After introducing a couple of common techniques that malware uses to obscure its access to the Windows API, we present an open source tool we developed that can be used to resolve addresses from a process running in a virtual machine by an IDA script.
Read more...Threat Research Blog
The FireEye Labs team posts blog entries under threat research to present and discuss cyber attacks and threat intelligence from a technical perspective. They cover the full spectrum of exploits and vulnerabilities, including advanced malware and targeted threats.
FIN10: Anatomy of a Cyber Extortion Operation
June 16, 2017 8:00 AM By David Mainor, Charles Carmakal, Charles Prevost, Nick Richard | Threat ResearchFireEye has identified a set of financially motivated intrusion operations being carried out by an actor we have dubbed FIN10.
Read more...Behind the CARBANAK Backdoor
June 12, 2017 11:00 AM By James T. Bennett, Barry Vengerik | Threat ResearchIn this blog we take a closer look at the powerful, versatile backdoor known as CARBANAK (aka Anunak).
Read more...Privileges and Credentials: Phished at the Request of Counsel
June 6, 2017 6:30 PM By Ian Ahl | Threat ResearchFireEye observed a phishing campaign targeting at least seven global law and investment firms and has associated this campaign with APT19.
Read more...Threat actors leverage EternalBlue exploit to deliver non-WannaCry payloads
June 2, 2017 9:00 AM By Ali Islam, Barry Vengerik, Christopher Glyer, Haroon W Malik, Zain Gardezi | Advanced Malware, Threat Research
The “EternalBlue” exploit (MS017-010) was initially used by WannaCry ransomware and Adylkuzz cryptocurrency miner. Now more threat actors are leveraging the vulnerability in Microsoft Server Message Block (SMB) protocol – this time to distribute Backdoor.Nitol and Trojan Gh0st RAT. FireEye Dynamic Threat Intelligence (DTI) has historically observed similar payloads delivered via exploitation of CVE-2014-6332 vulnerability as well as in some email spam campaigns using powershell commands. Specifically, Backdoor.Nitol has also been linked Read more...
Video
See How to Stop the WannaCry Ransomware
Sign up for email updates
Get information and insight on today's advanced threats from the leader in advanced threat prevention.
