In previous articles in this multipart series [1] [2] [3], malware researchers on the Elastic Security Labs team decomposed the REMCOS configuration structure and gave…
Overview After Microsoft disabled office macros by default for internet-sourced documents, other infection vectors like JavaScript, MSI files, LNK objects, and ISOs have surged in…
Introduction Reputation-based protections like Elastic’s reputation service can significantly improve detection capabilities while maintaining low false positive rates. However, like any protection capability, weaknesses exist…
Preamble In August 2024, a novel macOS malware named “BANSHEE Stealer” emerged, catching the attention of the cybersecurity community. Reportedly developed by Russian threat actors,…
Reports Elastic Security Labs has released the 2024 Elastic Global Threat Report, surfacing the most pressing threats, trends, and recommendations to help keep organizations safe…
Update This research covers an update to stage 2 of GHOSTPULSE, originally disclosed by Elastic Security Labs in October 2023. Key takeaways
Introduction We’re excited to introduce a new chapter in our security bounty program on HackerOne that we soft launched in December 2024. Elastic is now…
We’ve been working hard at Elastic Security Labs! We’ve just published a brand new report: the 2025 State of Detection Engineering at Elastic. This report…
Background The Huntress Security Operations Center (SOC) recently came across two interesting variants of the same attack involving a browser-in-the-browser (BiTB) phishing technique. BiTB is…
Acknowledgments: Special thanks to Jon Semon, Andrew Brant, and Lindsey O’Donnell-Welch for their contributions to this investigation and writeup. Background There’s still three months until…
We’re thrilled to share that Elastic Security achieved a score of 100% in the recent AV-Comparatives Business Security Test. Why the AV-Comparatives Business Security Test…
In a threat landscape defined by sophisticated, multistage attacks, enterprises demand endpoint security solutions that not only detect threats but also actively prevent them and…
