Internet Storm Center
Sign In
Sign Up
Handler on Duty:
Johannes Ullrich
Threat Level:
green
Date
Author
Title
GREETING CARDS PHISH MALWARE
2009-12-16
Rob VandenBrink
Beware the Attack of the Christmas Greeting Cards !
GREETING
2011-12-25/a>
Deborah Hale
Merry Christmas, Happy Holidays
2009-12-16/a>
Rob VandenBrink
Beware the Attack of the Christmas Greeting Cards !
2008-06-01/a>
Mark Hofman
Free Yahoo email account! Sign me up, Ok well maybe not.
CARDS
2014-11-24/a>
Richard Porter
Someone is using this? PoS: Compressor
2014-07-03/a>
Johannes Ullrich
Credit Card Processing in 700 Words or Less
2009-12-16/a>
Rob VandenBrink
Beware the Attack of the Christmas Greeting Cards !
2009-07-28/a>
Adrien de Beaupre
YYAMCCBA
2008-06-01/a>
Mark Hofman
Free Yahoo email account! Sign me up, Ok well maybe not.
PHISH
2024-12-05/a>
Jesse La Grew
[Guest Diary] Business Email Compromise
2024-10-14/a>
Xavier Mertens
Phishing Page Delivered Through a Blob URL
2024-07-16/a>
Jan Kopriva
"Reply-chain phishing" with a twist
2024-03-14/a>
Jan Kopriva
Increase in the number of phishing messages pointing to IPFS and to R2 buckets
2024-02-21/a>
Jan Kopriva
Phishing pages hosted on archive.org
2023-11-17/a>
Jan Kopriva
Phishing page with trivial anti-analysis features
2023-11-08/a>
Xavier Mertens
Example of Phishing Campaign Project File
2023-10-29/a>
Guy Bruneau
Spam or Phishing? Looking for Credentials & Passwords
2023-10-16/a>
Jan Kopriva
Are typos still relevant as an indicator of phishing?
2023-09-26/a>
Jan Kopriva
A new spin on the ZeroFont phishing technique
2023-09-03/a>
Didier Stevens
Analysis of a Defective Phishing PDF
2023-08-31/a>
Jan Kopriva
The low, low cost of (committing) cybercrime
2023-08-18/a>
Xavier Mertens
From a Zalando Phishing to a RAT
2023-06-21/a>
Yee Ching Tok
Analyzing a YouTube Sponsorship Phishing Mail and Malware Targeting Content Creators
2023-06-16/a>
Xavier Mertens
Another RAT Delivered Through VBS
2023-05-20/a>
Xavier Mertens
Phishing Kit Collecting Victim's IP Address
2023-05-15/a>
Jan Kopriva
Ongoing Facebook phishing campaign without a sender and (almost) without links
2023-05-01/a>
Jan Kopriva
"Passive" analysis of a phishing attachment
2023-04-26/a>
Yee Ching Tok
Strolling through Cyberspace and Hunting for Phishing Sites
2023-04-03/a>
Johannes Ullrich
Tax Season Risks
2023-03-31/a>
Jan Kopriva
Use of X-Frame-Options and CSP frame-ancestors security headers on 1 million most popular domains
2023-03-20/a>
Xavier Mertens
From Phishing Kit To Telegram... or Not!
2023-03-15/a>
Jan Kopriva
IPFS phishing and the need for correctly set HTTP security headers
2023-03-12/a>
Guy Bruneau
AsynRAT Trojan - Bill Payment (Pago de la factura)
2023-02-27/a>
Xavier Mertens
Phishing Again and Again
2023-02-21/a>
Xavier Mertens
Phishing Page Branded with Your Corporate Website
2023-02-18/a>
Guy Bruneau
Spear Phishing Handlers for Username/Password
2023-02-16/a>
Jan Kopriva
HTML phishing attachment with browser-in-the-browser technique
2022-11-24/a>
Xavier Mertens
Attackers Keep Phishing Victims Under Stress
2022-11-19/a>
Guy Bruneau
McAfee Fake Antivirus Phishing Campaign is Back!
2022-10-27/a>
Tom Webb
Supersizing your DUO and 365 Integration
2022-10-04/a>
Johannes Ullrich
Credential Harvesting with Telegram API
2022-09-21/a>
Xavier Mertens
Phishing Campaigns Use Free Online Resources
2022-09-10/a>
Guy Bruneau
Phishing Word Documents with Suspicious URL
2022-08-26/a>
Xavier Mertens
Paypal Phishing/Coinbase in One Image
2022-08-13/a>
Guy Bruneau
Phishing HTML Attachment as Voicemail Audio Transcription
2022-07-22/a>
Yee Ching Tok
An Analysis of a Discerning Phishing Website
2022-07-13/a>
Xavier Mertens
Using Referers to Detect Phishing Attacks
2022-06-01/a>
Jan Kopriva
HTML phishing attachments - now with anti-analysis features
2022-05-18/a>
Jan Kopriva
Do you want 30 BTC? Nothing is easier (or cheaper) in this phishing campaign...
2022-05-14/a>
Didier Stevens
Quick Analysis Of Phishing MSG
2022-05-07/a>
Guy Bruneau
Phishing PDF Received in my ISC Mailbox
2022-04-24/a>
Didier Stevens
Analyzing a Phishing Word Document
2022-04-07/a>
Johannes Ullrich
What is BIMI and how is it supposed to help with Phishing.
2022-04-04/a>
Johannes Ullrich
Emptying the Phishtank: Are WordPress sites the Mosquitoes of the Internet?
2022-02-13/a>
Guy Bruneau
DHL Spear Phishing to Capture Username/Password
2022-02-07/a>
Johannes Ullrich
web3 phishing via self-customizing landing pages
2022-01-31/a>
Xavier Mertens
Be careful with RPMSG files
2022-01-28/a>
Xavier Mertens
Malicious ISO Embedded in an HTML Page
2022-01-18/a>
Jan Kopriva
Phishing e-mail with...an advertisement?
2022-01-03/a>
Xavier Mertens
McAfee Phishing Campaign with a Nice Fake Scan
2021-12-23/a>
Xavier Mertens
Nicely Crafted indeed.com Login Page
2021-12-09/a>
Yee Ching Tok
Phishing Direct Messages via Discord
2021-12-04/a>
Guy Bruneau
A Review of Year 2021
2021-11-24/a>
Jan Kopriva
Phishing page hiding itself using dynamically adjusted IP-based allow list
2021-11-10/a>
Xavier Mertens
Shadow IT Makes People More Vulnerable to Phishing
2021-10-31/a>
Didier Stevens
Video: Phishing ZIP With Malformed Filename
2021-10-26/a>
Yee Ching Tok
Hunting for Phishing Sites Masquerading as Outlook Web Access
2021-10-24/a>
Didier Stevens
Phishing ZIP With Malformed Filename
2021-09-16/a>
Jan Kopriva
Phishing 101: why depend on one suspicious message subject when you can use many?
2021-09-02/a>
Xavier Mertens
Attackers Will Always Abuse Major Events in our Lifes
2021-08-03/a>
Johannes Ullrich
Is this the Weirdest Phishing (SMishing?) Attempt Ever?
2021-07-28/a>
Jan Kopriva
A sextortion e-mail from...IT support?!
2021-07-14/a>
Jan Kopriva
One way to fail at malspam - give recipients the wrong password for an encrypted attachment
2021-07-13/a>
Johannes Ullrich
USPS Phishing Using Telegram to Collect Data
2021-06-22/a>
Jan Kopriva
Phishing asking recipients not to report abuse
2021-05-29/a>
Guy Bruneau
Spear-phishing Email Targeting Outlook Mail Clients
2021-05-22/a>
Xavier Mertens
"Serverless" Phishing Campaign
2021-04-19/a>
Jan Kopriva
Hunting phishing websites with favicon hashes
2021-03-11/a>
Johannes Ullrich
Piktochart - Phishing with Infographics
2021-02-26/a>
Guy Bruneau
Pretending to be an Outlook Version Update
2021-02-10/a>
Brad Duncan
Phishing message to the ISC handlers email distro
2020-10-22/a>
Jan Kopriva
BazarLoader phishing lures: plan a Halloween party, get a bonus and be fired in the same afternoon
2020-10-09/a>
Jan Kopriva
Phishing kits as far as the eye can see
2020-10-02/a>
Xavier Mertens
Analysis of a Phishing Kit
2020-09-21/a>
Jan Kopriva
Slightly broken overlay phishing
2020-09-20/a>
Guy Bruneau
Analysis of a Salesforce Phishing Emails
2020-06-18/a>
Jan Kopriva
Broken phishing accidentally exploiting Outlook zero-day
2020-06-15/a>
Rick Wanner
HTML based Phishing Run
2020-05-27/a>
Jan Kopriva
Frankenstein's phishing using Google Cloud Storage
2020-05-02/a>
Guy Bruneau
Phishing PDF with Unusual Hostname
2020-04-28/a>
Jan Kopriva
Agent Tesla delivered by the same phishing campaign for over a year
2020-04-18/a>
Guy Bruneau
Maldoc Falsely Represented as DOCX Invoice Redirecting to Fake Apple Store
2020-04-13/a>
Jan Kopriva
Look at the same phishing campaign 3 months apart
2020-04-03/a>
Xavier Mertens
Obfuscated with a Simple 0x0A
2020-03-14/a>
Didier Stevens
Phishing PDF With Incremental Updates.
2020-03-05/a>
Xavier Mertens
Will You Put Your Password in a Survey?
2020-02-10/a>
Jan Kopriva
Current PayPal phishing campaign or "give me all your personal information"
2020-02-03/a>
Jan Kopriva
Analysis of a triple-encrypted AZORult downloader
2020-01-24/a>
Xavier Mertens
Why Phishing Remains So Popular?
2020-01-16/a>
Jan Kopriva
Picks of 2019 malware - the large, the small and the one full of null bytes
2019-12-06/a>
Jan Kopriva
Phishing with a self-contained credentials-stealing webpage
2019-12-05/a>
Jan Kopriva
E-mail from Agent Tesla
2019-12-04/a>
Jan Kopriva
Analysis of a strangely poetic malware
2019-11-26/a>
Jan Kopriva
Lessons learned from playing a willing phish
2019-10-31/a>
Jan Kopriva
EML attachments in O365 - a recipe for phishing
2019-10-17/a>
Jan Kopriva
Phishing e-mail spoofing SPF-enabled domain
2019-08-15/a>
Didier Stevens
Analysis of a Spearphishing Maldoc
2019-08-09/a>
Xavier Mertens
100% JavaScript Phishing Page
2019-05-13/a>
Xavier Mertens
From Phishing To Ransomware?
2019-04-17/a>
Xavier Mertens
Malware Sample Delivered Through UDF Image
2019-02-28/a>
Tom Webb
Phishing impersonations
2019-02-07/a>
Xavier Mertens
Phishing Kit with JavaScript Keylogger
2019-02-03/a>
Didier Stevens
Video: Analyzing a Simple HTML Phishing Attachment
2019-01-29/a>
Johannes Ullrich
A Not So Well Done Phish (Why Attackers need to Implement IPv6 Now! ;-) )
2019-01-02/a>
Lorna Hutcheson
Gift Card Scams on the rise
2018-12-27/a>
Didier Stevens
Matryoshka Phish
2018-12-21/a>
Lorna Hutcheson
Phishing Attempts That Bypass 2FA
2018-12-13/a>
Xavier Mertens
Phishing Attack Through Non-Delivery Notification
2018-08-23/a>
Xavier Mertens
Simple Phishing Through formcrafts.com
2018-08-12/a>
Didier Stevens
A URL shortener handy for phishers
2018-07-01/a>
Didier Stevens
Video: Analyzing XPS Files
2018-06-30/a>
Didier Stevens
XPS samples
2018-06-26/a>
Didier Stevens
Analyzing XPS files
2018-06-22/a>
Lorna Hutcheson
XPS Attachment Used for Phishing
2018-05-24/a>
Xavier Mertens
"Blocked" Does Not Mean "Forget It"
2018-05-09/a>
Xavier Mertens
Nice Phishing Sample Delivering Trickbot
2018-03-12/a>
Xavier Mertens
Payload delivery via SMB
2018-03-02/a>
Xavier Mertens
Common Patterns Used in Phishing Campaigns Files
2018-02-01/a>
Xavier Mertens
Adaptive Phishing Kit
2018-01-31/a>
Tom Webb
Tax Phishing Time
2018-01-20/a>
Didier Stevens
An RTF phish
2018-01-03/a>
John Bambenek
Phishing to Rural America Leads to Six-figure Wire Fraud Losses
2018-01-02/a>
Didier Stevens
PDF documents & URLs: video
2017-12-18/a>
Didier Stevens
Phish or scam? - Part 2
2017-12-17/a>
Didier Stevens
Phish or scam? - Part 1
2017-12-01/a>
Xavier Mertens
Phishing Kit (Ab)Using Cloud Services
2017-11-23/a>
Xavier Mertens
Proactive Malicious Domain Search
2017-11-10/a>
Bojan Zdrnja
Battling e-mail phishing
2017-11-05/a>
Didier Stevens
Extracting the text from PDF documents
2017-11-04/a>
Didier Stevens
PDF documents & URLs
2017-08-16/a>
Xavier Mertens
Analysis of a Paypal phishing kit
2017-08-13/a>
Didier Stevens
The Good Phishing Email
2017-07-16/a>
Renato Marinho
SMS Phishing induces victims to photograph its own token card
2017-06-27/a>
Brad Duncan
A Tale of Two Phishies
2017-06-15/a>
Bojan Zdrnja
Uberscammers
2017-06-02/a>
Xavier Mertens
Phishing Campaigns Follow Trends
2017-05-20/a>
Xavier Mertens
Typosquatting: Awareness and Hunting
2017-05-03/a>
Bojan Zdrnja
OAUTH phishing against Google Docs ? beware!
2017-04-18/a>
Johannes Ullrich
Yet Another Apple Phish and Some DNS Lessons Learned From It
2017-04-16/a>
Johannes Ullrich
Tool to Detect Active Phishing Attacks Using Unicode Look-Alike Domains
2017-03-28/a>
Xavier Mertens
Logical & Physical Security Correlation
2017-03-24/a>
Xavier Mertens
Nicely Obfuscated JavaScript Sample
2017-03-06/a>
Renato Marinho
A very convincing Typosquatting + Social Engineering campaign is targeting Santander corporate customers in Brazil
2017-02-27/a>
Tom Webb
Dynamite Phishing
2017-02-01/a>
Xavier Mertens
Quick Analysis of Data Left Available by Attackers
2017-01-10/a>
Johannes Ullrich
Realtors Be Aware: You Are a Target
2017-01-04/a>
John Bambenek
Mixed Messages : Novel Phishing Attempts Trying to Steal Your E-mail Password Goes Wrong
2016-11-16/a>
Xavier Mertens
Example of Getting Analysts & Researchers Away
2016-10-07/a>
Rick Wanner
First Hurricane Matthew related Phish
2016-08-23/a>
Xavier Mertens
Voice Message Notifications Deliver Ransomware
2016-06-29/a>
Xavier Mertens
Phishing Campaign with Blurred Images
2016-05-12/a>
Xavier Mertens
Another Day, Another Wave of Phishing Emails
2016-02-07/a>
Xavier Mertens
More Malicious JavaScript Obfuscation
2016-01-13/a>
Alex Stanford
You Have Got a New Audio Message - Guest Diary by Pasquale Stirparo
2015-12-04/a>
Tom Webb
Automating Phishing Analysis using BRO
2015-02-20/a>
Tom Webb
Fast analysis of a Tax Scam
2015-01-31/a>
Guy Bruneau
Beware of Phishing and Spam Super Bowl Fans!
2014-09-16/a>
Daniel Wesemann
https://yourfakebank.support -- TLD confusion starts!
2014-03-27/a>
Alex Stanford
Apple Credential Phishing via appleidconfirm.net
2014-01-24/a>
Johannes Ullrich
How to send mass e-mail the right way
2014-01-24/a>
Chris Mohan
Phishing via Social Media
2013-12-21/a>
Daniel Wesemann
Adobe phishing underway
2013-12-11/a>
Johannes Ullrich
Facebook Phishing and Malware via Tumblr Redirects
2013-10-17/a>
Adrien de Beaupre
Microsoft phish
2013-08-05/a>
Chris Mohan
DMARC: another step forward in the fight against phishing?
2013-05-21/a>
Adrien de Beaupre
Moore, Oklahoma tornado charitable organization scams, malware, and phishing
2013-03-29/a>
Chris Mohan
Does your breach email notification look like a phish?
2012-12-06/a>
Daniel Wesemann
Fake tech support calls - revisited
2012-12-03/a>
John Bambenek
John McAfee Exposes His Location in Photo About His Being on Run
2012-11-29/a>
Kevin Shortt
New Apple Security Update: APPLE-SA-2012-11-29-1 Apple TV 5.1.1
2012-11-28/a>
Mark Hofman
McAfee releases extraDAT for W32/Autorun.worm.aaeb-h
2012-11-28/a>
Mark Hofman
New version of wireshark is available (1.8.4), some security fixes included.
2012-11-27/a>
Chris Mohan
Can users' phish emails be a security admin's catch of the day?
2012-11-26/a>
John Bambenek
Online Shopping for the Holidays? Tips, News and a Fair Warning
2012-11-20/a>
John Bambenek
Behind the Random NTP Bizarreness of Incorrect Year Being Set
2012-11-20/a>
John Bambenek
Firefox v 17.0 just released, more here: http://www.mozilla.org/en-US/firefox/17.0/releasenotes/
2012-11-19/a>
John Bambenek
MoneyGram fined $100 million for aiding wire fraud - http://krebsonsecurity.com/2012/11/moneygram-fined-100-million-for-wire-fraud/
2012-11-19/a>
John Bambenek
New Poll: Top 5 Unresolved Security Problems of 2012
2012-11-17/a>
Manuel Humberto Santander Pelaez
New Sysinternal Updates: AdExplorer v1.44, Contig v1.7, Coreinfo v3.2, Procdump v5.1. See http://blogs.technet.com/b/sysinternals/archive/2012/11/16/updates-adexplorer-v1-44-contig-v1-7-coreinfo-v3-2-procdump-v5-1.aspx?Redirected=true
2012-11-12/a>
John Bambenek
Request for info: Robocall Phishing Against Local/Regional Banks
2012-11-09/a>
Mark Baggett
Remote Diagnostics with PSR
2012-11-09/a>
Mark Baggett
Fresh batch of Microsoft patches next week
2012-11-08/a>
Daniel Wesemann
Get a 40% discount on your hotel room!
2012-11-07/a>
Mark Baggett
Help eliminate unquoted path vulnerabilities
2012-11-07/a>
Mark Baggett
Multiple 0-Days Reported!
2012-11-07/a>
Mark Baggett
Cisco TACACS+ Authentication Bypass
2012-11-05/a>
Johannes Ullrich
Reminder: Ongoing SMTP Brute Forcing Attacks
2012-11-05/a>
Johannes Ullrich
Possible Fake-AV Ads from Doubleclick Servers
2012-11-04/a>
Lorna Hutcheson
What's important on your network?
2012-10-31/a>
Johannes Ullrich
Cyber Security Awareness Month - Day 31 - Business Continuity and Disaster Recovery
2012-10-30/a>
Johannes Ullrich
Hurricane Sandy Update
2012-10-30/a>
Richard Porter
Splunk 5.0 SP-CAAAHB4 http://www.splunk.com/view/SP-CAAAHB4
2012-10-28/a>
Tony Carothers
Firefox 16.02 Released
2012-10-26/a>
Russ McRee
Cyber Security Awareness Month - Day 26 - Attackers use trusted domain to propagate Citadel Zeus variant
2012-10-25/a>
Richard Porter
Cyber Security Awareness Month - Day 25 - Pro Audio & Video Packets on the Wire
2012-10-24/a>
Russ McRee
Ongoing Windstream outage in the midwest - https://twitter.com/search?q=windstream
2012-10-21/a>
Johannes Ullrich
Cyber Security Awareness Month - Day 22: Connectors
2012-10-21/a>
Lorna Hutcheson
Potential Phish for Regular Webmail Accounts
2012-10-19/a>
Johannes Ullrich
Cyber Security Awareness Month - Day 19: Standard log formats and CEE.
2012-10-18/a>
Rob VandenBrink
Cyber Security Awareness Month - Day 18 - Vendor Standards: The vSphere Hardening Guide
2012-10-17/a>
Mark Hofman
New Acrobat release (including reader) available. Version 11. Some security improvements more here -->http://blogs.adobe.com/adobereader/
2012-10-16/a>
Richard Porter
CyberAwareness Month - Day 15, Standards Body Soup (pt2), Same Soup Different Cook.
2012-10-16/a>
Johannes Ullrich
Cyber Security Awareness Month - Day 16: W3C and HTML
2012-10-14/a>
Pedro Bueno
Cyber Security Awareness Month - Day 14 - Poor Man's File Analysis System - Part 1
2012-10-09/a>
Johannes Ullrich
Microsoft October 2012 Black Tuesday Update - Overview
2012-10-07/a>
Tony Carothers
Cyber Security Awareness Month - Day 7 - Rollup Review of CSAM Week 1
2012-10-05/a>
Johannes Ullrich
Cyber Security Awareness Month - Day 5: Standards Body Soup, So many Flavors in the bowl.
2012-10-05/a>
Richard Porter
VMWare Security Advisory: VMSA-2012-0014 - http://www.vmware.com/security/advisories/VMSA-2012-0014.html
2012-10-05/a>
Richard Porter
Reports of a Distributed Injection Scan
2012-10-04/a>
Mark Hofman
And the SHA-3 title goes to .....Keccak
2012-10-03/a>
Kevin Shortt
Fake Support Calls Reported
2012-10-02/a>
Russ McRee
Cyber Security Awareness Month - Day 2 - PCI Security Standard: Mobile Payment Acceptance Security Guidelines
2012-10-01/a>
Johannes Ullrich
Cyber Security Awareness Month
2012-09-28/a>
Joel Esler
Adobe certification revocation for October 4th
2012-09-26/a>
Johannes Ullrich
Some Android phones can be reset to factory default by clicking on links
2012-09-26/a>
Johannes Ullrich
More Java Woes
2012-09-21/a>
Johannes Ullrich
iOS 6 Security Roundup
2012-09-20/a>
Russ McRee
Financial sector advisory: attacks and threats against financial institutions
2012-09-19/a>
Russ McRee
Script kiddie scavenging with Shellbot.S
2012-09-17/a>
Rob VandenBrink
What's on your iPad?
2012-09-14/a>
Lenny Zeltser
Scam Report - Fake Voice Mail Email Notification Redirects to Malicious Site
2012-09-13/a>
Mark Baggett
TCP Fuzzing with Scapy
2012-09-13/a>
Mark Baggett
Microsoft disrupts traffic associated with the Nitol botnet
2012-09-13/a>
Mark Baggett
More SSL trouble
2012-09-10/a>
Johannes Ullrich
Microsoft Patch Tuesday Pre-Release
2012-09-10/a>
Johannes Ullrich
Godaddy DDoS Attack
2012-09-09/a>
Guy Bruneau
Phishing/Spam Pretending to be from BBB
2012-09-06/a>
Johannes Ullrich
SSL Requests sent to port 80 (request for help/input)
2012-09-04/a>
Johannes Ullrich
Another round of "Spot the Exploit E-Mail"
2012-09-01/a>
Russ McRee
Blackhole targeting Java vulnerability via fake Microsoft Services Agreement email phish
2012-08-30/a>
Johannes Ullrich
Editorial: The Slumlord Approach to Network Security http://isc.sans.edu/j/editorial
2012-08-29/a>
Johannes Ullrich
"Data" URLs used for in-URL phishing
2012-08-27/a>
Johannes Ullrich
The Good, Bad and Ugly about Assigning IPv6 Addresses
2012-08-27/a>
Johannes Ullrich
Malware Spam harvesting Facebook Information
2012-08-26/a>
Lorna Hutcheson
Who ya gonna contact?
2012-08-22/a>
Adrien de Beaupre
Apple Remote Desktop update fixes no encryption issue
2012-08-22/a>
Adrien de Beaupre
Phishing/spam via SMS
2012-08-21/a>
Adrien de Beaupre
YYABCAFU - Yes Yet Another Bleeping Critical Adobe Flash Update
2012-08-21/a>
Adrien de Beaupre
RuggedCom fails key management 101 on Rugged Operating System (ROS)
2012-08-20/a>
Manuel Humberto Santander Pelaez
Do we need test procedures in our companies before implementing Antivirus signatures?
2012-08-19/a>
Manuel Humberto Santander Pelaez
Authentication Issues between entities during protocol message exchange in SCADA Systems
2012-08-17/a>
Guy Bruneau
Suspicious eFax Spear Phishing Messages
2012-08-12/a>
Tony Carothers
Layers of the Defense-in-Depth Onion
2012-08-12/a>
Tony Carothers
Oracle Security Alert for CVE-2012-3132
2012-08-09/a>
Mark Hofman
Zeus/Citadel variant causing issues in the Netherlands
2012-08-09/a>
Mark Hofman
SQL Injection Lilupophilupop style, Part 2
2012-08-07/a>
Adrien de Beaupre
Who protects small business?
2012-08-04/a>
Kevin Liston
Vendors: More Patch-Release Options Please
2012-07-27/a>
Daniel Wesemann
Cuckoo 0.4 is out - cool new features for malware analysis http://www.cuckoosandbox.org/
2012-07-24/a>
Richard Porter
Wireshark 1.8.1 Released http://www.wireshark.org/
2012-07-24/a>
Richard Porter
Report of spike in DNS Queries gd21.net
2012-07-20/a>
Mark Baggett
Syria Internet connection cut?
2012-07-19/a>
Mark Baggett
Diagnosing Malware with Resource Monitor
2012-07-19/a>
Mark Baggett
A Heap of Overflows?
2012-07-16/a>
Richard Porter
Sysinternals Update @ http://blogs.technet.com/b/sysinternals/archive/2012/07/16/updates-handle-v3-5-process-explorer-v15-22-process-monitor-v3-03-rammap-v1-21-zoomit-v4-3.aspx
2012-07-13/a>
Richard Porter
Yesterday (not as on the ball as Rob) at SANSFire
2012-07-13/a>
Russ McRee
2 for 1: SANSFIRE & MSRA presentations
2012-07-12/a>
Rick Wanner
Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Recording Server - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctrs
2012-07-12/a>
Rick Wanner
Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Immersive Endpoint Devices - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-cts
2012-07-12/a>
Rick Wanner
Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Manager - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctsman
2012-07-12/a>
Rick Wanner
Cisco Security Advisory: Multiple Vulnerabilities in Cisco TelePresence Multipoint Switch - http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120711-ctms
2012-07-09/a>
Johannes Ullrich
The FBI will turn off the Internet on Monday (or not)
2012-07-09/a>
Manuel Humberto Santander Pelaez
Internet Storm Center panel tonight at SANSFIRE 2012!
2012-07-05/a>
Adrien de Beaupre
New OS X trojan backdoor MaControl variant reported
2012-07-02/a>
Joel Esler
A rough guide to keeping your website up
2012-07-02/a>
Joel Esler
Linux & Java leap second bug
2012-06-29/a>
Jim Clausing
Updated SysInternals tools - Autoruns, Process Explorer, Process Monitor, PSKill -- http://blogs.technet.com/b/sysinternals/archive/2012/06/28/updates-autoruns-v11-32-process-explorer-v15-21-process-monitor-v3-02-pskill-v1-15-rammap-v1-2.aspx
2012-06-21/a>
Russ McRee
Wireshark 1.8.0 released 21 JUN 2012 http://www.wireshark.org/download.html
2012-06-19/a>
Daniel Wesemann
Vulnerabilityqueerprocessbrittleness
2012-06-14/a>
Johannes Ullrich
Spot the Phish: Verizon Wireless
2012-06-10/a>
Scott Fendley
Preying on Users After Major Security Incidents
2012-05-30/a>
Rob VandenBrink
It's Phishing Season! In fact, it's ALWAYS Phishing Season!
2012-02-17/a>
Mark Hofman
Intersting Facebook SPAM
2011-08-31/a>
Johannes Ullrich
Phishing e-mail to custom e-mail addresses
2011-08-16/a>
Scott Fendley
Phishing Scam Victim Response
2011-07-19/a>
Richard Porter
SMS Phishing at the SANSFire 2011 Handler Dinner
2011-06-27/a>
Kevin Shortt
Phishy Spam
2011-06-08/a>
Johannes Ullrich
Spam from compromised Hotmail accounts
2011-06-06/a>
Manuel Humberto Santander Pelaez
Phishing: Same goal, same techniques and people still falling for such scams
2011-02-02/a>
Johannes Ullrich
Having Phish on Friday
2010-11-29/a>
Stephen Hall
iPhone phishing - What you see, isn't what you get
2010-11-22/a>
Lenny Zeltser
Brand Impersonations On-Line: Brandjacking and Social Networks
2010-06-21/a>
Adrien de Beaupre
GoDaddy Scam/Phish/Spam
2010-06-10/a>
Deborah Hale
Another Morning of Fun
2010-04-19/a>
Daniel Wesemann
Linked into scams?
2010-02-02/a>
Johannes Ullrich
Twitter Mass Password Reset due to Phishing
2009-12-16/a>
Rob VandenBrink
Beware the Attack of the Christmas Greeting Cards !
2009-10-19/a>
Daniel Wesemann
Scam Email
2009-10-09/a>
Rob VandenBrink
AT&T Cell Phone Phish
2009-09-10/a>
Johannes Ullrich
Healthcare Spam
2009-07-28/a>
Adrien de Beaupre
Twitter spam/phish
2009-05-24/a>
Raul Siles
Facebook phising using Belgium (.be) domains
2009-05-04/a>
Tom Liston
Facebook phishing malware
2009-01-11/a>
Deborah Hale
The Frustration of Phishing Attacks
2009-01-04/a>
Rick Wanner
Twitter/Facebook Phishing Attempt
2008-11-11/a>
Swa Frantzen
Phishing for Google adwords
2008-10-29/a>
Deborah Hale
Enom Phishing - Caution Enom Registrars
2008-10-10/a>
Marcus Sachs
Fake Microsoft Update Email
2008-06-17/a>
Kyle Haugsness
Why go high-tech?
2008-05-26/a>
Marcus Sachs
Predictable Response
2008-05-19/a>
Maarten Van Horenbeeck
Text message and telephone aid scams
2008-04-14/a>
John Bambenek
A Federal Subpoena or Just Some More Spam & Malware?
MALWARE
2024-11-30/a>
Xavier Mertens
From a Regular Infostealer to its Obfuscated Version
2024-11-22/a>
Xavier Mertens
An Infostealer Searching for « BIP-0039 » Data
2024-11-19/a>
Xavier Mertens
Detecting the Presence of a Debugger in Linux
2024-11-07/a>
Xavier Mertens
Steam Account Checker Poisoned with Infostealer
2024-11-05/a>
Xavier Mertens
Python RAT with a Nice Screensharing Feature
2024-10-09/a>
Xavier Mertens
From Perfctl to InfoStealer
2024-09-18/a>
Xavier Mertens
Python Infostealer Patching Windows Exodus App
2024-09-17/a>
Xavier Mertens
23:59, Time to Exfiltrate!
2024-09-16/a>
Xavier Mertens
Managing PE Files With Overlays
2024-09-11/a>
Guy Bruneau
Hygiene, Hygiene, Hygiene! [Guest Diary]
2024-08-27/a>
Xavier Mertens
Why Is Python so Popular to Infect Windows Hosts?
2024-08-26/a>
Xavier Mertens
From Highly Obfuscated Batch File to XWorm and Redline
2024-08-19/a>
Xavier Mertens
Do you Like Donuts? Here is a Donut Shellcode Delivered Through PowerShell/Python
2024-08-14/a>
Xavier Mertens
Multiple Malware Dropped Through MSI Package
2024-07-26/a>
Xavier Mertens
ExelaStealer Delivered "From Russia With Love"
2024-07-25/a>
Xavier Mertens
XWorm Hidden With Process Hollowing
2024-07-24/a>
Xavier Mertens
"Mouse Logger" Malicious Python Script
2024-06-06/a>
Xavier Mertens
Malicious Python Script with a "Best Before" Date
2024-05-28/a>
Guy Bruneau
Is that It? Finding the Unknown: Correlations Between Honeypot Logs & PCAPs [Guest Diary]
2024-05-22/a>
Guy Bruneau
Analysis of ?redtail? File Uploads to ICS Honeypot, a Multi-Architecture Coin Miner [Guest Diary]
2024-04-29/a>
Guy Bruneau
Linux Trojan - Xorddos with Filename eyshcjdmzg
2024-04-25/a>
Jesse La Grew
Does it matter if iptables isn't running on my honeypot?
2024-03-28/a>
Xavier Mertens
From JavaScript to AsyncRAT
2024-03-13/a>
Xavier Mertens
Using ChatGPT to Deobfuscate Malicious Scripts
2024-02-29/a>
Jesse La Grew
[Guest Diary] Dissecting DarkGate: Modular Malware Delivery and Persistence as a Service.
2024-02-08/a>
Xavier Mertens
A Python MP3 Player with Builtin Keylogger Capability
2024-02-06/a>
Jan Kopriva
Computer viruses are celebrating their 40th birthday (well, 54th, really)
2024-01-26/a>
Xavier Mertens
A Batch File With Multiple Payloads
2024-01-25/a>
Xavier Mertens
Facebook AdsManager Targeted by a Python Infostealer
2024-01-24/a>
Johannes Ullrich
How Bad User Interfaces Make Security Tools Harmful
2024-01-19/a>
Xavier Mertens
macOS Python Script Replacing Wallet Applications with Rogue Apps
2024-01-07/a>
Guy Bruneau
Suspicious Prometei Botnet Activity
2024-01-03/a>
Jan Kopriva
Interesting large and small malspam attachments from 2023
2023-12-22/a>
Xavier Mertens
Shall We Play a Game?
2023-11-18/a>
Xavier Mertens
Quasar RAT Delivered Through Updated SharpLoader
2023-11-15/a>
Xavier Mertens
Redline Dropped Through MSIX Package
2023-11-09/a>
Xavier Mertens
Visual Examples of Code Injection
2023-11-01/a>
Xavier Mertens
Malware Dropped Through a ZPAQ Archive
2023-10-31/a>
Xavier Mertens
Multiple Layers of Anti-Sandboxing Techniques
2023-10-28/a>
Xavier Mertens
Size Matters for Many Security Controls
2023-10-18/a>
Jesse La Grew
Hiding in Hex
2023-09-30/a>
Xavier Mertens
Simple Netcat Backdoor in Python Script
2023-09-29/a>
Xavier Mertens
Are You Still Storing Passwords In Plain Text Files?
2023-08-25/a>
Xavier Mertens
Python Malware Using Postgresql for C2 Communications
2023-08-23/a>
Xavier Mertens
More Exotic Excel Files Dropping AgentTesla
2023-08-22/a>
Xavier Mertens
Have You Ever Heard of the Fernet Encryption Algorithm?
2023-08-21/a>
Xavier Mertens
Quick Malware Triage With Inotify Tools
2023-08-20/a>
Guy Bruneau
SystemBC Malware Activity
2023-08-18/a>
Xavier Mertens
From a Zalando Phishing to a RAT
2023-08-11/a>
Xavier Mertens
Show me All Your Windows!
2023-08-03/a>
Jan Kopriva
From small LNK to large malicious BAT file with zero VT score
2023-07-29/a>
Xavier Mertens
Do Attackers Pay More Attention to IPv6?
2023-07-28/a>
Xavier Mertens
ShellCode Hidden with Steganography
2023-07-26/a>
Xavier Mertens
Suspicious IP Addresses Avoided by Malware Samples
2023-06-27/a>
Xavier Mertens
The Importance of Malware Triage
2023-06-23/a>
Xavier Mertens
Word Document with an Online Attached Template
2023-06-21/a>
Yee Ching Tok
Analyzing a YouTube Sponsorship Phishing Mail and Malware Targeting Content Creators
2023-06-20/a>
Xavier Mertens
Malicious Code Can Be Anywhere
2023-06-19/a>
Xavier Mertens
Malware Delivered Through .inf File
2023-06-16/a>
Xavier Mertens
Another RAT Delivered Through VBS
2023-05-17/a>
Xavier Mertens
Increase in Malicious RAR SFX files
2023-04-07/a>
Xavier Mertens
Detecting Suspicious API Usage with YARA Rules
2023-04-04/a>
Johannes Ullrich
Analyzing the efile.com Malware "efail"
2023-03-30/a>
Xavier Mertens
Bypassing PowerShell Strong Obfuscation
2023-03-26/a>
Didier Stevens
Extra: "String Obfuscation: Character Pair Reversal"
2023-03-01/a>
Xavier Mertens
Python Infostealer Targeting Gamers
2023-02-09/a>
Xavier Mertens
A Backdoor with Smart Screenshot Capability
2023-02-04/a>
Guy Bruneau
Assemblyline as a Malware Analysis Sandbox
2023-01-25/a>
Xavier Mertens
A First Malicious OneNote Document
2023-01-16/a>
Johannes Ullrich
PSA: Why you must run an ad blocker when using Google
2023-01-06/a>
Xavier Mertens
AutoIT Remains Popular in the Malware Landscape
2023-01-05/a>
Brad Duncan
More Brazil malspam pushing Astaroth (Guildma) in January 2023
2022-12-21/a>
Guy Bruneau
DShield Sensor Setup in Azure
2022-12-18/a>
Guy Bruneau
Infostealer Malware with Double Extension
2022-11-19/a>
Guy Bruneau
McAfee Fake Antivirus Phishing Campaign is Back!
2022-11-09/a>
Xavier Mertens
Another Script-Based Ransomware
2022-11-05/a>
Guy Bruneau
Windows Malware with VHD Extension
2022-11-04/a>
Xavier Mertens
Remcos Downloader with Unicode Obfuscation
2022-10-24/a>
Xavier Mertens
C2 Communications Through outlook.com
2022-10-21/a>
Brad Duncan
sczriptzzbn inject pushes malware for NetSupport RAT
2022-10-18/a>
Xavier Mertens
Python Obfuscation for Dummies
2022-10-17/a>
Xavier Mertens
Fileless Powershell Dropper
2022-10-15/a>
Guy Bruneau
Malware - Covid Vaccination Supplier Declaration
2022-10-07/a>
Xavier Mertens
Powershell Backdoor with DGA Capability
2022-09-25/a>
Didier Stevens
Downloading Samples From Takendown Domains
2022-09-24/a>
Didier Stevens
Maldoc Analysis Info On MalwareBazaar
2022-09-23/a>
Xavier Mertens
Kids Like Cookies, Malware Too!
2022-09-22/a>
Xavier Mertens
RAT Delivered Through FODHelper
2022-09-15/a>
Xavier Mertens
Malicious Word Document with a Frameset
2022-09-14/a>
Xavier Mertens
Easy Process Injection within Python
2022-09-10/a>
Guy Bruneau
Phishing Word Documents with Suspicious URL
2022-09-03/a>
Didier Stevens
Video: James Webb JPEG With Malware
2022-09-02/a>
Didier Stevens
James Webb JPEG With Malware
2022-08-30/a>
Johannes Ullrich
Two things that will never die: bash scripts and IRC!
2022-08-22/a>
Xavier Mertens
32 or 64 bits Malware?
2022-07-29/a>
Johannes Ullrich
PDF Analysis Intro and OpenActions Entries
2022-07-25/a>
Xavier Mertens
PowerShell Script with Fileless Capability
2022-07-20/a>
Xavier Mertens
Malicious Python Script Behaving Like a Rubber Ducky
2022-06-25/a>
Xavier Mertens
Malicious Code Passed to PowerShell via the Clipboard
2022-06-22/a>
Xavier Mertens
Malicious PowerShell Targeting Cryptocurrency Browser Extensions
2022-06-16/a>
Xavier Mertens
Houdini is Back Delivered Through a JavaScript Dropper
2022-06-04/a>
Guy Bruneau
Spam Email Contains a Very Large ISO file
2022-06-03/a>
Xavier Mertens
Sandbox Evasion... With Just a Filename!
2022-05-31/a>
Xavier Mertens
First Exploitation of Follina Seen in the Wild
2022-05-20/a>
Xavier Mertens
A 'Zip Bomb' to Bypass Security Controls & Sandboxes
2022-05-19/a>
Brad Duncan
Bumblebee Malware from TransferXL URLs
2022-05-11/a>
Brad Duncan
TA578 using thread-hijacked emails to push ISO files for Bumblebee malware
2022-05-07/a>
Guy Bruneau
Phishing PDF Received in my ISC Mailbox
2022-05-06/a>
Jan Kopriva
What is the simplest malware in the world?
2022-05-05/a>
Brad Duncan
Password-protected Excel spreadsheet pushes Remcos RAT
2022-04-21/a>
Xavier Mertens
Multi-Cryptocurrency Clipboard Swapper
2022-04-06/a>
Brad Duncan
Windows MetaStealer Malware
2022-03-25/a>
Xavier Mertens
XLSB Files: Because Binary is Stealthier Than XML
2022-03-24/a>
Xavier Mertens
Malware Delivered Through Free Sharing Tool
2022-03-23/a>
Brad Duncan
Arkei Variants: From Vidar to Mars Stealer
2022-03-11/a>
Xavier Mertens
Keep an Eye on WebSockets
2022-03-09/a>
Xavier Mertens
Infostealer in a Batch File
2022-02-22/a>
Xavier Mertens
A Good Old Equation Editor Vulnerability Delivering Malware
2022-02-18/a>
Xavier Mertens
Remcos RAT Delivered Through Double Compressed Archive
2022-02-11/a>
Xavier Mertens
CinaRAT Delivered Through HTML ID Attributes
2022-01-20/a>
Xavier Mertens
RedLine Stealer Delivered Through FTP
2022-01-07/a>
Xavier Mertens
Custom Python RAT Builder
2022-01-06/a>
Xavier Mertens
Malicious Python Script Targeting Chinese People
2022-01-05/a>
Xavier Mertens
Code Reuse In the Malware Landscape
2021-12-21/a>
Xavier Mertens
More Undetected PowerShell Dropper
2021-12-15/a>
Xavier Mertens
Simple but Undetected PowerShell Backdoor
2021-12-03/a>
Xavier Mertens
The UPX Packer Will Never Die!
2021-12-02/a>
Brad Duncan
TA551 (Shathak) pushes IcedID (Bokbot)
2021-11-19/a>
Xavier Mertens
Downloader Disguised as Excel Add-In (XLL)
2021-11-18/a>
Xavier Mertens
JavaScript Downloader Delivers Agent Tesla Trojan
2021-10-21/a>
Brad Duncan
"Stolen Images Evidence" campaign pushes Sliver-based malware
2021-10-01/a>
Xavier Mertens
New Tool to Add to Your LOLBAS List: cvtres.exe
2021-09-23/a>
Xavier Mertens
Excel Recipe: Some VBA Code with a Touch of Excel4 Macro
2021-09-01/a>
Brad Duncan
STRRAT: a Java-based RAT that doesn't care if you have Java
2021-08-30/a>
Xavier Mertens
Cryptocurrency Clipboard Swapper Delivered With Love
2021-08-20/a>
Xavier Mertens
Waiting for the C2 to Show Up
2021-08-15/a>
Didier Stevens
Simple Tips For Triage Of MALWARE Bazaar's Daily Malware Batches
2021-08-07/a>
Didier Stevens
MALWARE Bazaar "Download daily malware batches"
2021-08-06/a>
Xavier Mertens
Malicious Microsoft Word Remains A Key Infection Vector
2021-07-30/a>
Xavier Mertens
Infected With a .reg File
2021-07-29/a>
Xavier Mertens
Malicious Content Delivered Through archive.org
2021-07-24/a>
Xavier Mertens
Agent.Tesla Dropped via a .daa Image and Talking to Telegram
2021-07-16/a>
Xavier Mertens
Multiple BaseXX Obfuscations
2021-07-06/a>
Xavier Mertens
Python DLL Injection Check
2021-06-30/a>
Brad Duncan
June 2021 Forensic Contest: Answers and Analysis
2021-06-11/a>
Xavier Mertens
Keeping an Eye on Dangerous Python Modules
2021-06-09/a>
Jan Kopriva
Architecture, compilers and black magic, or "what else affects the ability of AVs to detect malicious files"
2021-06-04/a>
Xavier Mertens
Russian Dolls VBS Obfuscation
2021-05-28/a>
Xavier Mertens
Malicious PowerShell Hosted on script.google.com
2021-05-27/a>
Jan Kopriva
All your Base are...nearly equal when it comes to AV evasion, but 64-bit executables are not
2021-05-21/a>
Xavier Mertens
Locking Kernel32.dll As Anti-Debugging Technique
2021-05-19/a>
Brad Duncan
May 2021 Forensic Contest: Answers and Analysis
2021-05-18/a>
Xavier Mertens
From RunDLL32 to JavaScript then PowerShell
2021-05-06/a>
Xavier Mertens
Alternative Ways To Perform Basic Tasks
2021-05-05/a>
Brad Duncan
May 2021 Forensic Contest
2021-04-29/a>
Xavier Mertens
From Python to .Net
2021-04-28/a>
Xavier Mertens
Deeper Analyzis of my Last Malicious PowerPoint Add-On
2021-04-23/a>
Xavier Mertens
Malicious PowerPoint Add-On: "Small Is Beautiful"
2021-04-09/a>
Xavier Mertens
No Python Interpreter? This Simple RAT Installs Its Own Copy
2021-04-08/a>
Xavier Mertens
Simple Powershell Ransomware Creating a 7Z Archive of your Files
2021-04-06/a>
Jan Kopriva
Malspam with Lokibot vs. Outlook and RFCs
2021-04-02/a>
Xavier Mertens
C2 Activity: Sandboxes or Real Victims?
2021-04-01/a>
Brad Duncan
April 2021 Forensic Quiz
2021-03-31/a>
Xavier Mertens
Quick Analysis of a Modular InfoStealer
2021-03-19/a>
Xavier Mertens
Pastebin.com Used As a Simple C2 Channel
2021-03-18/a>
Xavier Mertens
Simple Python Keylogger
2021-03-17/a>
Xavier Mertens
Defenders, Know Your Operating System Like Attackers Do!
2021-03-16/a>
Jan Kopriva
50 years of malware? Not really. 50 years of computer worms? That's a different story...
2021-03-04/a>
Xavier Mertens
From VBS, PowerShell, C Sharp, Process Hollowing to RAT
2021-02-19/a>
Xavier Mertens
Dynamic Data Exchange (DDE) is Back in the Wild?
2021-02-14/a>
Didier Stevens
Video: tshark & Malware Analysis
2021-02-12/a>
Xavier Mertens
AgentTesla Dropped Through Automatic Click in Microsoft Help File
2021-02-11/a>
Jan Kopriva
Agent Tesla hidden in a historical anti-malware tool
2021-02-03/a>
Brad Duncan
Excel spreadsheets push SystemBC malware
2021-02-02/a>
Xavier Mertens
New Example of XSL Script Processing aka "Mitre T1220"
2021-01-22/a>
Xavier Mertens
Another File Extension to Block in your MTA: .jnlp
2021-01-21/a>
Xavier Mertens
Powershell Dropping a REvil Ransomware
2021-01-04/a>
Jan Kopriva
From a small BAT file to Mass Logger infostealer
2021-01-02/a>
Guy Bruneau
Protecting Home Office and Enterprise in 2021
2020-12-24/a>
Xavier Mertens
Malicious Word Document Delivering an Octopus Backdoor
2020-12-22/a>
Xavier Mertens
Malware Victim Selection Through WiFi Identification
2020-12-03/a>
Brad Duncan
Traffic Analysis Quiz: Mr Natural
2020-11-25/a>
Xavier Mertens
Live Patching Windows API Calls Using PowerShell
2020-11-23/a>
Didier Stevens
Quick Tip: Cobalt Strike Beacon Analysis
2020-11-09/a>
Xavier Mertens
How Attackers Brush Up Their Malicious Scripts
2020-10-25/a>
Didier Stevens
Video: Pascal Strings
2020-10-21/a>
Daniel Wesemann
Shipping dangerous goods
2020-09-24/a>
Xavier Mertens
Party in Ibiza with PowerShell
2020-09-23/a>
Xavier Mertens
Malicious Word Document with Dynamic Content
2020-09-18/a>
Xavier Mertens
A Mix of Python & VBA in a Malicious Word Document
2020-09-15/a>
Brad Duncan
Traffic Analysis Quiz: Oh No... Another Infection!
2020-09-04/a>
Jan Kopriva
A blast from the past - XXEncoded VB6.0 Trojan
2020-09-03/a>
Xavier Mertens
Sandbox Evasion Using NTP
2020-08-28/a>
Xavier Mertens
Example of Malicious DLL Injected in PowerShell
2020-08-26/a>
Xavier Mertens
Malicious Excel Sheet with a NULL VT Score
2020-08-24/a>
Xavier Mertens
Tracking A Malware Campaign Through VT
2020-08-19/a>
Xavier Mertens
Example of Word Document Delivering Qakbot
2020-08-18/a>
Xavier Mertens
Using API's to Track Attackers
2020-08-14/a>
Jan Kopriva
Definition of 'overkill' - using 130 MB executable to hide 24 kB malware
2020-08-06/a>
Xavier Mertens
A Fork of the FTCode Powershell Ransomware
2020-08-05/a>
Brad Duncan
Traffic Analysis Quiz: What's the Malware From This Infection?
2020-07-24/a>
Xavier Mertens
Compromized Desktop Applications by Web Technologies
2020-07-15/a>
Brad Duncan
Word docs with macros for IcedID (Bokbot)
2020-07-10/a>
Brad Duncan
Excel spreasheet macro kicks off Formbook infection
2020-07-08/a>
Xavier Mertens
If You Want Something Done Right, You Have To Do It Yourself... Malware Too!
2020-06-13/a>
Guy Bruneau
Mirai Botnet Activity
2020-06-04/a>
Xavier Mertens
Anti-Debugging Technique based on Memory Protection
2020-06-01/a>
Jim Clausing
Stackstrings, type 2
2020-05-23/a>
Xavier Mertens
AgentTesla Delivered via a Malicious PowerPoint Add-In
2020-05-21/a>
Xavier Mertens
Malware Triage with FLOSS: API Calls Based Behavior
2020-05-20/a>
Brad Duncan
Microsoft Word document with malicious macro pushes IcedID (Bokbot)
2020-05-06/a>
Xavier Mertens
Keeping an Eye on Malicious Files Life Time
2020-04-27/a>
Xavier Mertens
Powershell Payload Stored in a PSCredential Object
2020-04-25/a>
Didier Stevens
MALWARE Bazaar
2020-04-24/a>
Xavier Mertens
Malicious Excel With a Strong Obfuscation and Sandbox Evasion
2020-04-20/a>
Didier Stevens
KPOT AutoIt Script: Analysis
2020-04-17/a>
Xavier Mertens
Weaponized RTF Document Generator & Mailer in PowerShell
2020-04-12/a>
Didier Stevens
Reader Analysis: "Dynamic analysis technique to get decrypted KPOT Malware."
2020-04-10/a>
Xavier Mertens
PowerShell Sample Extracting Payload From SSL
2020-04-03/a>
Xavier Mertens
Obfuscated with a Simple 0x0A
2020-03-31/a>
Johannes Ullrich
Kwampirs Targeted Attacks Involving Healthcare Sector
2020-03-27/a>
Xavier Mertens
Malicious JavaScript Dropping Payload in the Registry
2020-03-26/a>
Xavier Mertens
Very Large Sample as Evasion Technique?
2020-03-23/a>
Didier Stevens
KPOT Deployed via AutoIt Script
2020-03-22/a>
Didier Stevens
More COVID-19 Themed Malware
2020-03-21/a>
Guy Bruneau
Honeypot - Scanning and Targeting Devices & Services
2020-03-19/a>
Xavier Mertens
COVID-19 Themed Multistage Malware
2020-03-11/a>
Xavier Mertens
Agent Tesla Delivered via Fake Canon EOS Notification on Free OwnCloud Account
2020-03-06/a>
Xavier Mertens
A Safe Excel Sheet Not So Safe
2020-02-21/a>
Xavier Mertens
Quick Analysis of an Encrypted Compound Document Format
2020-02-14/a>
Xavier Mertens
Keep an Eye on Command-Line Browsers
2020-02-07/a>
Xavier Mertens
Sandbox Detection Tricks & Nice Obfuscation in a Single VBScript
2020-02-03/a>
Jan Kopriva
Analysis of a triple-encrypted AZORult downloader
2020-01-16/a>
Jan Kopriva
Picks of 2019 malware - the large, the small and the one full of null bytes
2020-01-10/a>
Xavier Mertens
More Data Exfiltration
2020-01-09/a>
Xavier Mertens
Quick Analyzis of a(nother) Maldoc
2020-01-02/a>
Xavier Mertens
Ransomware in Node.js
2019-12-24/a>
Brad Duncan
Malspam with links to Word docs pushes IcedID (Bokbot)
2019-12-12/a>
Xavier Mertens
Code & Data Reuse in the Malware Ecosystem
2019-11-23/a>
Guy Bruneau
Local Malware Analysis with Malice
2019-10-18/a>
Xavier Mertens
Quick Malicious VBS Analysis
2019-10-03/a>
Xavier Mertens
"Lost_Files" Ransomware
2019-09-19/a>
Xavier Mertens
Agent Tesla Trojan Abusing Corporate Email Accounts
2019-08-30/a>
Xavier Mertens
Malware Dropping a Local Node.js Instance
2019-08-28/a>
Xavier Mertens
Malware Samples Compiling Their Next Stage on Premise
2019-08-22/a>
Xavier Mertens
Simple Mimikatz & RDPWrapper Dropper
2019-08-18/a>
Didier Stevens
Video: Analyzing DAA Files
2019-08-16/a>
Didier Stevens
The DAA File Format
2019-08-12/a>
Didier Stevens
Malicious .DAA Attachments
2019-07-18/a>
Xavier Mertens
Malicious PHP Script Back on Stage?
2019-07-11/a>
Xavier Mertens
Russian Dolls Malicious Script Delivering Ursnif
2019-07-02/a>
Xavier Mertens
Malicious Script With Multiple Payloads
2019-06-14/a>
Jim Clausing
A few Ghidra tips for IDA users, part 4 - function call graphs
2019-06-10/a>
Xavier Mertens
Interesting JavaScript Obfuscation Example
2019-05-29/a>
Xavier Mertens
Behavioural Malware Analysis with Microsoft ASA
2019-05-13/a>
Xavier Mertens
From Phishing To Ransomware?
2019-05-03/a>
Jim Clausing
A few Ghidra tips for IDA users, part 3 - conversion, labels, and comments
2019-05-01/a>
Xavier Mertens
Another Day, Another Suspicious UDF File
2019-04-19/a>
Didier Stevens
Analyzing UDF Files with Python
2019-04-17/a>
Jim Clausing
A few Ghidra tips for IDA users, part 2 - strings and parameters
2019-04-17/a>
Xavier Mertens
Malware Sample Delivered Through UDF Image
2019-04-08/a>
Jim Clausing
A few Ghidra tips for IDA users, part 1 - the decompiler/unreachable code
2019-04-03/a>
Jim Clausing
A few Ghidra tips for IDA users, part 0 - automatic comments for API call parameters
2019-03-30/a>
Didier Stevens
"404" is not Malware
2019-03-10/a>
Didier Stevens
Malicious HTA Analysis by a Reader
2019-03-10/a>
Didier Stevens
Quick and Dirty Malicious HTA Analysis
2019-02-14/a>
Xavier Mertens
Old H-Worm Delivered Through GitHub
2019-01-16/a>
Brad Duncan
Emotet infections and follow-up malware
2019-01-06/a>
Didier Stevens
Malicious .tar Attachments
2019-01-05/a>
Didier Stevens
A Malicious JPEG? Second Example
2019-01-04/a>
Didier Stevens
A Malicious JPEG?
2019-01-02/a>
Xavier Mertens
Malicious Script Leaking Data via FTP
2018-12-09/a>
Didier Stevens
Quickie: String Analysis is Still Useful
2018-12-08/a>
Didier Stevens
Reader Malware Submission: MHT File Inside a ZIP File
2018-11-27/a>
Xavier Mertens
More obfuscated shell scripts: Fake MacOS Flash update
2018-11-26/a>
Xavier Mertens
Obfuscated bash script targeting QNap boxes
2018-11-22/a>
Xavier Mertens
Divided Payload in Multiple Pasties
2018-11-06/a>
Xavier Mertens
Malicious Powershell Script Dissection
2018-10-23/a>
Xavier Mertens
Diving into Malicious AutoIT Code
2018-10-22/a>
Xavier Mertens
Malicious Powershell using a Decoy Picture
2018-10-21/a>
Pasquale Stirparo
Beyond good ol’ LaunchAgent - part 0
2018-10-12/a>
Xavier Mertens
More Equation Editor Exploit Waves
2018-09-28/a>
Xavier Mertens
More Excel DDE Code Injection
2018-09-22/a>
Didier Stevens
Suspicious DNS Requests ... Issued by a Firewall
2018-09-16/a>
Didier Stevens
20/20 malware vision
2018-09-13/a>
Xavier Mertens
Malware Delivered Through MHT Files
2018-09-05/a>
Xavier Mertens
Malicious PowerShell Compiling C# Code on the Fly
2018-08-31/a>
Jim Clausing
Quickie: Using radare2 to disassemble shellcode
2018-08-30/a>
Xavier Mertens
Crypto Mining Is More Popular Than Ever!
2018-08-26/a>
Didier Stevens
Identifying numeric obfuscation
2018-08-26/a>
Didier Stevens
"When was this machine infected?"
2018-08-24/a>
Xavier Mertens
Microsoft Publisher Files Delivering Malware
2018-08-21/a>
Xavier Mertens
Malicious DLL Loaded Through AutoIT
2018-08-06/a>
Didier Stevens
Numeric obfuscation: another example
2018-08-04/a>
Didier Stevens
Dealing with numeric obfuscation in malicious scripts
2018-08-02/a>
Brad Duncan
DHL-themed malspam reveals embedded malware in animated gif
2018-07-26/a>
Xavier Mertens
Windows Batch File Deobfuscation
2018-07-09/a>
Renato Marinho
Criminals Don't Read Instructions or Use Strong Passwords
2018-06-07/a>
Remco Verhoef
Automated twitter loot collection
2018-06-05/a>
Xavier Mertens
Malicious Post-Exploitation Batch File
2018-06-01/a>
Remco Verhoef
Binary analysis with Radare2
2018-05-22/a>
Xavier Mertens
Malware Distributed via .slk Files
2018-05-19/a>
Xavier Mertens
Malicious Powershell Targeting UK Bank Customers
2018-05-09/a>
Xavier Mertens
Nice Phishing Sample Delivering Trickbot
2018-05-07/a>
Xavier Mertens
Adding Persistence Via Scheduled Tasks
2018-05-01/a>
Xavier Mertens
Diving into a Simple Maldoc Generator
2018-03-05/a>
Xavier Mertens
Malicious Bash Script with Multiple Features
2018-03-04/a>
Xavier Mertens
The Crypto Miners Fight For CPU Cycles
2018-02-25/a>
Didier Stevens
Retrieving malware over Tor on Windows
2018-02-02/a>
Xavier Mertens
Simple but Effective Malicious XLS Sheet
2018-01-28/a>
Didier Stevens
Is this a pentest?
2018-01-26/a>
Xavier Mertens
Investigating Microsoft BITS Activity
2018-01-25/a>
Xavier Mertens
Ransomware as a Service
2018-01-11/a>
Xavier Mertens
Mining or Nothing!
2017-12-19/a>
Xavier Mertens
Example of 'MouseOver' Link in a Powerpoint File
2017-12-16/a>
Xavier Mertens
Microsoft Office VBA Macro Obfuscation via Metadata
2017-11-29/a>
Xavier Mertens
Fileless Malicious PowerShell Sample
2017-11-16/a>
Xavier Mertens
Suspicious Domains Tracking Dashboard
2017-11-15/a>
Xavier Mertens
If you want something done right, do it yourself!
2017-11-13/a>
Guy Bruneau
VBE Embeded Script (info.zip)
2017-11-07/a>
Xavier Mertens
Interesting VBA Dropper
2017-11-03/a>
Xavier Mertens
Simple Analysis of an Obfuscated JAR File
2017-10-31/a>
Xavier Mertens
Some Powershell Malicious Code
2017-10-29/a>
Didier Stevens
Remember ACE files?
2017-10-24/a>
Xavier Mertens
BadRabbit: New ransomware wave hitting RU & UA
2017-10-15/a>
Didier Stevens
Peeking into .msg files
2017-09-09/a>
Didier Stevens
Malware analysis output sanitization
2017-09-02/a>
Xavier Mertens
AutoIT based malware back in the wild
2017-08-26/a>
Didier Stevens
Malware analysis: searching for dots
2017-08-25/a>
Xavier Mertens
Malicious AutoIT script delivered in a self-extracting RAR file
2017-08-23/a>
Xavier Mertens
Malicious script dropping an executable signed by Avast?
2017-08-18/a>
Renato Marinho
EngineBox Malware Supports 10+ Brazilian Banks
2017-07-21/a>
Didier Stevens
Malicious .iso Attachments
2017-07-09/a>
Russ McRee
Adversary hunting with SOF-ELK
2017-07-05/a>
Didier Stevens
Selecting domains with random names
2017-06-22/a>
Xavier Mertens
Obfuscating without XOR
2017-06-06/a>
Didier Stevens
Malware and XOR - Part 2
2017-06-05/a>
Didier Stevens
Malware and XOR - Part 1
2017-05-16/a>
Russ McRee
WannaCry? Do your own data analysis.
2017-05-13/a>
Guy Bruneau
Microsoft Released Guidance for WannaCrypt
2017-04-28/a>
Xavier Mertens
Another Day, Another Obfuscation Technique
2017-04-19/a>
Xavier Mertens
Hunting for Malicious Excel Sheets
2017-04-05/a>
Xavier Mertens
Whitelists: The Holy Grail of Attackers
2017-03-18/a>
Xavier Mertens
Example of Multiple Stages Dropper
2017-03-12/a>
Guy Bruneau
Honeypot Logs and Tracking a VBE Script
2017-03-08/a>
Xavier Mertens
Not All Malware Samples Are Complex
2017-02-05/a>
Xavier Mertens
Many Malware Samples Found on Pastebin
2017-01-31/a>
Johannes Ullrich
Malicious Office files using fileless UAC bypass to drop KEYBASE malware
2017-01-24/a>
Xavier Mertens
Malicious SVG Files in the Wild
2017-01-06/a>
John Bambenek
Ransomware Operators Cold Calling UK Schools to Get Malware Through
2017-01-05/a>
John Bambenek
New Year's Resolution: Build Your Own Malware Lab?
2017-01-01/a>
Didier Stevens
py2exe Decompiling - Part 1
2016-12-13/a>
Xavier Mertens
UAC Bypass in JScript Dropper
2016-11-11/a>
Rick Wanner
Benevolent malware? reincarna/Linux.Wifatch
2016-10-30/a>
Pasquale Stirparo
Volatility Bot: Automated Memory Analysis
2016-09-30/a>
Xavier Mertens
Another Day, Another Malicious Behaviour
2016-09-13/a>
Rob VandenBrink
If it's Free, YOU are the Product
2016-09-05/a>
Xavier Mertens
Malware Delivered via '.pub' Files
2016-09-01/a>
Xavier Mertens
Maxmind.com (Ab)used As Anti-Analysis Technique
2016-08-25/a>
Xavier Mertens
Out-of-Band iOS Patch Fixes 0-Day Vulnerabilities
2016-08-24/a>
Xavier Mertens
Example of Targeted Attack Through a Proxy PAC File
2016-08-23/a>
Xavier Mertens
Voice Message Notifications Deliver Ransomware
2016-08-01/a>
Daniel Wesemann
Are you getting I-CANNED ?
2016-07-27/a>
Xavier Mertens
Analyze of a Linux botnet client source code
2016-07-25/a>
Didier Stevens
Python Malware - Part 4
2016-07-16/a>
Didier Stevens
Python Malware - Part 3
2016-07-12/a>
Xavier Mertens
Hunting for Malicious Files with MISP + OSSEC
2016-06-20/a>
Xavier Mertens
Ongoing Spam Campaign Related to Swift
2016-06-18/a>
Rob VandenBrink
Controlling JavaScript Malware Before it Runs
2016-05-15/a>
Didier Stevens
Python Malware - Part 1
2016-05-13/a>
Xavier Mertens
MISP - Malware Information Sharing Platform
2016-05-05/a>
Xavier Mertens
Microsoft BITS Used to Download Payloads
2016-05-02/a>
Rick Wanner
Fake Chrome update for Android
2016-04-21/a>
Daniel Wesemann
Decoding Pseudo-Darkleech (#1)
2016-04-21/a>
Daniel Wesemann
Decoding Pseudo-Darkleech (Part #2)
2016-04-10/a>
Didier Stevens
Handling Malware Samples
2016-03-07/a>
Xavier Mertens
Another Malicious Document, Another Way to Deliver Malicious Code
2016-02-24/a>
Xavier Mertens
Analyzis of a Malicious .lnk File with an Embedded Payload
2016-02-18/a>
Xavier Mertens
Hunting for Executable Code in Windows Environments
2016-02-11/a>
Tom Webb
Tomcat IR with XOR.DDoS
2016-01-24/a>
Didier Stevens
Obfuscated MIME Files
2016-01-15/a>
Xavier Mertens
JavaScript Deobfuscation Tool
2016-01-01/a>
Didier Stevens
Failure Is An Option
2015-12-26/a>
Didier Stevens
Malfunctioning Malware
2015-12-16/a>
Xavier Mertens
Playing With Sandboxes Like a Boss
2015-12-06/a>
Mark Hofman
Malware SPAM a new run has started.
2015-11-09/a>
John Bambenek
Protecting Users and Enterprises from the Mobile Malware Threat
2015-09-29/a>
Pedro Bueno
Tricks for DLL analysis
2015-09-28/a>
Johannes Ullrich
"Transport of London" Malicious E-Mail
2015-09-21/a>
Xavier Mertens
Detecting XCodeGhost Activity
2015-04-24/a>
Basil Alawi S.Taher
Fileless Malware
2015-04-09/a>
Brad Duncan
An example of the malicious emails sometimes sent to the ISC handler addresses
2015-03-18/a>
Daniel Wesemann
New SANS memory forensics poster
2015-03-14/a>
Didier Stevens
Maldoc VBA Sandbox/Virtualization Detection
2015-03-08/a>
Brad Duncan
What Happened to You, Asprox Botnet?
2015-02-19/a>
Daniel Wesemann
Macros? Really?!
2014-10-03/a>
Johannes Ullrich
CSAM: The Power of Virustotal to Turn Harmless Binaries Malicious
2014-09-22/a>
Johannes Ullrich
Fake LogMeIn Certificate Update with Bad AV Detection Rate
2014-08-06/a>
Chris Mohan
Free Service to Help CryptoLocker Victims by FireEye and Fox-IT
2014-07-22/a>
Daniel Wesemann
Ivan's Order of Magnitude
2014-07-19/a>
Russ McRee
Keeping the RATs out: the trap is sprung - Part 3
2014-07-18/a>
Russ McRee
Keeping the RATs out: **it happens - Part 2
2014-07-18/a>
Russ McRee
Gameover Zeus reported as "returned from the dead"
2014-07-16/a>
Russ McRee
Keeping the RATs out: an exercise in building IOCs - Part 1
2014-07-05/a>
Guy Bruneau
Malware Analysis with pedump
2014-06-22/a>
Russ McRee
OfficeMalScanner helps identify the source of a compromise
2014-06-08/a>
Guy Bruneau
efax Spam Containing Malware
2014-04-06/a>
Basil Alawi S.Taher
"Power Worm" PowerShell based Malware
2014-04-05/a>
Jim Clausing
Those strange e-mails with URLs in them can lead to Android malware
2014-03-04/a>
Daniel Wesemann
XPired!
2014-02-28/a>
Daniel Wesemann
Fiesta!
2014-01-19/a>
Rick Wanner
Anatomy of a Malware distribution campaign
2013-12-24/a>
Daniel Wesemann
Mr Jones wants you to appear in court!
2013-12-23/a>
Daniel Wesemann
Costco, BestBuy, Walmart really want to send you a package!
2013-12-07/a>
Guy Bruneau
Suspected Active Rovnix Botnet Controller
2013-11-02/a>
Rick Wanner
Protecting Your Family's Computers
2013-10-31/a>
Russ McRee
Happy Halloween: The Ghost Really May Be In The Machine
2013-10-30/a>
Russ McRee
SIR v15: Five good reasons to leave Windows XP behind
2013-10-28/a>
Daniel Wesemann
Exploit cocktail (Struts, Java, Windows) going after 3-month old vulnerabilities
2013-10-24/a>
Johannes Ullrich
False Positive: php.net Malware Alert
2013-09-30/a>
Adrien de Beaupre
Twitter DM spam/malware
2013-09-12/a>
Daniel Wesemann
37.58.73.42 / 95.156.228.69 / 195.210.43.42, anyone?
2013-09-10/a>
Swa Frantzen
Macs need to patch too!
2013-08-29/a>
Russ McRee
Suspect Sendori software
2013-07-04/a>
Russ McRee
Celebrating 4th of July With a Malware PCAP Visualization
2013-06-18/a>
Russ McRee
Volatility rules...any questions?
2013-05-21/a>
Adrien de Beaupre
Moore, Oklahoma tornado charitable organization scams, malware, and phishing
2013-05-17/a>
Daniel Wesemann
e-netprotections.su ?
2013-05-16/a>
Daniel Wesemann
Extracting signatures from Apple .apps
2013-05-11/a>
Lenny Zeltser
Extracting Digital Signatures from Signed Malware
2013-05-01/a>
Daniel Wesemann
The cost of cleaning up
2013-04-10/a>
Manuel Humberto Santander Pelaez
Massive Google scam sent by email to Colombian domains
2013-03-22/a>
Mark Baggett
Wipe the drive! Stealthy Malware Persistence - Part 4
2013-03-20/a>
Mark Baggett
Wipe the drive! Stealthy Malware Persistence - Part 3
2013-03-19/a>
Johannes Ullrich
Scam of the day: More fake CNN e-mails
2013-03-15/a>
Mark Baggett
AVG detect legit file as virus
2013-03-14/a>
Mark Baggett
Wipe the drive! Stealthy Malware Persistence - Part 2
2013-03-13/a>
Mark Baggett
Wipe the drive! Stealthy Malware Persistence Mechanism - Part 1
2013-02-25/a>
Johannes Ullrich
Mass-Customized Malware Lures: Don't trust your cat!
2013-01-08/a>
Jim Clausing
Cuckoo 0.5 is out and the world didn't end
2012-12-18/a>
Rob VandenBrink
All I Want for Christmas is to Not Get Hacked !
2012-12-03/a>
Kevin Liston
Mobile Malware: Request for Field Reports
2012-11-02/a>
Daniel Wesemann
Lamiabiocasa
2012-11-01/a>
Daniel Wesemann
Patched your Java yet?
2012-10-14/a>
Pedro Bueno
Cyber Security Awareness Month - Day 14 - Poor Man's File Analysis System - Part 1
2012-09-21/a>
Guy Bruneau
Storing your Collection of Malware Samples with Malwarehouse
2012-09-14/a>
Lenny Zeltser
Analyzing Malicious RTF Files Using OfficeMalScanner's RTFScan
2012-07-21/a>
Rick Wanner
OpenDNS is looking for a few good malware people!
2012-07-05/a>
Adrien de Beaupre
New OS X trojan backdoor MaControl variant reported
2012-06-27/a>
Swa Frantzen
Online Banking Heists
2012-06-26/a>
Daniel Wesemann
Run, Forest! (Update)
2012-06-25/a>
Rick Wanner
Targeted Malware for Industrial Espionage?
2012-06-25/a>
Swa Frantzen
Belgian online banking customers hacked.
2012-06-22/a>
Daniel Wesemann
Run, Forest!
2012-06-21/a>
Raul Siles
Print Bomb? (Take 2)
2012-06-21/a>
Russ McRee
Analysis of drive-by attack sample set
2012-06-19/a>
Daniel Wesemann
Vulnerabilityqueerprocessbrittleness
2012-06-04/a>
Lenny Zeltser
Decoding Common XOR Obfuscation in Malicious Code
2012-04-26/a>
Richard Porter
Define Irony: A medical device with a Virus?
2012-04-25/a>
Daniel Wesemann
Blacole's obfuscated JavaScript
2012-04-25/a>
Daniel Wesemann
Blacole's shell code
2012-04-12/a>
Guy Bruneau
HP ProCurve 5400 zl Switch, Flash Cards Infected with Malware
2012-04-12/a>
Guy Bruneau
Apple Java Updates for Mac OS X
2012-03-25/a>
Daniel Wesemann
evilcode.class
2012-03-03/a>
Jim Clausing
New automated sandbox for Android malware
2012-02-24/a>
Guy Bruneau
Flashback Trojan in the Wild
2012-02-20/a>
Pedro Bueno
Simple Malware Research Tools
2012-02-20/a>
Rick Wanner
DNSChanger resolver shutdown deadline is March 8th
2012-01-14/a>
Daniel Wesemann
Hello, Antony!
2011-12-28/a>
Daniel Wesemann
.nl.ai ?
2011-12-10/a>
Daniel Wesemann
Unwanted Presents
2011-12-07/a>
Lenny Zeltser
V8 as an Alternative to SpiderMonkey for JavaScript Deobfuscation
2011-11-04/a>
Guy Bruneau
Duqu Mitigation
2011-10-20/a>
Johannes Ullrich
Evil Printers Sending Mail
2011-09-07/a>
Lenny Zeltser
Analyzing Mobile Device Malware - Honeynet Forensic Challenge 9 and Some Tools
2011-08-29/a>
Kevin Shortt
Internet Worm in the Wild
2011-06-15/a>
Pedro Bueno
Hit by MacDefender, Apple Web Security (name your Mac FakeAV here)...
2011-05-25/a>
Daniel Wesemann
Apple advisory on "MacDefender" malware
2011-05-19/a>
Daniel Wesemann
Fake AV Bingo
2011-05-14/a>
Guy Bruneau
Websense Study Claims Canada Next Hotbed for Cybercrime Web Hosting Activity
2011-05-03/a>
Johannes Ullrich
Update on Osama Bin Laden themed Malware
2011-05-02/a>
Johannes Ullrich
Bin Laden Death Related Malware
2011-04-23/a>
Manuel Humberto Santander Pelaez
Image search can lead to malware download
2011-03-01/a>
Daniel Wesemann
AV software and "sharing samples"
2011-02-07/a>
Pedro Bueno
The Good , the Bad and the Unknown Online Scanners
2011-02-01/a>
Lenny Zeltser
The Importance of HTTP Headers When Investigating Malicious Sites
2010-12-29/a>
Daniel Wesemann
Malware Domains 2234.in, 0000002.in & co
2010-12-29/a>
Daniel Wesemann
Beware of strange web sites bearing gifts ...
2010-10-26/a>
Pedro Bueno
Cyber Security Awareness Month - Day 26 - Sharing Office Files
2010-09-09/a>
Marcus Sachs
'Here You Have' Email
2010-07-21/a>
Adrien de Beaupre
Dell PowerEdge R410 replacement motherboard firmware contains malware
2010-07-21/a>
Adrien de Beaupre
autorun.inf and .lnk Malware (NOT 'Vulnerability in Windows Shell Could Allow Remote Code Execution' 2286198)
2010-07-06/a>
Rob VandenBrink
Bogus Support Organizations use Live Operators to Install Malware
2010-07-04/a>
Manuel Humberto Santander Pelaez
Malware inside PDF Files
2010-06-17/a>
Deborah Hale
FYI - Another bogus site
2010-06-14/a>
Manuel Humberto Santander Pelaez
Rogue facebook application acting like a worm
2010-06-07/a>
Manuel Humberto Santander Pelaez
Software Restriction Policy to keep malware away
2010-06-02/a>
Rob VandenBrink
New Mac malware - OSX/Onionspy
2010-05-26/a>
Bojan Zdrnja
Malware modularization and AV detection evasion
2010-05-23/a>
Manuel Humberto Santander Pelaez
e-mail scam announcing Fidel Castro's funeral ... and nasty malware to your computer.
2010-05-21/a>
Rick Wanner
IBM distributes malware at AusCERT!
2010-04-30/a>
Kevin Liston
The Importance of Small Files
2010-04-19/a>
Daniel Wesemann
Linked into scams?
2010-04-18/a>
Guy Bruneau
Some NetSol hosted sites breached
2010-04-13/a>
Johannes Ullrich
More Legal Threat Malware E-Mail
2010-03-30/a>
Pedro Bueno
Sharing the Tools
2010-03-26/a>
Daniel Wesemann
Getting the EXE out of the RTF again
2010-03-09/a>
Marcus Sachs
Energizer Malware
2010-03-04/a>
Daniel Wesemann
salefale-dot-com is bad
2010-03-03/a>
Johannes Ullrich
Reports about large number of fake Amazon order confirmations
2010-02-21/a>
Patrick Nolan
Looking for "more useful" malware information? Help develop the format.
2010-01-14/a>
Bojan Zdrnja
PDF Babushka
2010-01-07/a>
Daniel Wesemann
Static analysis of malicious PDFs
2010-01-07/a>
Daniel Wesemann
Static analysis of malicous PDFs (Part #2)
2009-12-17/a>
Daniel Wesemann
overlay.xul is back
2009-12-17/a>
Daniel Wesemann
In caches, danger lurks
2009-12-16/a>
Rob VandenBrink
Beware the Attack of the Christmas Greeting Cards !
2009-12-07/a>
Rick Wanner
Cheat Sheet: Analyzing Malicious Documents
2009-12-04/a>
Daniel Wesemann
Max Power's Malware Paradise
2009-12-02/a>
Rob VandenBrink
SPAM and Malware taking advantage of H1N1 concerns
2009-11-25/a>
Jim Clausing
Updates to my GREM Gold scripts and a new script
2009-09-25/a>
Lenny Zeltser
Categories of Common Malware Traits
2009-09-25/a>
Deborah Hale
Conficker Continues to Impact Networks
2009-09-25/a>
Deborah Hale
Malware delivered over Google and Yahoo Ad's?
2009-09-04/a>
Adrien de Beaupre
Fake anti-virus
2009-08-29/a>
Guy Bruneau
Immunet Protect - Cloud and Community Malware Protection
2009-08-26/a>
Johannes Ullrich
Malicious CD ROMs mailed to banks
2009-07-26/a>
Jim Clausing
New Volatility plugins
2009-07-03/a>
Adrien de Beaupre
Happy 4th of July!
2009-07-02/a>
Daniel Wesemann
Getting the EXE out of the RTF
2009-07-02/a>
Bojan Zdrnja
Cold Fusion web sites getting compromised
2009-06-16/a>
John Bambenek
Iran Internet Blackout: Using Twitter for Operational Intelligence
2009-06-16/a>
John Bambenek
URL Shortening Service Cligs Hacked
2009-06-04/a>
Raul Siles
Malware targetting banks ATM's
2009-06-04/a>
Raul Siles
Targeted e-mail attacks asking to verify wire transfer details
2009-06-01/a>
G. N. White
Yet another "Digital Certificate" malware campaign
2009-05-20/a>
Pedro Bueno
Cyber Warfare and Kylin thoughts
2009-05-07/a>
Deborah Hale
Malicious Content on the Web
2009-05-04/a>
Tom Liston
Facebook phishing malware
2009-04-24/a>
Pedro Bueno
Did you check your conference goodies?
2009-03-13/a>
Bojan Zdrnja
When web application security, Microsoft and the AV vendors all fail
2009-02-23/a>
Daniel Wesemann
Turf War
2009-02-23/a>
Daniel Wesemann
And the Oscar goes to...
2009-02-10/a>
Bojan Zdrnja
More tricks from Conficker and VM detection
2009-02-09/a>
Bojan Zdrnja
Some tricks from Conficker's bag
2009-02-04/a>
Daniel Wesemann
Titan Shields up!
2009-01-31/a>
John Bambenek
Google Search Engine's Malware Detection Broken
2009-01-24/a>
Pedro Bueno
Identifying and Removing the iWork09 Trojan
2009-01-18/a>
Daniel Wesemann
3322. org
2009-01-15/a>
Bojan Zdrnja
Conficker's autorun and social engineering
2009-01-12/a>
William Salusky
Downadup / Conficker - MS08-067 exploit and Windows domain account lockout
2009-01-07/a>
Bojan Zdrnja
An Israeli patriot program or a trojan
2009-01-02/a>
Rick Wanner
Tools on my Christmas list.
2008-12-25/a>
Maarten Van Horenbeeck
Merry Christmas, and beware of digital hitchhikers!
2008-12-25/a>
Maarten Van Horenbeeck
Christmas Ecard Malware
2008-12-17/a>
donald smith
Team CYMRU's Malware Hash Registry
2008-12-05/a>
Daniel Wesemann
Been updatin' your Flash player lately?
2008-12-05/a>
Daniel Wesemann
Baby, baby!
2008-12-04/a>
Bojan Zdrnja
Rogue DHCP servers
2008-11-17/a>
Jim Clausing
Finding stealth injected DLLs
2008-11-16/a>
Maarten Van Horenbeeck
Detection of Trojan control channels
2008-11-12/a>
John Bambenek
Thoughts on Security Intelligence (McColo Corp alleged spam/malware host knocked offline)
2008-11-11/a>
Swa Frantzen
Acrobat continued activity in the wild
2008-11-10/a>
Stephen Hall
Adobe Reader Vulnerability - part 2
2008-10-07/a>
Kyle Haugsness
Good reading and a malware challenge
2008-09-29/a>
Daniel Wesemann
ASPROX mutant
2008-09-22/a>
Maarten Van Horenbeeck
Data exfiltration and the use of anonymity providers
2008-09-18/a>
Bojan Zdrnja
Monitoring HTTP User-Agent fields
2008-09-07/a>
Lorna Hutcheson
Malware Analysis: Tools are only so good
2008-09-03/a>
Daniel Wesemann
Static analysis of Shellcode
2008-09-03/a>
Daniel Wesemann
Static analysis of Shellcode - Part 2
2008-09-01/a>
John Bambenek
The Number of Machines Controlled by Botnets Has Jumped 4x in Last 3 Months
2008-08-13/a>
Adrien de Beaupre
CNN switched to MSNBC
2008-08-05/a>
Daniel Wesemann
The news update you never asked for
2008-07-20/a>
Kevin Liston
Malware Intelligence: Making it Actionable
2008-07-15/a>
Maarten Van Horenbeeck
Extracting scripts and data from suspect PDF files
2008-07-14/a>
Daniel Wesemann
Obfuscated JavaScript Redux
2008-07-07/a>
Pedro Bueno
Bad url classification
2008-06-18/a>
Marcus Sachs
Olympics Part II
2008-06-14/a>
Lorna Hutcheson
Malware Detection - Take the Blinders Off
2008-06-10/a>
Swa Frantzen
Ransomware keybreaking
2008-06-01/a>
Mark Hofman
Free Yahoo email account! Sign me up, Ok well maybe not.
2008-05-28/a>
Adrien de Beaupre
Another example of malicious SWF
2008-05-27/a>
Adrien de Beaupre
Malicious swf files?
2008-05-26/a>
Marcus Sachs
Predictable Response
2008-05-14/a>
Bojan Zdrnja
War of the worlds?
2008-05-02/a>
Adrien de Beaupre
Hi, remember me?...
2008-04-30/a>
Bojan Zdrnja
(Minor) evolution in Mac DNS changer malware
2008-04-24/a>
Maarten Van Horenbeeck
Targeted attacks using malicious PDF files
2008-04-16/a>
Bojan Zdrnja
The 10.000 web sites infection mystery solved
2008-04-15/a>
Johannes Ullrich
SRI Malware Threat Center
2008-04-14/a>
John Bambenek
A Federal Subpoena or Just Some More Spam & Malware?
2008-04-07/a>
John Bambenek
HP USB Keys Shipped with Malware for your Proliant Server
2008-04-07/a>
John Bambenek
Got Kraken?
2008-04-07/a>
John Bambenek
Kraken Technical Details: UPDATED x3
2008-04-06/a>
Daniel Wesemann
Advanced obfuscated JavaScript analysis
2008-04-04/a>
Daniel Wesemann
nmidahena
2008-04-03/a>
Bojan Zdrnja
VB detection: is it so difficult?
2008-04-02/a>
Adrien de Beaupre
When is a DMG file not a DMG file
2008-03-27/a>
Maarten Van Horenbeeck
Guarding the guardians: a story of PGP key ring theft
2006-08-31/a>
Swa Frantzen
NT botnet submitted
2000-01-02/a>
Deborah Hale
2010 A Look Back - 2011 A Look Ahead
Homepage
Diaries
Podcasts
Jobs
Data
TCP/UDP Port Activity
Port Trends
SSH/Telnet Scanning Activity
Weblogs
Threat Feeds Activity
Threat Feeds Map
Useful InfoSec Links
Presentations & Papers
Research Papers
API
Tools
DShield Sensor
DNS Looking Glass
Honeypot (RPi/AWS)
InfoSec Glossary
Contact Us
Contact Us
About Us
Handlers
About Us
Slack Channel
Mastodon
Bluesky
X
This site is powered by
your submissions
, so tell us
what you see happening