Proactive Threat Hunting with A.I.

Proactive Threat Hunting helps in the early detection of new threats and in the discovery of weak spots that can be leveraged by an attacker to gain or maintain access to an infrastructure.  Traditional IOCs, combined with ATT&CK Mitre TTPs and Artificial Intelligence for discovery of new behaviors raises the bar for the attackers, helping responders to identify breaches at a very early stage, enabling them to contain and mitigate the attacks quickly and effectively.
Continue reading “Proactive Threat Hunting with A.I.”

Ursnif reloaded: tracing the latest trojan campaigns

On the 9th of October our customers started reporting the same kind of incident over the span of a few hours. The identified activity appears to be linked to the banking Trojan Ursnif, a long active malware, whose roots can be traced back to 2007 together with ZeuS and SpyEye, still with strong infection capabilities in each of its campaigns. The attack vector was a malicious email with a Word document attached.
Continue reading “Ursnif reloaded: tracing the latest trojan campaigns”

Banks and crypto wallets: unveiling a global malware campaign using Zeus/Panda

For the past weeks our Threat Intelligence team has been following an enxtesive campaign, possibly operated by the same group, targeting a large amount of financial institutions, cyptocurrency wallets and the occasional Google and Apple accounts. The attackers target their victims both with Phishing emails, typo-squatted domains and malicious attachments that eventually lead to the installation of Zeus/Panda banking malware. The group appears to be active since at least 2015 and it’s most likely related to several campaigns identified by the security community in the past 3 years.
Continue reading “Banks and crypto wallets: unveiling a global malware campaign using Zeus/Panda”

Active Learning as a powerful tool in the Cyber Security arsenal

When datasets are hard to label or highly skewed, Active Learning shows great potential to help both the algorithms and the analyst to make sense of data faster and more efficiently.

The promise of AI in cyber-security has long been that of helping humans to automate and simplify the daunting task of preventing data loss by detecting, tracking and blocking malicious software and intruders. AI is a tremendously powerful tool for such a task but, unlike what happens in other domains, gathering and labelling data to train any kind of engine/classifier is not only expensive but also hard.
Continue reading “Active Learning as a powerful tool in the Cyber Security arsenal”

Spear-phishing campaign leveraging on MSXSL

We have identified an ongoing spear-phishing campaign targeting a variety of entities with malicious RTF documents exploiting three different vulnerabilities: CVE-2017-8570, CVE-2017-11882 and CVE-2018-0802 and taking advantage of a misplaced trust binary, Microsoft’s msxsl, to run a JScript backdoor. The whole attack chain leverages on system’s signed components to remain under the radar as much as possible and it shares many similarities with previous campaigns from the Cobalt Group.
Continue reading “Spear-phishing campaign leveraging on MSXSL”

A dive into MuddyWater APT targeting Middle-East

MuddyWater is a threat actor that caught our attention for their extensive use of “Living off the Land” attacks in a targeted campaign aimed at the Middle East. During our investigation we reconstruct the evolution of the vectors used and how the group operates to  target their victims, evade detections and move laterally inside the compromised infrastructures.
Continue reading “A dive into MuddyWater APT targeting Middle-East”