindowsMicrosoft.NETFrameworkv4.0.30319RegSvcs.exe C:WindowsMicrosoft.NETFrameworkv2.0.50727RegSvcs.exe C:WindowsMicrosoft.NETFrameworkv3.5Msbuild.exe These binaries are signed and trusted by the system and can evade detection by security software that relies on…
Elastic publishes 2023 Global Threat Report Spring Edition
Last November, Elastic published our inaugural global threat report: a summary of threat trends, forecasts, and recommendations based on analyzing millions of telemetry events shared…
Elastic users protected from SUDDENICON’s supply chain attack
Key takeaways li]:list-disc”> akamaicontainer[.]com akamaitechcloudservices[.]com azuredeploystore[.]com azureonlinecloud[.]com azureonlinestorage[.]com dunamistrd[.]com glcloudservice[.]com journalide[.]org msedgepackageinfo[.]com msstorageazure[.]com msstorageboxes[.]com officeaddons[.]com officestoragebox[.]com pbxcloudeservices[.]com pbxphonenetwork[.]com pbxsources[.]com qwepoi123098[.]com sbmsa[.]wiki sourceslabs[.]com visualstudiofactory[.]com zacharryblogs[.]com Potentially…
Now available: The LLM safety assessment
Reports Check out the newest report from Elastic Security Labs, which explores how you can protect your organization from LLM threats. Today Elastic Security Labs…
Upping the Ante: Detecting In-Memory Threats with Kernel Call Stacks
Intro Elastic Security for endpoint, with its roots in Endgame, has long led the industry for in-memory threat detection. We pioneered and patented many detection…