会社名 > ブログ

セキュアなデジタルトランスフォーメーションの第一人者が発信するニュースと知見

この著者の詳細

ユーザのプロフィール写真 Brett Stone-Gross

Brett Stone-Gross

Director of Threat Intelligence
Pikabot reverse engineering
Threatlabzリサーチ
9 分で読了

Technical Analysis of Pikabot

Key Points Pikabot is a new malware trojan that emerged in early 2023 that consists of two components: a loader and a core module. The core module implements the malicious functionality that includes the ability ...
Ransomware
ランサムウェア
10 分で読了

Technical Analysis of CryptNet Ransomware

Key Points CryptNet is a new ransomware-as-a-service that has been advertised in underground forums since at least April 2023 The CryptNet threat group claims to perform double extortion attacks by combining...
Smash PostScript Interpreters Using a Syntax-Aware Fuzzer
Threatlabzリサーチ
9 分で読了

Smash PostScript Interpreters Using A Syntax-Aware Fuzzer

In 2022, Zscaler’s ThreatLabz performed vulnerability hunting for some of the most popular PostScript interpreters using a custom-built syntax-aware fuzzer. The PostScript interpreters that were evaluated include Adobe A...
Trigona ransomware
ランサムウェア
14 分で読了

Technical Analysis of Trigona Ransomware

Key Points Trigona is a ransomware family written in the Delphi programming language that has been active since at least June 2022 The Trigona threat group claims to perform double extortion attacks by combining ...
Nevada ransomware
ランサムウェア
6 分で読了

Nevada Ransomware: Yet Another Nokoyawa Variant

Key Points Nevada ransomware was advertised in criminal forums in December 2022 as part of a new ransomware-as-a-service affiliate program Nevada is written in the Rust programming language with support for Linu...
Ransomware hacker
ランサムウェア
5 分で読了

Nokoyawa Ransomware: Rust or Bust

Key Points Nokoyawa is a 64-bit Windows-based ransomware family that emerged in February 2022 The threat group behind Nokoyawa performs double extortion ransomware attacks: exfiltrating sensitive information from...
BlackBasta Hacker
ランサムウェア
7 分で読了

Back in Black... Basta

Key Points BlackBasta emerged in February 2022 with double extortion ransomware attacks against organizations The threat group exfiltrates sensitive information from organizations before performing file encryptio...
Technical Analysis of Windows CLFS Zero-Day Vulnerability CVE-2022-37969 - Part 2: Exploit Analysis
セキュリティ インサイト
19 分で読了

Technical Analysis of Windows CLFS Zero-Day Vulnerability CVE-2022-37969 - Part 2: Exploit Analysis

In Part 1 of this blog series, we analyzed the root cause for CVE-2022-37969. In this blog, we will present an in-the-wild exploit that was discovered by Zscaler ThreatLabz that successfully leveraged CVE-2022-37969 for ...
Windows Common Log File System Driver Privilege Escalation Zero-Day Vulnerability CVE-2022-37969
セキュリティ インサイト
19 分で読了

Technical Analysis of Windows CLFS Zero-Day Vulnerability CVE-2022-37969 - Part 1: Root Cause Analysis

On September 2, 2022, Zscaler Threatlabz captured an in-the-wild 0-day exploit in the Windows Common Log File System Driver (CLFS.sys) and reported this discovery to Microsoft. In the September Tuesday patch, Microsoft f...
Malware
セキュリティ インサイト
9 分で読了

The Ares Banking Trojan Learns Old Tricks: Adds the Defunct Qakbot DGA

Summary: ThreatLabz observed an update to the Ares banking trojan that introduces a domain generation algorithm (DGA), which mirrors the Qakbot DGA. Based on analyzing the malware code, there does not appear to be a dire...
Analysis of Adobe Acrobat Reader Javascript Doc.print() Use-After-Free Vulnerability (CVE-2022-34233)
セキュリティ インサイト
3 分で読了

Analysis of Adobe Acrobat Reader Javascript Doc.print() Use-After-Free Vulnerability (CVE-2022-34233)

In July 2022, Adobe released a security update for vulnerabilities in Adobe Acrobat and Reader. The update fixed a vulnerability that is identified as CVE-2022-34233 discovered by the Zscaler ThreatLabz research team. In...
2022年ThreatLabzランサムウェア現状レポート
ランサムウェア
6 分で読了

2022年ThreatLabzランサムウェア現状レポート

Zscalerクラウドで検知されたランサムウェアペイロードの分析から、ランサムウェア攻撃が2021年2月～2022年3月にさらに80%増加したことがわかりました。暗号化に情報漏洩を加えた二重恐喝攻撃の増加の勢いがさらに加速し、前年比117%を記録しました。 2022年ThreatLabzランサムウェア現状レポートでは、Zscaler Zero Trust Exchangeで処理される1日あたり2,000億件以上のトランザクションとブロ...
cover image
セキュリティ インサイト
11 分で読了

Vidar distributed through backdoored Windows 11 downloads and abusing Telegram

Summary In April 2022, ThreatLabz discovered several newly registered domains, which were created by a threat actor to spoof the official Microsoft Windows 11 OS download portal. We discovered these domains by monitor...
Cyber honeycomb containing locks.
セキュリティ インサイト
7 分で読了

Peeking into PrivateLoader

Key Points PrivateLoader is a downloader malware family that was first identified in early 2021 The loader’s primary purpose is to download and execute additional malware as part of a pay-per-install (PPI) malwar...
Zscaler ThreatLabz Discovers Multiple Product Bugs in Adobe Acrobat
セキュリティ インサイト
3 分で読了

Zscaler ThreatLabz Discovers Multiple Product Bugs in Adobe Acrobat

In April 2022, Adobe released security update APSB22-16. This update fixed five product bugs that Zscaler’s ThreatLabz reported in Adobe Acrobat that are related to EMF (Enhanced Metafile Format) parsing. Adobe determine...
Ransomware
セキュリティ インサイト
8 分で読了

Conti Ransomware Attacks Persist With an Updated Version Despite Leaks

In late January 2022, ThreatLabz identified an updated version of Conti ransomware as part of the global ransomware tracking efforts. This update was released prior to the massive leak of Conti source code and chat logs ...
CVE-2021-44708
セキュリティ インサイト
10 分で読了

Analysis of Adobe Acrobat Pro DC Solid Framework Heap-based Buffer Overflow Vulnerability (CVE-2021-44708)

In January 2022, Adobe released a security update for vulnerabilities in Adobe Acrobat and Reader. The update fixed five vulnerabilities (CVE-2021-44703, CVE-2021-44708, CVE-2021-44709, CVE-2021-44740, and CVE-2021-44741...
Cyber honeycomb containing locks.
セキュリティ インサイト
4 分で読了

DanaBot Launches DDoS Attack Against the Ukrainian Ministry of Defense

March 7, 2022 Update DanaBot affiliate ID 5 has stopped DDoSing the Ukrainian Ministry of Defense’s webmail server and started DDoSing a hardcoded IP address, 138.68.177[.]158. According to Passive DNS data, this...
ランサムウェアハッカー
ランサムウェア
4 分で読了

PartyTicket Ransomwareの技術的分析

要点 PartyTicketは、精巧さに欠ける貧弱な設計のランサムウェア系列で、Hermetic wiper攻撃からの注意を逸らすことを意図していると思われます。 このランサムウェアは、GCMモードでターゲットファイルを暗号化するために使用される単一のAESキーを生成します。 AESのキーは決定論的なランダム関数で生成されるため、RSAの秘密キーにアクセスできなくてもファイルを復号することが可能です 技術分析 2022年...
Ukraineの標的型攻撃
セキュリティ インサイト
11 分で読了

ウクライナでのHermeticWiperと標的型攻撃の再活性化

まとめ 2022年1月以来、ThreatLabzは、ウクライナに対する標的型攻撃の再活発化を確認しています。これまでに2022年1月から2月の期間内に2つの攻撃チェーンを特定しましたが、これは中程度の信頼水準を備えた同一の脅威アクターによるものです。最終のペイロードと攻撃の動機を完全に掴み切れていないため、現時点ではこの攻撃が国家が支援する脅威アクターによるものか断定できないことに注意することが重要です。C2インフラストラクチャの再利...
Analysis of Adobe Acrobat Pro DC Solid Framework Out-of-Bounds Read Vulnerability (CVE-2021-40729)
セキュリティ インサイト
11 分で読了

Analysis of Adobe Acrobat Pro DC Solid Framework Out-of-Bounds Read Vulnerability (CVE-2021-40729)

Summary In October 2021, Adobe released a security update for vulnerabilities in Adobe Acrobat and Reader. Among these vulnerabilities is an out-of-bounds read (CVE-2021-40729) that was discovered by Zscaler’s ThreatL...
Cyber security
セキュリティ インサイト
11 分で読了

Squirrelwaffle: New Loader Delivering Cobalt Strike

Zscaler ThreatLabz has been following an emerging new malware loader known as Squirrelwaffle that is being used to deliver Cobalt Strike. In this blog, we will be analyzing the complete attack chain for this new malware ...
Ransomware hacker
ランサムウェア
3 分で読了

DoppelPaymer Continues to Cause Grief Through Rebranding

In early May 2021, DoppelPaymer ransomware activity dropped significantly. Although the DoppelPaymer leak site still remains online, there has not been a new victim post since May 6, 2021. In addition, no victim posts ha...
Kaseya Supply Chain Ransomware Attack - Technical Analysis of the REvil Payload
セキュリティ インサイト
8 分で読了

Kaseya Supply Chain Ransomware Attack - Technical Analysis of the REvil Payload

On July 2, 2021, Kaseya, an IT Management software firm, disclosed a security incident impacting their on-premises version of Kaseya's Virtual System Administrator (VSA) software. Kaseya VSA is a cloud-based Managed Serv...
Ares malware
セキュリティ インサイト
17 分で読了

Ares Malware: The Grandson of the Kronos Banking Trojan

Kronos is a banking trojan that first emerged in 2014 and marketed in underground forums as a crimeware kit to conduct credit card, identity theft, and wire fraud. In September 2018, a new Kronos variant named Osiris int...
Botnets
セキュリティ インサイト
32 分で読了

DreamBus Botnet – Technical Analysis

Zscaler’s ThreatLabZ research team recently analyzed a Linux-based malware family that we have dubbed the DreamBus Botnet. The malware is a variant of SystemdMiner, which consists of a series of Executable and Linkable F...

関連する記事

さらにトピックを探す