NAPLISTENER: more bad dreams from developers of SIESTAGRAPH
Introduction While continuing to monitor the REF2924 activity group, Elastic Security Labs observed that the attacker shifted priorities from data theft to persistent access using…
Category: ThreatIntelligence-IncidentResponse
Autonomous Remediation and What Finally Makes It Safe
Executive Summary Vulnerability exploitation now happens at a speed that manual, ticket-based remediation can’t match. Qualys’s Enterprise TruRisk Management Platform closes that gap with autonomous…
Revisiting BLISTER: New development of the BLISTER loader
Preamble In a fast-paced and ever-changing world of cybercrime threats, the tenacity and adaptability of malicious actors is a significant concern. BLISTER, a malware loader…
Automate Asset Isolation to Meet Remediation Deadlines
Executive Summary Remediation deadlines slip for reasons outside your control: a patch does not exist yet, a patch is delayed, or a remediation attempt fails.…
Before You Patch. Why Patch Reliability Matters for Confident Deployment
Executive Summary Microsoft’s September 2026 security updates, KB5124008 and KB5124012, have been linked to USB audio failures on some Windows systems, highlighting the operational risk that can…
Inside Microsoft’s plan to kill PPLFault
On September 1, 2023, Microsoft released a new build of Windows Insider Canary, version 25941. Insider builds are pre-release versions of Windows that include experimental…
Accelerating Elastic detection tradecraft with LLMs
In line with our Openness Initiative, we remain committed to transparency and want to share how our internal AI R&D efforts have increased the productivity…
Dancing the night away with named pipes
Introduction This year at VB2023, a globally renowned malware conference, Daniel Stepanic of the Elastic Security Labs team presented new insights into PIPEDANCE – a…
Disclosing the BLOODALCHEMY backdoor
Preamble BLOODALCHEMY is an x86 backdoor written in C and found as shellcode injected into a signed benign process. It was discovered in our analysis…
Fall 2023 Global Threat Report Outro
After months of diligent work, Elastic Security Labs is excited to announce the publication of the October 2023 Global Threat Report. For our second annual…
Getting gooey with GULOADER: deobfuscating the downloader
Overview Elastic Security Labs continues to monitor active threats such as GULOADER, also known as CloudEyE – an evasive shellcode downloader that has been highly…
Operational Resilience: IT Security Risks with Reduced Staffing
Holiday periods are something every organisation has to deal with. Whether it’s the summer holidays or another period where large numbers of people are taking…