Blog | ReversingLabs | Threat Research (4)

Threat Research (4)

July 21, 2023

From the Labs: YARA Rule for Detecting Minodo

In this edition, we take a look at what Minodo is, where it came from, and how cybercriminals are using it to deliver other malware families.

July 7, 2023

From the Labs: YARA Rule for Detecting StealC

In this edition of From the Labs, we contextualize StealC, a popular malware infostealer that has become a favored tool for cybercriminals.

July 6, 2023

Operation Brainleeches: Malicious npm packages fuel supply chain and phishing attacks

“Write once, infect everywhere” might be the new cybercrime motto, with newly discovered campaigns showing malicious npm packages powering phishing kits and supply chain attacks.

June 16, 2023

From the Labs: YARA Rule for Detecting HermeticRansom

The ReversingLabs YARA detection rule for HermeticRansom can help you find this ransomware in your environment.

June 1, 2023

When byte code bites: Who checks the contents of compiled Python files?

ReversingLabs researchers identified a PyPI attack using compiled Python code to evade detection — possibly the first PYC file direct-execution attack.

May 18, 2023

RATs found hiding in the npm attic

ReversingLabs researchers discovered two malicious packages that contained TurkoRat, an infostealer that lurked on npm for months before being detected.

May 12, 2023

Detecting Debugger Evasion: Exception Flooding

ReversingLabs researchers created detection YARA rules for a debugger evasion recently added to the Malware Behavior Catalog as Exception Flooding.

May 9, 2023

Red teamers take on AI at DEF CON 31

It takes a village... In Las Vegas, researchers play capture the flag to find vulnerabilities in tools like ChatGPT — with a White House assist.

April 24, 2023

Package names repurposed to push malware on PyPI

What’s in a name? Here's how bad actors are pushing malware on the Python Package Index under the guise of legitimate yet abandoned open source modules.