Conti pivots as ransomware as a service struggles

The resurgence of the Conti ransomware group in the face of leaks and takedowns is worth paying attention to -and a signal of trouble ahead for enterprises

Wiper malware targeting Ukraine: Evidence of planning, and haste

Ukrainian organizations have been targeted by hundreds of attacks in recent weeks, including two new examples of destructive wiper malware. We take a closer look at HermeticWiper and IsaacWiper.

Microsoft disables Excel, Office macros by default. Will it matter?

ReversingLabs data shows that attachments that use decades-old scripting languages like XLM and VBA are often malicious. Still, Microsoft’s move to harden Excel and other Office apps may not move the security needle.

After Russian arrests, REvil ransomware implants persist

Almost two weeks after Russian authorities claimed to have dismantled the REvil ransomware group with a string of arrests, evidence for a reduction in the availability of REvil implants has yet to appear.

Here’s what happened with Log4Shell while you were out

A look back at 2021: The year ransomware took the gloves off

We came into 2021 well aware of the risks ransomware posed. Even that didn’t prepare us for what was to come, as ransomware gangs and nation states launched attacks on critical infrastructure with cyber-physical consequences

A look back at 2021: The year supply chain threats went mainstream

Ransomware may have grabbed most of the headlines, but history will remember 2021 as the year that governments and companies finally woke up to the lurking threat posed by vulnerable software supply chains

Groundhog day: NPM package caught stealing browser passwords

This blog discusses the process used to find another NPM package that steals saved Chrome browser passwords.

Data Exfiltrator

A New Tactic for Ransomware Adversaries

Third-party code comes with some baggage

Recognizing risks introduced by statically linked third-party libraries

It only takes one line of code to ruin your day

They say there’s no such thing as bad press, but getting name recognition for a data breach never feels good. Enter Codecov.

Spotting malicious Excel4 macros

Relying on legacy functionalities comes with inherent security risks

Code Reuse Across Packers and DLL Loaders

One of the core tenets of computer science is code reuse.

DotNET Loaders

Many families of remote access trojan (RAT) are .NET executables.

Malware in images: When you can’t see 'the whole picture'