FlipSwitch: a Novel Syscall Hooking Technique
FlipSwitch: a Novel Syscall Hooking Technique Syscall hooking, particularly by overwriting pointers to syscall handlers, has been a cornerstone of Linux rootkits like Diamorphine and…
Category: ThreatIntelligence-IncidentResponse
WARMCOOKIE One Year Later: New Features and Fresh Insights
Revisiting WARMCOOKIE Elastic Security Labs continues to track developments in the WARMCOOKIE codebase, uncovering new infrastructure tied to the backdoor. Since our original post, we…
What the 2025 Elastic Global Threat Report reveals about the evolving threat landscape
For the fourth consecutive year, Elastic Security Labs presents its 2025 Global Threat Report, distilling real-world user telemetry to offer critical insights into the evolving…
From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect
Introduction Elastic Security Labs is observing malicious campaigns delivering a multi-stage infection involving a previously undocumented loader. The infection begins when users are diverted to…
How we caught the Axios supply chain attack
Preamble Last Monday night I was working late and a Slack alert came in from a monitoring tool I had built three days earlier. Axios…
Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild
Introduction Recent Linux kernel privilege escalation vulnerabilities, Copy Fail (CVE-2026-31431) , Copy Fail 2, and DirtyFrag, highlight how subtle page cache corruption bugs can become…
Daisy-Chaining Trust: Investigating Faronics Deploy Abuse
Acknowledgments: Special thanks to Ben Nahorney and Aaron Deal for their contributions to this investigation and writeup. Background Huntress has identified a surge in phishing…
Hackers Frequently Target Healthcare and Finance Orgs
When a ransomware attack hits a hospital or bank, it’s not just company data or customer emails that are vulnerable. These organizations have access to…
Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
On August 4, 2026, Elastic Security Labs identified a new Shai-Hulud campaign targeting the maintainer of keyv, a widely used key-value storage library. The attackers…
Tenable + OpenAI CyberAgents Exchange AI Inspector
Open-source registries for AI agents are only effective when they include a rigorous, transparent security review process for community submissions. That’s why for its new…
Shadow AI in Financial Services | Risk & Governance
Shadow AI is already taking root across financial services and many firms are discovering it only after the fact. Employees are turning to AI tools…
BPFDoor Scanner | Elastic Security Labs
Python script to identify hosts infected with the BPFDoor malware. Download bpfdoor-scanner.tar.gz Getting Started This tool provides a Python script to identify hosts that are…