Not sleeping anymore: SOMNIRECORD’s wake-up call
Introduction While monitoring the REF2924 activity group, Elastic Security Labs researchers identified a new malware family written in C++ that we refer to as SOMNIRECORD.…
Category: ThreatIntelligence-IncidentResponse
REF2924: how to maintain persistence as an (advanced?) threat
Preamble In recent months, there has been a noticeable shift in the nature of the incidents being tracked under REF2924. Initially, the attacker employed custom,…
Attack chain leads to XWORM and AGENTTESLA
Key Takeaways li]:list-disc”> C:WindowsMicrosoft.NETFrameworkv4.0.30319RegSvcs.exe C:WindowsMicrosoft.NETFrameworkv2.0.50727RegSvcs.exe C:WindowsMicrosoft.NETFrameworkv3.5Msbuild.exe These binaries are signed and trusted by the system and can evade detection by security software that relies on…
Elastic publishes 2023 Global Threat Report Spring Edition
Last November, Elastic published our inaugural global threat report: a summary of threat trends, forecasts, and recommendations based on analyzing millions of telemetry events shared…
Elastic users protected from SUDDENICON’s supply chain attack
Key takeaways li]:list-disc”> akamaicontainer[.]com akamaitechcloudservices[.]com azuredeploystore[.]com azureonlinecloud[.]com azureonlinestorage[.]com dunamistrd[.]com glcloudservice[.]com journalide[.]org msedgepackageinfo[.]com msstorageazure[.]com msstorageboxes[.]com officeaddons[.]com officestoragebox[.]com pbxcloudeservices[.]com pbxphonenetwork[.]com pbxsources[.]com qwepoi123098[.]com sbmsa[.]wiki sourceslabs[.]com visualstudiofactory[.]com zacharryblogs[.]com Potentially…
Now available: The LLM safety assessment
Reports Check out the newest report from Elastic Security Labs, which explores how you can protect your organization from LLM threats. Today Elastic Security Labs…
Upping the Ante: Detecting In-Memory Threats with Kernel Call Stacks
Intro Elastic Security for endpoint, with its roots in Endgame, has long led the industry for in-memory threat detection. We pioneered and patented many detection…
Into The Weeds: How We Run Detonate
Preamble In our first post in our Detonate series, we introduced the Detonate system and what we use it for at Elastic. We also discussed…
Initial research exposing JOKERSPY
Key takeaways li]:list-disc”> How Elastic Security Labs identified reconnaissance from the adversary group The adversary’s steps to evade detection using xcc , installing the sh.py…
Centralized alert triage: one SOC, 100 linked projects
Run security operations for more than one team, region, or customer, and you inherit a familiar tradeoff. One giant deployment gives you a single view…
Oracle September 2026 Critical Security Patch Update
Oracle addresses 672 CVEs in its September 2026 Critical Security Patch Update with 673 patches, including 104 critical updates. Key Takeaways The September 2026 Critical…
The End of Point-in-Time Compliance | Continuous Audit
Key Takeaways Periodic audits provide a point-in-time assessment, but they cannot demonstrate whether controls remain effective between audit cycles. Qualys platform data shows 10.5 billion…