Research & Intelligence

Unsecured Elasticsearch Data Replaced with Ransom Note Security controls such as MFA can limit access to internet-facing databases. Security controls such as MFA can limit access to internet-facing databases.

COBALT MIRAGE Conducts Ransomware Operations in U.S. The Iranian threat group blurs the line between financially motivated attacks and espionage. Learn how the Iranian threat group blurs the line between…

REvil Development Adds Confidence About GOLD SOUTHFIELD Reemergence Updated samples indicate access to original source code and active development, signaling that GOLD SOUTHFIELD has resumed operations. Updated samples indicate access…

BRONZE PRESIDENT Targets Russian Speakers with Updated PlugX The threat group’s targeting shift could reflect a change in China’s intelligence collection requirements due to the war in Ukraine. : The…

GOLD ULRICK Continues Conti Operations Despite Public Disclosures Leaks of GOLD ULRICK communications and operational details have not hampered ransomware activity. Leaks of GOLD ULRICK communications and operational details have…

GOLD ULRICK Leaks Reveal Organizational Structure and Relationships Messages reveal collaboration and support among threat groups. Messages reveal collaboration and support among threat groups.

Type: Blogs Excel Add-ins Deliver JSSLoader Malware The GOLD NIAGARA threat group has expanded its tactics for delivering the JSSLoader RAT, spoofing legitimate Microsoft Excel add-ins to infect systems. Learn…

Type: Blogs Domains Linked to Phishing Attacks Targeting Ukraine Analysis of domains listed in a CERT-UA warning revealed additional domains linked to phishing attacks targeting Ukrainian government and military personnel…

Type: Blogs Secureworks FAQ: Russian Activity in Ukraine, Part 2 Learn how prior to the military incursion, there were ongoing distributed denial-of-service (DDOS), website defacement, and malware wiper attacks targeting…

Type: Blogs Disruptive HermeticWiper Attacks Targeting Ukrainian Organizations Prior to the Russian military invasion, Ukrainian government and financial organizations were impacted by distributed denial of service and wiper attacks. Learn…