Dancing the night away with named pipes
Introduction This year at VB2023, a globally renowned malware conference, Daniel Stepanic of the Elastic Security Labs team presented new insights into PIPEDANCE – a…
Category: ThreatIntelligence-IncidentResponse
Disclosing the BLOODALCHEMY backdoor
Preamble BLOODALCHEMY is an x86 backdoor written in C and found as shellcode injected into a signed benign process. It was discovered in our analysis…
Fall 2023 Global Threat Report Outro
After months of diligent work, Elastic Security Labs is excited to announce the publication of the October 2023 Global Threat Report. For our second annual…
Getting gooey with GULOADER: deobfuscating the downloader
Overview Elastic Security Labs continues to monitor active threats such as GULOADER, also known as CloudEyE – an evasive shellcode downloader that has been highly…
Operational Resilience: IT Security Risks with Reduced Staffing
Holiday periods are something every organisation has to deal with. Whether it’s the summer holidays or another period where large numbers of people are taking…
Doubling Down: Detecting In-Memory Threats with Kernel ETW Call Stacks
Introduction We were pleased to see that the kernel call stack capability we released in 8.8 was met with extremely positive community feedback – both…
Sinking macOS Pirate Ships with Elastic Behavior Detections
Preamble On January 12, 2024, Malwrhunterteam, an X account that surfaces interesting malware samples, usually found via VirusTotal, released a Tweet about a pirated macOS…
Unlocking Power Safely: Privilege Escalation via Linux Process Capabilities
Preamble In the realm of Linux security, administrators constantly grapple with a delicate balance between safeguarding sensitive system resources and accessibility. One helpful avenue that…
500ms to midnight: XZ A.K.A. liblzma backdoor
Key Takeaways li]:list-disc”> Stage 0: The initial malicious code additions attempt to decode the Stage 1 script (hidden code segments) by changing byte values from…
Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part One
In the first article in this multipart series, malware researchers on the Elastic Security Labs team give a short introduction about the REMCOS threat and…
Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Two
In the previous article in this series on the REMCOS implant, we shared information about execution, persistence, and defense evasion mechanisms. Continuing this series we’ll…
Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Three
In previous articles in this multipart series, malware researchers on the Elastic Security Labs team analyzed REMCOS execution flow, detailing its recording capabilities and its…